From 2b54c7fbcb467472c01fca938724a5904beb0055 Mon Sep 17 00:00:00 2001
From: Bert-Jan Fikse <bert-jan@whatwedo.ch>
Date: Fri, 13 Mar 2026 14:37:02 +0100
Subject: [PATCH] feat: add drawio instance for nextcloud and opencloud

Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
---
 .../vagrant/host_vars/backend/nextcloud.yml        | 14 ++++++++++++++
 .../vagrant/host_vars/backend/opencloud.yml        | 10 ++++++++--
 inventories/vagrant/host_vars/backend/traefik.yml  |  4 ++++
 inventories/vagrant/hosts.yml                      |  4 ++++
 playbooks/site.yml                                 |  6 ++++++
 5 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/inventories/vagrant/host_vars/backend/nextcloud.yml b/inventories/vagrant/host_vars/backend/nextcloud.yml
index 22b5435..cbd8825 100644
--- a/inventories/vagrant/host_vars/backend/nextcloud.yml
+++ b/inventories/vagrant/host_vars/backend/nextcloud.yml
@@ -1,4 +1,18 @@
 nextcloud_collabora_disable_cert_verification: true
+
+# Draw.io integration
+nextcloud_enable_drawio: true
+nextcloud_drawio_url: "https://drawio.local.test"
+
+# Apps to install (override defaults to include drawio)
+nextcloud_apps_to_install:
+  - groupfolders
+  - richdocuments
+  - spreed
+  - user_ldap
+  - user_oidc
+  - whiteboard
+  - drawio
 nextcloud_allow_local_remote_servers: true  # Allow requests to local network in Vagrant
 nextcloud_oidc_allow_selfsigned: true  # Allow self-signed certs for OIDC in Vagrant
 
diff --git a/inventories/vagrant/host_vars/backend/opencloud.yml b/inventories/vagrant/host_vars/backend/opencloud.yml
index 72e1538..a40c9c1 100644
--- a/inventories/vagrant/host_vars/backend/opencloud.yml
+++ b/inventories/vagrant/host_vars/backend/opencloud.yml
@@ -5,6 +5,7 @@ opencloud_extra_hosts:
   - "keycloak.local.test:host-gateway"
   - "storage.local.test:192.168.56.11"
   - "office.local.test:host-gateway"
+  - "drawio.local.test:host-gateway"
   - "389ds:192.168.56.11"
 
 # OIDC configuration (Keycloak)
@@ -31,6 +32,11 @@ opencloud_ldap_bind_password: "admin"
 opencloud_ldap_user_base_dn: "ou=users,dc=local,dc=test"
 opencloud_ldap_group_base_dn: "ou=groups,dc=local,dc=test"
 
-# Allow OpenCloud to connect to Keycloak for OIDC discovery
+# Draw.io integration
+opencloud_drawio_url: "https://drawio.local.test"
+
+# CSP configuration
 opencloud_csp_extra_connect_src:
-  - "https://keycloak.local.test/"
\ No newline at end of file
+  - "https://keycloak.local.test/"
+opencloud_csp_extra_frame_src:
+  - "https://drawio.local.test/"
\ No newline at end of file
diff --git a/inventories/vagrant/host_vars/backend/traefik.yml b/inventories/vagrant/host_vars/backend/traefik.yml
index 795fd2e..e123dc1 100644
--- a/inventories/vagrant/host_vars/backend/traefik.yml
+++ b/inventories/vagrant/host_vars/backend/traefik.yml
@@ -28,6 +28,10 @@ traefik_dmz_exposed_services:
     domain: opencloud.local.test
     port: 443
     protocol: https
+  - name: drawio
+    domain: drawio.local.test
+    port: 443
+    protocol: https
   # Example: Add more services as you deploy them
   # - name: forgejo
   #   domain: git.example.com
diff --git a/inventories/vagrant/hosts.yml b/inventories/vagrant/hosts.yml
index 27cf21d..5dcd0c6 100644
--- a/inventories/vagrant/hosts.yml
+++ b/inventories/vagrant/hosts.yml
@@ -69,6 +69,10 @@ all:
       hosts:
         backend:
 
+    drawio_servers:
+      hosts:
+        backend:
+
     opencloud_servers:
       hosts:
         backend:
\ No newline at end of file
diff --git a/playbooks/site.yml b/playbooks/site.yml
index 807dc31..4e75791 100644
--- a/playbooks/site.yml
+++ b/playbooks/site.yml
@@ -53,6 +53,12 @@
   roles:
     - digitalboard.core.authentik
 
+- name: Deploy drawio service
+  hosts: drawio_servers
+  become: yes
+  roles:
+    - digitalboard.core.drawio
+
 - name: Deploy opencloud service
   hosts: opencloud_servers
   become: yes