nextcloud: Make HArP optional and opt-in

roles/nextcloud/defaults/main.yaml

@@ -1,2 +1,3 @@
 ---
 nextcloud_tag: stable
+nextcloud_install_harp: false

roles/nextcloud/meta/argument_specs.yaml

@@ -8,7 +8,7 @@ argument_specs:
         type: list
         required: true
         elements: str
-      nextcloud_admin_pw:
+      nextcloud_admin_password:
         description: Password of the initial admin user
         type: str
         required: true
@@ -17,3 +17,8 @@ argument_specs:
         type: str
         required: false
         default: stable
+      nextcloud_install_harp:
+        description: Whether to install HaRP for nextcloud
+        type: bool
+        required: false
+        default: false

roles/nextcloud/tasks/main.yaml

@@ -14,8 +14,8 @@
         source: data
         destination: /var/www/html
     service_container_secrets:
-      - name: adminpw
+      - name: admin-password
-        value: "{{ nextcloud_admin_pw }}"
+        value: "{{ nextcloud_admin_password }}"
       - name: harp-shared-key
     service_container_env:
       POSTGRES_HOST: postgres
@@ -26,39 +26,6 @@
       TRUSTED_PROXIES: 10.0.0.0/8
       NEXTCLOUD_TRUSTED_DOMAINS: "{{ nextcloud_domains | join(' ') }}"
       NEXTCLOUD_ADMIN_USER: admin
-      NEXTCLOUD_ADMIN_PASSWORD_FILE: /run/secrets/adminpw
+      NEXTCLOUD_ADMIN_PASSWORD_FILE: /run/secrets/admin-password
-    service_additional_containers:
+    service_additional_containers: "{{ _nextcloud_additional_containers }}"
-      - name: cron
+    service_vhost_locations: "{{ _nextcloud_vhost_locations }}"
-        entrypoint: /cron.sh
-      - name: harp
-        add_capabilities:
-          - CAP_SYS_ADMIN
-        image: quay.io/podman/stable:latest
-        user: podman
-        entrypoint: /entrypoint.sh
-        devices:
-          - source: /dev/fuse
-        mounts:
-          - type: template
-            source: containers.conf.j2
-            destination: /etc/containers/containers.conf
-          - type: template
-            source: harp_entrypoint.sh.j2
-            destination: /entrypoint.sh
-            mode: "0755"
-          - type: volume
-            source: harp-certs
-            destination: /certs
-#          - type: volume
-#            source: harp-containers
-#            destination: /home/podman/.local/share/containers
-        env: {}
-        secrets:
-          - name: harp-shared-key
-        publish_ports:
-          - name: harp
-            type: socket
-            container_port: 8780
-    service_vhost_locations:
-      - path: /exapps/*
-        proxy_target_socket: /run/nextcloud-harp-socat.sock

roles/nextcloud/vars/main.yaml

@@ -0,0 +1,45 @@
+---
+_nextcloud_cron_container:
+  name: cron
+  entrypoint: /cron.sh
+_nextcloud_harp_container:
+  name: harp
+  add_capabilities:
+    - CAP_SYS_ADMIN
+  image: quay.io/podman/stable:latest
+  user: podman
+  entrypoint: /entrypoint.sh
+  devices:
+    - source: /dev/fuse
+  mounts:
+    - type: template
+      source: containers.conf.j2
+      destination: /etc/containers/containers.conf
+    - type: template
+      source: harp_entrypoint.sh.j2
+      destination: /entrypoint.sh
+      mode: "0755"
+    - type: volume
+      source: harp-certs
+      destination: /certs
+    - type: volume
+      source: harp-containers
+      destination: /home/podman/.local/share/containers
+  env: {}
+  secrets:
+    - name: harp-shared-key
+  publish_ports:
+    - name: harp
+      type: socket
+      container_port: 8780
+_nextcloud_additional_containers: >-
+  {{
+    [_nextcloud_cron_container]
+    + ([_nextcloud_harp_container] if nextcloud_install_harp else [])
+  }}
+
+_nextcloud_harp_vhost_locations:
+  - path: /exapps/*
+    proxy_target_socket: /run/nextcloud-harp-socat.sock
+_nextcloud_vhost_locations: >-
+  {{ _nextcloud_harp_vhost_locations if nextcloud_install_harp else [] }}

roles/service/tasks/oauth2_proxy.yaml

@@ -28,6 +28,8 @@
       OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
       OAUTH2_PROXY_EMAIL_DOMAINS: "*"
       OAUTH2_PROXY_REVERSE_PROXY: "true"
+    container_requires:
+      - "{{ service_name }}-oauth2-proxy.socket"
     container_auto_update: "{{ service_auto_update }}"
 
 - name: Socket for OAuth2 Proxy for {{ service_name }}