First version in Galaxy

seb4itik/byow/roles/wordpress/README.md

@@ -0,0 +1,5 @@
+# BYOW - Build Your Own WAF
+
+A WAF _à la carte_.
+
+## Wordpress

seb4itik/byow/roles/wordpress/defaults/main.yml

@@ -0,0 +1,24 @@
+# Required
+wordpress_url: null
+wordpress_site: null
+wordpress_site_title: null
+wordpress_admin_user: null
+wordpress_admin_password: null
+wordpress_admin_email: null
+wordpress_db_pass: null
+wordpress_themes: []
+wordpress_active_theme: null
+
+# Defaults
+wordpress_user: "wordpress"
+wordpress_plugins: []
+wordpress_locale: "fr_FR"
+wordpress_db_host: "localhost"
+wordpress_db_name: "{{ wordpress_user }}"
+wordpress_db_user: "{{ wordpress_user }}"
+wordpress_db_prefix: "wp_"
+wordpress_db_charset: "utf8mb4"
+
+# Optionnal
+wordpress_import_ocdi_indexes: []
+wordpress_create_master: null

seb4itik/byow/roles/wordpress/handlers/main.yml

@@ -0,0 +1,17 @@
+- name: Restart Nginx
+  ansible.builtin.systemd:
+    name: "nginx"
+    state: "restarted"
+
+- name: Flush Wordpress
+  become: true
+  become_user: "{{ wordpress_user }}"
+  ansible.builtin.shell:
+    executable: "/usr/bin/bash"
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: |
+      set -o pipefail
+      wp cache flush
+      wp transient delete --all
+      wp rewrite flush --hard
+  changed_when: true

seb4itik/byow/roles/wordpress/tasks/install_plugins.yml

@@ -0,0 +1,12 @@
+- name: Installation des plugins Wordpress
+  become: true
+  become_user: "{{ wordpress_user }}"
+  loop: "{{ wordpress_plugins_to_install }}"
+  ansible.builtin.command:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: "wp plugin install {{ item }} --activate"
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/plugins/{{ item | basename | splitext | first }}"
+  register: "wordpress_out_plugin_install"
+  changed_when: "'Success: Installed 1 of 1 plugins' in wordpress_out_plugin_install.stdout"
+  notify:
+    - "Flush Wordpress"

seb4itik/byow/roles/wordpress/tasks/main.yml

@@ -0,0 +1,214 @@
+- name: Installation des pré-requis
+  ansible.builtin.apt:
+    name:
+      - "nginx"
+      - "php-fpm"
+      - "php-mysql"
+      - "php-curl"
+      - "php-json"
+      - "php-xml"
+      - "php-mbstring"
+      - "php-zip"
+      - "php-igbinary"
+      - "php-imagick"
+      - "php-intl"
+      - "php-apcu"
+      - "zip"
+
+- name: Installation de wp-cli
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  ansible.builtin.get_url:
+    url: "https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar"
+    dest: "/usr/local/bin/wp"
+    owner: "root"
+    group: "root"
+    mode: "755"
+
+- name: Création de l'utilisateur système pour Wordpress
+  ansible.builtin.user:
+    name: "{{ wordpress_user | mandatory }}"
+    home: "/var/www/{{ wordpress_user }}"
+    group: "www-data"
+    shell: "/usr/bin/bash"
+    password_lock: true
+    create_home: true
+
+- name: Création du répertoire de Wordpress
+  ansible.builtin.file:
+    path: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    state: "directory"
+    owner: "{{ wordpress_user }}"
+    group: "www-data"
+    mode: "0750"
+
+- name: Installation de Wordpress
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  become: true
+  become_user: "{{ wordpress_user }}"
+  ansible.builtin.command:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: "wp core download --locale='{{ wordpress_locale }}' --skip-content"
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-config-sample.php"
+
+# TODO: https://make.wordpress.org/cli/handbook/references/config/#config-files
+- name: Configuration de Wordpress
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  become: true
+  become_user: "{{ wordpress_user }}"
+  ansible.builtin.shell:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      wp config create \
+        --dbhost='{{ wordpress_db_host }}' \
+        --dbname='{{ wordpress_db_name }}' \
+        --dbuser='{{ wordpress_db_user }}' \
+        --dbpass='{{ wordpress_db_pass }}' \
+        --dbprefix='{{ wordpress_db_prefix }}' \
+        --dbcharset='{{ wordpress_db_charset }}' \
+        --extra-php <<PHP
+      define('FS_METHOD', 'direct');
+      define('FORCE_SSL_ADMIN', false);
+      define('WP_HOME', 'https://{{ wordpress_site }}');
+      define('WP_SITEURL', 'https://{{ wordpress_site }}');
+
+      error_reporting(0);
+      @ini_set('display_errors', 0);
+      define('DISALLOW_FILE_EDIT', true);
+
+      if (isset(\$_SERVER['HTTP_X_FORWARDED_PROTO']) && \$_SERVER['HTTP_X_FORWARDED_PROTO']=='https')
+          \$_SERVER['HTTPS'] = 'on';
+      PHP
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-config.php"
+  notify:
+    - "Flush Wordpress"
+
+- name: Create Wordpress database tables
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  become: true
+  become_user: "{{ wordpress_user }}"
+  ansible.builtin.command:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: >
+      wp core install
+      --url='{{ wordpress_url }}'
+      --title='{{ wordpress_site_title }}'
+      --admin_user='{{ wordpress_admin_user }}'
+      --admin_password='{{ wordpress_admin_password }}'
+      --admin_email='{{ wordpress_admin_email }}'
+      --locale='{{ wordpress_locale }}'
+      --skip-email
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/uploads/ }}"
+  register: "wordpress_out_core_install"
+  changed_when: "'Success: WordPress installed successfully.' in wordpress_out_core_install.stdout"
+  notify:
+    - "Flush Wordpress"
+
+- name: Installation des thèmes Wordpress
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  become: true
+  become_user: "{{ wordpress_user }}"
+  loop: "{{ wordpress_themes }}"
+  ansible.builtin.command:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: "wp theme install '{{ item }}'"
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/themes/{{ item | basename | splitext | first }}"
+  register: "wordpress_out_theme_install"
+  changed_when: "'Success: Installed 1 of 1 themes' in wordpress_out_theme_install.stdout"
+  notify:
+    - "Flush Wordpress"
+
+- name: Activation du thème Wordpress
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  become: true
+  become_user: "{{ wordpress_user }}"
+  ansible.builtin.command:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    cmd: "wp theme activate '{{ wordpress_active_theme }}'"
+  register: "wordpress_out_theme_activate"
+  changed_when: "'Success: Switched to ' in wordpress_out_theme_activate.stdout"
+  notify:
+    - "Flush Wordpress"
+
+- name: Installation des plugins wordpress-importer et one-click-demo-import
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  vars:
+    wordpress_plugins_to_install:
+      - "wordpress-importer"
+      - "one-click-demo-import"
+  ansible.builtin.include_tasks: "install_plugins.yml"
+
+- name: Importation des plugins OCDI
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  become: true
+  become_user: "{{ wordpress_user }}"
+  loop: "{{ wordpress_import_ocdi_indexes }}"
+  ansible.builtin.shell:
+    chdir: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}"
+    executable: "/usr/bin/bash"
+    cmd: |
+      set -o pipefail
+      wp ocdi import --predefined='{{ item }}' \
+      && touch /var/www/{{ wordpress_user }}/{{ wordpress_site }}/.ocdi_index{{ item }}_imported
+    creates: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/.ocdi_index{{ item }}_imported"
+  register: "wordpress_out_ocdi_import"
+  changed_when: "'Success: Content import finished!' in wordpress_out_ocdi_import.stdout"
+  notify:
+    - "Flush Wordpress"
+
+- name: Installation des plugins Wordpress
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  vars:
+    wordpress_plugins_to_install: "{{ wordpress_plugins }}"
+  ansible.builtin.include_tasks: "install_plugins.yml"
+
+- name: Création du répertoire cache de Wordpress
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  ansible.builtin.file:
+    path: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/cache"
+    state: "directory"
+    owner: "{{ wordpress_user }}"
+    group: "www-data"
+    mode: "0750"
+
+- name: Apply permissions
+  when: "wordpress_create_master != None and wordpress_create_master == ansible_hostname"
+  loop:
+    - "cache"
+    - "upgrade"
+    - "uploads"
+  ansible.builtin.file:
+    path: "/var/www/{{ wordpress_user }}/{{ wordpress_site }}/wp-content/{{ item }}/"
+    owner: "{{ wordpress_user }}"
+    group: "www-data"
+    mode: "u=rwX,g=rwX,o=rX"
+    recurse: true
+
+- name: Configuration de Nginx
+  ansible.builtin.template:
+    src: "templates/nginx_vhost.conf"
+    dest: "/etc/nginx/sites-available/{{ wordpress_site }}.conf"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  notify:
+    - "Restart Nginx"
+
+- name: Link Nginx vhost config
+  ansible.builtin.file:
+    src: "/etc/nginx/sites-available/{{ wordpress_site }}.conf"
+    dest: "/etc/nginx/sites-enabled/{{ wordpress_site }}.conf"
+    state: "link"
+  notify:
+    - "Restart Nginx"
+
+- name: Unlink Nginx default vhost config
+  ansible.builtin.file:
+    path: "/etc/nginx/sites-enabled/default"
+    state: "absent"
+  notify:
+    - "Restart Nginx"
+
+ # FIXME: php. ini config
+ # Mainly: upload_max_filesize, post_max_size, max_execution_time

seb4itik/byow/roles/wordpress/templates/nginx_vhost.conf

@@ -0,0 +1,50 @@
+server {
+    listen 80;
+    server_name {{ wordpress_site }} www.{{ wordpress_site }};
+    root /var/www/{{ wordpress_user }}/{{ wordpress_site }};
+    index index.html index.htm index.php;
+    client_max_body_size 50M;
+
+    location /nginx_status {
+        stub_status on;
+        access_log off;
+        allow 127.0.0.1;
+        deny all;
+    }
+
+    location ~ /\.ht {
+        deny all;
+    }
+
+    location ~ /wp-config\.php\$ {
+        deny all;
+    }
+
+    location ~ /wp-content/uploads/.*\.php\$ {
+        deny all;
+    }
+
+  location ~ \.php$ {
+    include snippets/fastcgi-php.conf;
+    fastcgi_pass unix:/var/run/php/php-fpm.sock;
+  }
+
+  # Réécritures pour WordPress
+  location ~ ^/index\.php$ { }
+  location / {
+    if (!-e $request_filename){
+      rewrite ^/(.*)$ /index.php last;
+      break;
+    }
+  }
+
+#   location / {
+#       try_files \$uri \$uri/ /index.php?\$args;
+#   }
+
+#   location ~ \.php\$ {
+#       include snippets/fastcgi-php.conf;
+#       fastcgi_pass unix:/var/run/php/php-fpm.sock;
+#       fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+#   }
+}