diff --git a/ansible/inventory/group_vars/all.yaml b/ansible/inventory/group_vars/all.yaml index 5f751f6..58c9412 100644 --- a/ansible/inventory/group_vars/all.yaml +++ b/ansible/inventory/group_vars/all.yaml @@ -151,6 +151,14 @@ services: http: "3001" redis: "6383" subuid: "100999" + outline: + domain: + public: "outline" + internal: "outline.app" + ports: + http: "3002" + redis: "6384" + subuid: "101000" version: packages: @@ -187,3 +195,4 @@ version: nextcloud: "33.0.3" collabora: "25.04.9.4.1" sure: "0.7.0-hotfix.2" + outline: "1.7.1" diff --git a/ansible/playbooks/app/site.yaml b/ansible/playbooks/app/site.yaml index b0c3163..b8a9bd4 100644 --- a/ansible/playbooks/app/site.yaml +++ b/ansible/playbooks/app/site.yaml @@ -225,6 +225,14 @@ tags: ["site", "sure"] tags: ["site", "sure"] + - name: Set outline + ansible.builtin.include_role: + name: "app" + tasks_from: "services/set_outline" + apply: + tags: ["site", "outline"] + tags: ["site", "outline"] + - name: Flush handlers right now ansible.builtin.meta: "flush_handlers" diff --git a/ansible/roles/app/handlers/main.yaml b/ansible/roles/app/handlers/main.yaml index 877dfc7..26e2ed0 100644 --- a/ansible/roles/app/handlers/main.yaml +++ b/ansible/roles/app/handlers/main.yaml @@ -102,3 +102,15 @@ changed_when: false listen: "notification_restart_sure" ignore_errors: true # noqa: ignore-errors + +- name: Restart outline + ansible.builtin.systemd: + name: "outline.service" + state: "restarted" + enabled: true + scope: "user" + daemon_reload: true + when: is_outline_init.stat.exists + changed_when: false + listen: "notification_restart_outline" + ignore_errors: true # noqa: ignore-errors diff --git a/ansible/roles/app/tasks/services/set_outline.yaml b/ansible/roles/app/tasks/services/set_outline.yaml new file mode 100644 index 0000000..dbb1c75 --- /dev/null +++ b/ansible/roles/app/tasks/services/set_outline.yaml @@ -0,0 +1,152 @@ +--- +- name: Set redis service name + ansible.builtin.set_fact: + redis_service: "outline" + +- name: Create redis_outline directory + ansible.builtin.file: + path: "{{ node['home_path'] }}/{{ item }}" + state: "directory" + owner: "{{ services['redis']['subuid'] }}" + group: "svadmins" + mode: "0770" + loop: + - "containers/redis" + - "containers/redis/{{ redis_service }}" + - "containers/redis/{{ redis_service }}/data" + become: true + +- name: Deploy redis config file + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2" + dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf" + owner: "{{ ansible_user }}" + group: "svadmins" + mode: "0644" + register: "is_redis_conf" + +- name: Deploy redis container file + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2" + dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container" + owner: "{{ ansible_user }}" + group: "svadmins" + mode: "0644" + register: "is_redis_containerfile" + +- name: Enable (Restart) redis service + ansible.builtin.systemd: + name: "redis_{{ redis_service }}.service" + state: "restarted" + enabled: true + daemon_reload: true + scope: "user" + when: is_redis_conf.changed or is_redis_containerfile.changed # noqa: no-handler + +- name: Create outline directory + ansible.builtin.file: + path: "{{ node['home_path'] }}/{{ item }}" + state: "directory" + owner: "{{ services['outline']['subuid'] }}" + group: "svadmins" + mode: "0770" + loop: + - "data/containers/outline" + - "data/containers/outline/data" + - "containers/outline" + - "containers/outline/ssl" + become: true + +- name: Check data directory empty + ansible.builtin.stat: + path: "{{ node['home_path'] }}/data/containers/outline/.init" + register: "is_outline_init" + +- name: Create .init file + ansible.builtin.file: + path: "{{ node['home_path'] }}/data/containers/outline/.init" + state: "touch" + mode: "0644" + owner: "{{ ansible_user }}" + group: "svadmins" + when: not is_outline_init.stat.exists + +- name: Deploy root certificate + ansible.builtin.copy: + content: | + {{ hostvars['console']['ca']['root']['crt'] }} + dest: "{{ node['home_path'] }}/containers/outline/ssl/{{ root_cert_filename }}" + owner: "{{ services['outline']['subuid'] }}" + group: "svadmins" + mode: "0440" + become: true + notify: "notification_restart_outline" + no_log: true + +- name: Register secret value to podman secret + containers.podman.podman_secret: + name: "{{ item.name }}" + data: "{{ item.value }}" + state: "present" + force: true + loop: + - name: "OUTLINE_SECRET_KEY" + value: "{{ hostvars['console']['outline']['session_secret'] }}" + - name: "OUTLINE_UTILS_SECRET" + value: "{{ hostvars['console']['outline']['utils_secret'] }}" + - name: "OUTLINE_DATABASE_PASSWORD" + value: "{{ hostvars['console']['postgresql']['password']['outline'] }}" + - name: "OUTLINE_OIDC_CLIENT_SECRET" + value: "{{ hostvars['console']['outline']['oidc']['secret'] }}" + notify: "notification_restart_outline" + no_log: true + +- name: Deploy outline.container file + ansible.builtin.template: + src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/outline/outline.container.j2" + dest: "{{ node['home_path'] }}/.config/containers/systemd/outline.container" + owner: "{{ ansible_user }}" + group: "svadmins" + mode: "0644" + notify: "notification_restart_outline" + +- name: Enable outline.service + ansible.builtin.systemd: + name: "outline.service" + state: "started" + enabled: true + daemon_reload: true + scope: "user" + +- name: Check container archive images + ansible.builtin.stat: + path: "{{ node['home_path'] }}/archives/containers/{{ item.file }}.tar" + loop: + - image: "docker.io/library/redis:{{ version['containers']['redis'] }}" + file: "docker.io_library_redis_{{ version['containers']['redis'] }}" + - image: "docker.io/outlinewiki/outline:{{ version['containers']['outline'] }}" + file: "docker.io_outlinewiki_outline_{{ version['containers']['outline'] }}" + loop_control: + label: "{{ item.file }}" + register: container_archive_images + +- name: Save container archive images + containers.podman.podman_save: + image: + - "{{ item.item.image }}" + dest: "{{ node['home_path'] }}/archives/containers/{{ item.item.file }}.tar" + format: "oci-archive" + force: false + loop: "{{ container_archive_images.results }}" + loop_control: + label: "{{ item.item.file }}" + when: not item.stat.exists + +- name: Fetch container archive images + ansible.builtin.fetch: + src: "{{ node['home_path'] }}/archives/containers/{{ item.item.file }}.tar" + dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/" + flat: true + loop: "{{ container_archive_images.results }}" + loop_control: + label: "{{ item.item.file }}" diff --git a/ansible/roles/infra/tasks/services/set_postgresql.yaml b/ansible/roles/infra/tasks/services/set_postgresql.yaml index dc1e733..3f75d6a 100644 --- a/ansible/roles/infra/tasks/services/set_postgresql.yaml +++ b/ansible/roles/infra/tasks/services/set_postgresql.yaml @@ -12,6 +12,7 @@ - "affine" - "nextcloud" - "sure" + - "outline" - name: Create postgresql directory ansible.builtin.file: diff --git a/config/secrets/secrets.yaml b/config/secrets/secrets.yaml index 3cc12a5..34c8938 100644 --- a/config/secrets/secrets.yaml +++ b/config/secrets/secrets.yaml @@ -120,6 +120,7 @@ postgresql: affine: ENC[AES256_GCM,data:XPXrcszsV06YqCJZ7CDqc4rCwqqNlbtLCFYfLAQ8jamLtft8L2UVrMA4WZo=,iv:vrWdBeckxB9tmEE628j4jhU+hSpE6TXYMGt0hh1Cg84=,tag:hlWwWUGht8NqWTZREMsa1Q==,type:str] nextcloud: ENC[AES256_GCM,data:ROsximNuWYMTZktmLJPx7W1Qol/uT+APgwoCtFO/6ZYYc3KxKvlk344eqEc=,iv:4d+MrfIHjJKAcwhvZ3g4go66uZcieuL7lngKErJd+fg=,tag:QbWOtxeCbiu62GyrE2atXg==,type:str] sure: ENC[AES256_GCM,data:FULJ2gjJ2gZC3s324itW+CjGRBHIP9RnOqw5TT1UaiUhb7UHAPm1na+LsZk=,iv:c0GnVZkxprJUzPPq3TCQaZvAes9QQuvDXqgVLLaiQIg=,tag:uDxy/Lkd2hNK4AWwMNMslw==,type:str] + outline: ENC[AES256_GCM,data:0eJFCfHgS4olWXHOnUPixs4Dl5PoxJa+2H1mk3YgC4GUv+nX8gTPmzKTMVM=,iv:HGxX7aLODUc2nVLC8YXdet9qphU/wxMapWhk93YmHDM=,tag:6/2uckW/a24LgVFRH6E85Q==,type:str] #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment] # # @@ -251,6 +252,16 @@ sure: #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment] # # +#ENC[AES256_GCM,data:H6BtfLuevnDCEpHSmf6pxQ==,iv:9Jw0UZwVwS2It7c4e1rAN/BEiqDKp9DHD4W9xdpJ/Vs=,tag:Xj8HKvxgCA260CXBVK2S1A==,type:comment] +outline: + session_secret: ENC[AES256_GCM,data:A26j8/ghGA9MjDiuq+H84iTFXkHZp3l3LbGKO9w+Cgv+u1dkTF5q4zuBnOSBi+Tnz+2Y4jIoxsac+CS0dguRMg==,iv:NzJiJxVxOvud3e4mP8urnHrqugE8SmjFVnZtwfzrUzs=,tag:YR/jexb3G0HfC2qHpn6fPA==,type:str] + utils_secret: ENC[AES256_GCM,data:ACI+NZzqHBsYeb4WwTJ1nfJcy6zNwJn2hBqA93aM5cgNWQ4KtQHDXgmS6UTwmSpxrteiaH25J3Np03H3eQoVeA==,iv:nitwxxwTPQvoQXGLVMnk2zsdC7M+JIXkTY4zJdQ3DFo=,tag:IQewG7EE9IgQk+Rfz7M5Iw==,type:str] + oidc: + secret: ENC[AES256_GCM,data:zR6sN205C51BIiQxLYOwC4ZbTYGr2AveiPeEbdadairmfnNJkGOtm0zT4Gg=,iv:uyYoJYuAuH/Gy2dlLr2SkkLYq+lMdwBgmzUsEj1EAKc=,tag:uhgvE6BagvPPKf7Y3NaGfA==,type:str] + hash: ENC[AES256_GCM,data:xOibOUdmfhvUk6HABHf/MGIaUqRtrmbBpD5eTIrlt+Ll5IxuIaECMIyBufqV6KStoNsAxtlWmPqoVYROnVh7Z50ntywP6w6YNFbihMGr5tYnNBAS2ITViCq0Z7GQpNVmhNkFbmZv4bX14YOI557CS1KeDVrKrHnZ3fPgEgDwEiUdCwo=,iv:3lVQEw/gmTvJ6wteyKhAHAYUUw1AfKku8YEveddJTZU=,tag:0jimA4vof+nKOQtCOrVFdw==,type:str] +#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment] +# +# #ENC[AES256_GCM,data:T4Wtn49AAxPd2QUFTR+q,iv:bH5goGWBDqumAat9dUv2OwfCUJUpuVqncTMqMBZUXhI=,tag:G+W6hHA+yftQ+4RJpXrxHg==,type:comment] switch: password: ENC[AES256_GCM,data:qu0f9L7A0eFq/UCpaRs=,iv:W8LLOp3MSfd/+EfNEZNf91K8GgI5eUfVPoWTRES2C0Y=,tag:Q5FlAOfwqwJwPvd7k6i+0g==,type:str] @@ -280,7 +291,7 @@ sops: UmliaFNxVTBqRkI1QWJpWGpTRWxETW8KEY/8AfU73UOzCGhny1cNnd5dCNv7bHXt k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-09T14:26:51Z" - mac: ENC[AES256_GCM,data:TYs08ZSS2kcO5lYuhQ/IySUSQ3DpL+ba3/uNLyszht4OttR110/W/WQLiRuu/Ql6FwtDtjq6I3iNpOhmCHSv1kMCam1l99GEIYCaPUIY+TY3Zw0j7518dFXe8p/DrKRwIVXfK5lIKLIEd+eizD50HzwXXJFmU+7YDkQ1Dx+55kw=,iv:arJKJ4wO4sdQlu3GZbtultsfM6s8vbhG93tnf2EjJDc=,tag:m95gUqvn4w85XI8qVvCZpQ==,type:str] + lastmodified: "2026-05-16T08:55:23Z" + mac: ENC[AES256_GCM,data:UXueLe3zZcuvUUH9OJGWcwUqzPoIhw+vtTpqZIB2fGOa4KpFCUmOXtRgws+mQVzBRB30xpbfbbwWM/ZIWjVx2EoE4uP09uk8fgtmMD9ZBacHxEzjxksKW78cX4SoOj6tzzhACTkj61RRrXS8Ft1RNZJFZlzeQVodEGt5eoJUq28=,iv:eCsQAiTqqL1w6xQ69u/Yi4iKUXS44sPUOSDuYPp8WFM=,tag:2kEdh4VB0XWhv0KBgD8EGA==,type:str] unencrypted_suffix: _unencrypted version: 3.12.1 diff --git a/config/services/containers/app/outline/outline.container.j2 b/config/services/containers/app/outline/outline.container.j2 new file mode 100644 index 0000000..a384843 --- /dev/null +++ b/config/services/containers/app/outline/outline.container.j2 @@ -0,0 +1,77 @@ +[Quadlet] +DefaultDependencies=false + +[Unit] +Description=Outline + +After=redis_outline.service +Wants=redis_outline.service + +[Container] +Image=docker.io/outlinewiki/outline:{{ version['containers']['outline'] }} +ContainerName=outline +HostName=outline +PublishPort={{ services['outline']['ports']['http'] }}:3000/tcp + +# Volumes +Volume=%h/data/containers/outline/data:/var/lib/outline/data:rw +Volume=%h/containers/outline/ssl:/etc/ssl/outline:ro + +# General +Environment="TZ={{ timezone }}" +Environment="NODE_ENV=production" +Environment="URL=https://{{ services['outline']['domain']['public'] }}.{{ domain['public'] }}" +Environment="PORT=3000" +#Environment="FORCE_HTTPS=true" #HTST function is not required + +# Secrets +Secret=OUTLINE_SECRET_KEY,type=env,target=SECRET_KEY +Secret=OUTLINE_UTILS_SECRET,type=env,target=UTILS_SECRET + +# Database +Environment="DATABASE_HOST={{ services['postgresql']['domain'] }}.{{ domain['internal'] }}" +Environment="DATABASE_PORT={{ services['postgresql']['ports']['tcp'] }}" +Environment="DATABASE_NAME=outline_db" +Environment="DATABASE_USER=outline" +Environment="PGSSLMODE=verify-full" +Environment="NODE_EXTRA_CA_CERTS=/etc/ssl/outline/{{ root_cert_filename }}" +Secret=OUTLINE_DATABASE_PASSWORD,type=env,target=DATABASE_PASSWORD + +# Redis +Environment="REDIS_URL=redis://host.containers.internal:{{ services['outline']['ports']['redis'] }}" + +# Storage +Environment="FILE_STORAGE=local" +Environment="FILE_STORAGE_LOCAL_ROOT_DIR=/var/lib/outline/data" +Environment="FILE_STORAGE_UPLOAD_MAX_SIZE=262144000" + +# OIDC +Environment="OIDC_CLIENT_ID=outline" +Environment="OIDC_AUTH_URI=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}/api/oidc/authorization" +Environment="OIDC_TOKEN_URI=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}/api/oidc/token" +Environment="OIDC_USERINFO_URI=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}/api/oidc/userinfo" +Environment="OIDC_USERNAME_CLAIM=preferred_username" +Environment="OIDC_DISPLAY_NAME=Authelia" +Environment="OIDC_SCOPES=openid offline_access profile email" +Secret=OUTLINE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET + +# Mail +#Environment="SMTP_HOST=smtp.example.com" +#Environment="SMTP_PORT=587" +#Environment="SMTP_USERNAME=outline@example.com" +#Environment="SMTP_PASSWORD=change_me" +#Environment="SMTP_FROM_EMAIL=outline@example.com" +#Environment="SMTP_REPLY_EMAIL=outline@example.com" +#Environment="SMTP_SECURE=false" + +# Optional +Environment="LOG_LEVEL=warn" + +[Service] +ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }} +Restart=always +RestartSec=10s +TimeoutStopSec=120 + +[Install] +WantedBy=default.target diff --git a/config/services/containers/auth/authelia/config/authelia.yaml.j2 b/config/services/containers/auth/authelia/config/authelia.yaml.j2 index 2e4078b..84e6d91 100644 --- a/config/services/containers/auth/authelia/config/authelia.yaml.j2 +++ b/config/services/containers/auth/authelia/config/authelia.yaml.j2 @@ -260,3 +260,26 @@ identity_providers: access_token_signed_response_alg: 'none' userinfo_signed_response_alg: 'none' token_endpoint_auth_method: 'client_secret_basic' + # https://www.authelia.com/integration/openid-connect/clients/outline/ + - client_id: 'outline' + client_name: 'Outline' + client_secret: '{{ hostvars['console']['outline']['oidc']['hash'] }}' + public: false + authorization_policy: 'one_factor' + require_pkce: false + pkce_challenge_method: '' + redirect_uris: + - 'https://{{ services['outline']['domain']['public'] }}.{{ domain['public'] }}/auth/oidc.callback' + scopes: + - 'openid' + - 'offline_access' + - 'profile' + - 'email' + response_types: + - 'code' + grant_types: + - 'authorization_code' + - 'refresh_token' + access_token_signed_response_alg: 'none' + userinfo_signed_response_alg: 'none' + token_endpoint_auth_method: 'client_secret_post' diff --git a/config/services/containers/common/caddy/etc/app/Caddyfile.j2 b/config/services/containers/common/caddy/etc/app/Caddyfile.j2 index 9e57c65..fa4cb24 100644 --- a/config/services/containers/common/caddy/etc/app/Caddyfile.j2 +++ b/config/services/containers/common/caddy/etc/app/Caddyfile.j2 @@ -77,3 +77,9 @@ header_up Host {http.request.header.X-Forwarded-Host} } } +{{ services['outline']['domain']['internal'] }}.{{ domain['internal'] }} { + import private_tls + reverse_proxy host.containers.internal:{{ services['outline']['ports']['http'] }} { + header_up Host {http.request.header.X-Forwarded-Host} + } +} diff --git a/config/services/containers/common/caddy/etc/auth/Caddyfile.j2 b/config/services/containers/common/caddy/etc/auth/Caddyfile.j2 index 666aa1b..ef82979 100644 --- a/config/services/containers/common/caddy/etc/auth/Caddyfile.j2 +++ b/config/services/containers/common/caddy/etc/auth/Caddyfile.j2 @@ -136,6 +136,15 @@ } } } +{{ services['outline']['domain']['public'] }}.{{ domain['public'] }} { + import crowdsec_log + route { + crowdsec + reverse_proxy https://{{services['outline']['domain']['internal'] }}.{{ domain['internal'] }} { + header_up Host {http.reverse_proxy.upstream.host} + } + } +} # Internal domain {{ node['name'] }}.{{ domain['internal'] }} { diff --git a/docs/services/app/outline.md b/docs/services/app/outline.md new file mode 100644 index 0000000..57432a0 --- /dev/null +++ b/docs/services/app/outline.md @@ -0,0 +1,52 @@ +# Outline + +## Prerequisite + +### Create database + +- Create the password with `openssl rand -base64 32` + - Save this value in secrets.yaml in `postgresql.password.outline` + - Access infra server to create outline_db with `podman exec -it postgresql psql -U postgres` + +```SQL +CREATE USER outline WITH PASSWORD 'postgresql.password.outline'; +CREATE DATABASE outline_db; +ALTER DATABASE outline_db OWNER TO outline; +``` + +### Create oidc secret and hash + +- Create the secret with `openssl rand -base64 32` +- access to auth vm + - `podman exec -it authelia sh` + - `authelia crypto hash generate pbkdf2 --password 'outline.oidc.secret'` +- Save this value in secrets.yaml in `outline.oidc.secret` and `outline.oidc.hash` + +### Create session secret and utils value + +- Create two secrets with `openssl rand -hex 32` + - Save this value in secrets.yaml in `outline.session_secret` + - Save this value in secrets.yaml in `outline.utils_secret` + +### Add postgresql dump backup list + +- [set_postgresql.yaml](../../../ansible/roles/infra/tasks/services/set_postgresql.yaml) + +```yaml +- name: Set connected services list + ansible.builtin.set_fact: + connected_services: + - ... + - "outline" +``` + +## Configuration + +### Notice + +- Outline is a BSL, not fully open-sourced stack. Always ensure they can change their policy of the outline + +### Access to outline + +- https://outline.ilnmors.com + - Authelia redirect and automatically sign-up diff --git a/docs/specifications/environments.md b/docs/specifications/environments.md index 0757640..75f6395 100644 --- a/docs/specifications/environments.md +++ b/docs/specifications/environments.md @@ -126,6 +126,8 @@ - Link to Nextcloud - [x] sure - budget and finance + - [x] outline + - Compare to affine, the whiteboard and canvas functions are not useful enough - [ ] memos - WriteFreely or directus + frontend(Astro) - MediaCMS or PeerTube