Post-Tyranny-Tech-Infrastructure/ansible/roles/nextcloud/tasks/apps.yml

---
# Install and configure Nextcloud apps

- name: Install Collabora Office app (richdocuments)
  shell: docker exec -u www-data nextcloud php occ app:install richdocuments
  register: collabora_install
  changed_when: "'richdocuments installed' in collabora_install.stdout"
  failed_when: collabora_install.rc != 0 and 'already installed' not in collabora_install.stdout
  when: collabora_enabled | default(true)

- name: Enable Collabora Office app
  shell: docker exec -u www-data nextcloud php occ app:enable richdocuments
  when: collabora_enabled | default(true)
  changed_when: false

- name: Configure Collabora WOPI URL
  shell: |
    docker exec -u www-data nextcloud php occ config:app:set richdocuments wopi_url --value="https://{{ collabora_domain }}"
  when: collabora_enabled | default(true)
  changed_when: true

- name: Get Nextcloud internal network info
  shell: |
    docker inspect nextcloud-internal -f {% raw %}'{{ .IPAM.Config }}'{% endraw %}
  register: nextcloud_network
  changed_when: false
  when: collabora_enabled | default(true)

- name: Configure Collabora WOPI allowlist
  shell: |
    docker exec -u www-data nextcloud php occ config:app:set richdocuments wopi_allowlist --value="172.18.0.0/16,172.21.0.0/16"
  when: collabora_enabled | default(true)
  changed_when: true

- name: Install two-factor authentication apps
  shell: docker exec -u www-data nextcloud php occ app:install {{ item }}
  loop:
    - twofactor_totp
    - twofactor_admin
    - twofactor_backupcodes
  register: twofactor_install
  changed_when: "'installed' in twofactor_install.stdout"
  failed_when: twofactor_install.rc != 0 and 'already installed' not in twofactor_install.stdout

- name: Enable two-factor authentication apps
  shell: docker exec -u www-data nextcloud php occ app:enable {{ item }}
  loop:
    - twofactor_totp
    - twofactor_admin
    - twofactor_backupcodes
  changed_when: false

- name: Enforce two-factor authentication
  shell: |
    docker exec -u www-data nextcloud php occ config:system:set twofactor_enforced --value="true" --type=boolean
  when: twofactor_enforced | default(true)
  changed_when: true

- name: Configure APCu for local caching
  shell: |
    docker exec -u www-data nextcloud php occ config:system:set memcache.local --value="\\OC\\Memcache\\APCu"
  changed_when: true

- name: Configure maintenance window
  shell: |
    docker exec -u www-data nextcloud php occ config:system:set maintenance_window_start --value=2 --type=integer
  changed_when: true

- name: Display apps configuration summary
  debug:
    msg: |
      Nextcloud Apps Configured:
      - Collabora Office: {{ 'Enabled' if collabora_enabled else 'Disabled' }}
        WOPI URL: https://{{ collabora_domain if collabora_enabled else 'N/A' }}
      - Two-Factor Auth: {{ 'Enforced' if twofactor_enforced else 'Optional' }}
        - TOTP (Authenticator apps)
        - Admin enforcement
        - Backup codes
      - Caching:
        - Local: APCu
        - Distributed: Redis
        - Locking: Redis
      - Maintenance window: 2:00 AM