Multiple fixes after deployment on open.audio

README.md

@@ -13,13 +13,44 @@ Using this role, you can install and upgrade a Funkwhale pod, closely matching o
 - Install and configure Funkwhale and it's dependencies
 - Install and configure a SSL certificate with Let's Encrypt (optional)
 
-Usage
------
+Installation and usage
+----------------------
 
-Add the following to your playbook:
+Install ansible:
+
+```
+pip install --user ansible
+```
+
+Create a directory for ansible files:
+
+    mkdir ~/ansible-funkwhale
+    cd ansible-funkwhale
+
+Create a playbook requirements and inventory file:
+
+    touch requirements.yml
+    touch playbook.yml
+    touch inventory.ini
+
+Add the following to `requirements.yml`:
+
+```
+- src: git+https://dev.funkwhale.audio/funkwhale/ansible
+  name: funkwhale
+  version: master
+```
+
+Install the role:
+
+```
+ansible-galaxy install -r requirements.yml
+```
+
+Add the following to `playbook.yml`:
 
 ```yaml
-- hosts: servers
+- hosts: funkwhale-servers
   roles:
     - role: funkwhale
       funkwhale_hostname: yourdomain.funkwhale
@@ -29,6 +60,24 @@ Add the following to your playbook:
 
 See below for a full documentation on available variables.
 
+Add your server to `inventory.ini`:
+
+```ini
+[funkwhale-servers]
+your-server-ip-or-domain
+```
+
+Launch the installation (in check mode, so nothing is applied):
+
+```
+ansible-playbook --ask-become-pass -i inventory.ini playbook.yml --check --diff
+```
+*On some hosts, you may need to install the `python-apt` package for check mode to work*.
+
+This command will show you the changes that would be applied to your system. If you are confortable with them,
+rerun the same command without the `--check` flag.
+
+
 Role Variables
 --------------
 

handlers/main.yml

 ---
 - name: restart funkwhale
+  become: true
   service:
     name: funkwhale.target
     state: restarted
 
 - name: reload nginx
+  become: true
   service:
     name: nginx
     state: reloaded

tasks/funkwhale.yml

 ---
 
 - name: "Create funkwhale user"
+  become: true
   user:
     name: "{{ funkwhale_username }}"
     shell: /bin/false
@@ -33,18 +34,29 @@
   register: result_secret_key_generation
 
 - name: "Create django_secret_key file"
-  when: result_django_secret_key.stat.exists == False
+  when: not ansible_check_mode and result_django_secret_key.stat.exists == False
   become: true
   become_user: "{{ funkwhale_username }}"
   copy:
     content: "{{ result_secret_key_generation.stdout }}"
     dest: "{{ funkwhale_config_path }}/django_secret_key"
 
+- name: "Setup a dummy secret key"
+  when: ansible_check_mode
+  set_fact:
+    django_secret_key: "dummy_secret_key_for_check_mode"
+
 - name: "Retrieve secret key from {{ funkwhale_config_path }}/django_secret_key"
+  when: not ansible_check_mode
   slurp:
     src: "{{ funkwhale_config_path }}/django_secret_key"
   register: secret_key
 
+- name: "Register secret key"
+  when: not ansible_check_mode
+  set_fact:
+    django_secret_key: "{{ secret_key['content'] | b64decode }}"
+
 - name: "Create funkwhale configuration file"
   become: true
   become_user: "{{ funkwhale_username }}"
@@ -53,8 +65,6 @@
     dest: "{{ funkwhale_config_path }}/.env"
     owner: "{{ funkwhale_username }}"
     mode: 0600
-  vars:
-    django_secret_key: "{{ secret_key['content'] | b64decode }}"
   notify:
     - restart funkwhale
 

tasks/main.yml

 ---
 - include: packages.yml
+  tags: [packages]
 - include: db.yml
+  tags: [db]
 - include: redis.yml
+  tags: [redis]
 - include: funkwhale.yml
+  tags: [funkwhale]
 - include: services.yml
+  tags: [services]
 - include: nginx.yml
+  tags: [nginx]

tasks/services.yml

@@ -30,6 +30,7 @@
 
 - name: "Start and enable {{ funkwhale_systemd_service_name }}-* services"
   when: funkwhale_nginx_managed
+  become: true
   systemd:
     name: "{{ item }}"
     enabled: true

templates/funkwhale-process.service.j2

@@ -5,6 +5,8 @@ After={{ funkwhale_systemd_after }}
 PartOf={{ funkwhale_systemd_service_name }}.target
 
 [Service]
+Restart=on-failure
+RestartSec=10
 User={{ funkwhale_username }}
 WorkingDirectory={{ funkwhale_install_path }}/api
 EnvironmentFile={{ funkwhale_config_path }}/.env

templates/nginx.conf.j2

 # {{ ansible_managed }}
-{% if funkwhale_protocol == 'https' %}
+{% if funkwhale_protocol == 'https' -%}
 server {
     listen 80;
+    listen [::]:80;
     server_name {{ funkwhale_hostname }};
-
-    {% if funkwhale_letsencrypt_enabled %}
-    location /.well-known/acme-challenge {
-        root /var/www/letsencrypt;
-        try_files $uri $uri/ =404;
-    }
-    {% endif %}
-    location / {
-        rewrite ^ https://{{ funkwhale_hostname }}$request_uri? permanent;
-    }
+    location / { return 301 https://$host$request_uri; }
 }
-{% endif %}
+{% endif -%}
 
 # required for websocket support
 map $http_upgrade $connection_upgrade {
@@ -23,30 +15,28 @@ map $http_upgrade $connection_upgrade {
 }
 
 server {
-    listen {% if funkwhale_protocol == 'https' %}443 ssl{% else %}80{% endif %};
+    listen {% if funkwhale_protocol == 'https' %}443 ssl{% else %}80{% endif %} http2;
+    listen [::]:{% if funkwhale_protocol == 'https' %}443 ssl{% else -%}80{% endif %} http2;
     server_name {{ funkwhale_hostname }};
-
-    {% if funkwhale_letsencrypt_enabled %}
-    location /.well-known/acme-challenge {
-        root /var/www/letsencrypt;
-        try_files $uri $uri/ =404;
-    }
-    {% endif %}
-    {% if funkwhale_protocol == 'https' %}
-    {% if funkwhale_ssl_key_path %}
+    {% if funkwhale_protocol == 'https' -%}
+    {% if funkwhale_ssl_key_path -%}
     ssl_certificate {{ funkwhale_ssl_cert_path }};
     ssl_certificate_key {{ funkwhale_ssl_key_path }};
-    {% else %}
+    {% else -%}
     ssl_certificate /ect/lectsencrypt/live/{{ funkwhale_hostname }}/fullchain.pem;
     ssl_certificate_key /ect/lectsencrypt/live/{{ funkwhale_hostname }}/privkey.pem;
-    {% endif %}
-    ssl_session_cache shared:le_nginx_SSL:1m;
-    ssl_session_timeout 1440m;
-    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    {% endif -%}
+    # from https://cipherli.st/
     ssl_prefer_server_ciphers on;
-    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA";
-    add_header Strict-Transport-Security "max-age=31536000";
-    {% endif %}
+    ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
+    ssl_ecdh_curve secp384r1;
+    ssl_session_timeout  10m;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_tickets off;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    add_header Strict-Transport-Security "max-age=63072000; preload";
+    {% endif -%}
 
     root {{ funkwhale_install_path }}/front/dist;
 
@@ -111,14 +101,14 @@ server {
         alias {{ funkwhale_media_path }}/;
     }
 
-    {% if funkwhale_external_storage_enabled %}
+    {% if funkwhale_external_storage_enabled -%}
     # Comment the previous location and uncomment this one if you're storing
     # media files in a S3 bucket
     location ~ /_protected/media/(.+) {
         internal;
         proxy_pass $1;
     }
-    {% else %}
+    {% else -%}
     location /_protected/media {
         # this is an internal location that is used to serve
         # audio files once correct permission / authentication
@@ -126,7 +116,7 @@ server {
         internal;
         alias   {{ funkwhale_media_path }};
     }
-    {% endif %}
+    {% endif -%}
 
     location /_protected/music {
         # this is an internal location that is used to serve