oauth.yml

---
- name: Initial bootstrap
  hosts: all

  vars:
    disktype: sd
    base_packages:
      - apache2
      - libapache2-mod-php8.2
      - mariadb-server
      - redis
      - htop
      - aptitude
      - php-mbstring
      - php-xml
      - php-redis
      - php-mysql
      - php-intl
      - php-curl
      - composer
      - python3-pymysql

  tasks:
    - name: Make db filesystem
      community.general.filesystem:
        fstype: ext4
        dev: "/dev/{{disktype}}b"
        opts: "-L oauth-db"

    - name: Create www mountpoint
      ansible.builtin.file:
        path: "/var/www"
        state: directory
        mode: '0755'

    - name: Create db mountpoint
      ansible.builtin.file:
        path: "/var/lib/mysql"
        state: directory
        mode: '0755'

    - name: Mount db disk
      ansible.posix.mount:
        path: "/var/lib/mysql"
        src: "LABEL=oauth-db"
        fstype: ext4
        state: mounted

    - name: Install packages
      apt:
        update_cache: yes
        name: "{{ base_packages }}"
      notify: Restart apache2
    
    - name: Remove default vhost
      ansible.builtin.file:
        path: /etc/apache2/sites-enabled/000-default.conf
        state: absent
      notify: Restart apache2
    
    - name: Deploy MediaWiki vhost
      ansible.builtin.copy:
        src: mediawiki.conf
        dest: /etc/apache2/sites-enabled/mediawiki.conf
        owner: root
        group: root
        mode: '0644'
      notify: Restart apache2
    
    - name: Fix FS permissions for /var/lib/mysql
      ansible.builtin.file:
        path: /var/lib/mysql
        state: directory
        recurse: yes
        owner: mysql
        group: mysql
      notify: Restart mariadb
  handlers:
    - name: Restart mariadb
      service:
        name: mariadb
        state: restarted

    - name: Restart apache2
      service:
        name: apache2
        state: restarted

- name: Deploy MediaWiki
  hosts: all
  vars:
    wgServer: localhost
    urlScheme: https
    version: REL1_42
  tasks:
    - name: check if LocalSettings.php exists
      stat: 
        path: /var/www/www/w/LocalSettings.php
      register: localsettings
    - name: Create www mountpoint
      ansible.builtin.file:
        path: "/var/www/www"
        state: directory
        mode: '0755'
    - name: Root redirect
      ansible.builtin.copy:
        content: '<?php header("Location: /w/index.php");'
        dest: /var/www/www/index.php
    - name: Create MySQL user
      community.mysql.mysql_user:
        state: present
        name: wikiuser
        password: wikiuser
        priv:
          'wikidb.*': 'ALL'
        login_unix_socket: /var/run/mysqld/mysqld.sock
    - name: Create wiki database
      community.mysql.mysql_db:
        name: wikidb
        state: present
        login_unix_socket: /var/run/mysqld/mysqld.sock
      register: wikidb

    - name: MediaWiki git checkout
      ansible.builtin.git:
        repo: https://gerrit.wikimedia.org/r/mediawiki/core.git
        dest: /var/www/www/w
        version: "{{version}}"
        recursive: false
        accept_hostkey: true
        force: yes
        depth: 1
    - name: AntiSpoof git checkout
      ansible.builtin.git:
        repo: https://gerrit.wikimedia.org/r/p/mediawiki/extensions/AntiSpoof.git
        dest: /var/www/www/w/extensions/AntiSpoof
        version: "{{version}}"
        accept_hostkey: true
        force: yes
        depth: 1
    - name: CheckUser git checkout
      ansible.builtin.git:
        repo: https://gerrit.wikimedia.org/r/p/mediawiki/extensions/CheckUser.git
        dest: /var/www/www/w/extensions/CheckUser
        version: "{{version}}"
        accept_hostkey: true
        force: yes
        depth: 1
    - name: TitleBlacklist git checkout
      ansible.builtin.git:
        repo: https://gerrit.wikimedia.org/r/p/mediawiki/extensions/TitleBlacklist.git
        dest: /var/www/www/w/extensions/TitleBlacklist
        version: "{{version}}"
        accept_hostkey: true
        force: yes
        depth: 1
    - name: OAuth git checkout
      ansible.builtin.git:
        repo: https://gerrit.wikimedia.org/r/p/mediawiki/extensions/OAuth.git
        dest: /var/www/www/w/extensions/OAuth
        version: "{{version}}"
        accept_hostkey: true
        force: yes
        depth: 1
    - name: Vector git checkout
      ansible.builtin.git:
        repo: https://gerrit.wikimedia.org/r/mediawiki/skins/Vector.git
        dest: /var/www/www/w/skins/Vector
        version: "{{version}}"
        accept_hostkey: true
        force: yes
        depth: 1
    - name: Composer
      include_tasks: composer.yml
      loop:
        - /var/www/www/w/
        - /var/www/www/w/extensions/CheckUser/
        - /var/www/www/w/extensions/TitleBlacklist/
        - /var/www/www/w/extensions/OAuth/
        - /var/www/www/w/extensions/AntiSpoof/

    - name: Create logs directory
      ansible.builtin.file:
        path: "/var/log/mediawiki"
        state: directory
        mode: '0755'
        owner: www-data
        group: www-data

    - name: Install MediaWiki
      ansible.builtin.shell:
        cmd: php maintenance/run.php install --dbname=wikidb --dbpass=wikiuser --server="{{urlScheme}}://{{wgServer}}" --scriptpath=/w --lang=en --pass=Adminpassword "OAuth Test Wiki" Admin
        chdir: /var/www/www/w
      when: wikidb.changed

    - name: Local settings
      ansible.builtin.copy:
        content: |
          <?php
          # This file was generated by MediaWiki 1.38.5
          # Managed by Ansible
          if ( !defined( 'MEDIAWIKI' ) ) {
              exit;
          }

          $wgSitename = "OAuth Test Wiki";
          $wgMetaNamespace = "OAuth_Test_Wiki";

          $wgScriptPath = "/w";

          $wgServer = "{{urlScheme}}://" . (isset($_SERVER['SERVER_NAME']) ? $_SERVER['SERVER_NAME'] : "{{wgServer}}");
          $wgResourceBasePath = $wgScriptPath;
          $wgLogos = [
              '1x' => "$wgResourceBasePath/resources/assets/change-your-logo.svg",
              'icon' => "$wgResourceBasePath/resources/assets/change-your-logo-icon.svg",
          ];

          $wgEmergencyContact = "apache@{{wgServer}}";
          $wgPasswordSender = "apache@{{wgServer}}";

          $wgDBpassword = "wikiuser";
          $wgDBname = "wikidb";
          $wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";
          $wgSharedTables[] = "actor";

          $wgMemCachedServers = [];
          $wgLocaltimezone = "UTC";

          $wgSecretKey = "e773a8f14c0ec3bd76585a06707607ef5446aef4fdecc667077c484697be67d1";

          $wgAuthenticationTokenVersion = "1";

          $wgRightsPage = "";
          $wgRightsUrl = "https://creativecommons.org/publicdomain/zero/1.0/";
          $wgRightsText = "Creative Commons Zero (Public Domain)";
          $wgRightsIcon = "$wgResourceBasePath/resources/assets/licenses/cc-0.png";

          $wgDefaultSkin = "vector";
          wfLoadSkin( 'Vector' );

          wfLoadExtension( 'AntiSpoof' );
          wfLoadExtension( 'CheckUser' );
          wfLoadExtension( 'OAuth' );
          wfLoadExtension( 'TitleBlacklist' );

          // Caching setup
          $wgObjectCaches['redis'] = array(
              'class'   => 'RedisBagOStuff',
              'servers' => array( '127.0.0.1:6379' ),
          );

          $wgMainCacheType = 'redis';
          $wgSessionCacheType = 'redis';  // same as WMF prod

          // OAuth setup
          $wgGroupPermissions['*']['createaccount'] = false;
          $wgGroupPermissions['*']['edit'] = false;
          $wgGroupPermissions['user']['mwoauthproposeconsumer'] = true;
          $wgGroupPermissions['user']['mwoauthupdateownconsumer'] = true;
          $wgGroupPermissions['user']['mwoauthmanageconsumer'] = true;
          $wgGroupPermissions['user']['mwoauthmanagemygrants'] = true;
          $wgGroupPermissions['suppress']['mwoauthsuppress'] = true;
          $wgGroupPermissions['suppress']['mwoauthviewsuppressed'] = true;
          $wgGroupPermissions['checkuser']['mwoauthviewprivate'] = true;
          $wgMWOAuthSecureTokenTransfer = false;

          $wgEmailAuthentication = false;
          $wgShowExceptionDetails = true;
          $wgBlockDisablesLogin = true;

          $wgDebugLogFile = "/var/log/mediawiki/debug.log";
          $wgDebugLogGroups = array(
            'exception' => '/var/log/mediawiki/exception.log',
            'error' => '/var/log/mediawiki/error.log',
            'OAuth' => '/var/log/mediawiki/OAuth.log',
          );

        dest: /var/www/www/w/LocalSettings.php

    - name: Update MediaWiki
      ansible.builtin.shell: 
        cmd: php maintenance/run.php update --quick
        chdir: /var/www/www/w

    - name: Update Main Page
      ansible.builtin.shell: 
        cmd: php maintenance/edit.php -b --user "Ansible playbook"  "Main Page"
        chdir: /var/www/www/w
        stdin: |
          This wiki is intended for testing OAuth applications against MediaWiki. If you need access to experiment with OAuth, contact [[Special:ListUsers/sysop|an existing user with access]] for an account.

          == OAuth consumers ==

          * [[Special:OAuthConsumerRegistration/propose|Propose a consumer]]
          * [[Special:OAuthManageConsumers/proposed|Approve the consumer]]


          * [[Special:OAuthConsumerRegistration/list|My registered consumers]]


          * [[Special:OAuthManageMyGrants|Consumers approved to access my account]]

          == All consumers ==
          * [[Special:OAuthManageConsumers/proposed|All proposed consumers]]
          * [[Special:OAuthManageConsumers/approved|All approved consumers]]

          * [[Special:OAuthManageConsumers/disabled|All disabled consumers]]
          * [[Special:OAuthManageConsumers/rejected|All rejected consumers]]
          * [[Special:OAuthManageConsumers/expired|All expired consumers]]

    - name: Update Title blacklist
      ansible.builtin.shell: 
        cmd: php maintenance/edit.php -b --user "Ansible playbook"  "MediaWiki:Titleblacklist"
        chdir: /var/www/www/w
        stdin: |
          # This is a disallowed titles list. Titles and usernames that match a regular expression here cannot be created.
          # Use "#" for comments.
          # This is case-insensitive by default
          .*blacklist.* <newaccountonly>

    - name: Update copyright
      ansible.builtin.shell: 
        cmd: php maintenance/edit.php -b --user "Ansible playbook"  "MediaWiki:Copyright"
        chdir: /var/www/www/w
        stdin: |
          Content is available under $1 unless otherwise noted.

          <div style="background-color: #FFE0E0; border: 2px dashed #AA0000; padding: 0.5em; margin-top:1em">
          <b>Warning: this is <u>not</u> a live Wikimedia Foundation project.</b> This site is used only for testing and development purposes. This site is not covered by the Wikimedia Foundation’s Terms of Use or Privacy Policy. Do not disclose personal information on this site and do not use this site to post any illegal or harmful content. For more information on this test environment, see <a href="https://wikitech.wikimedia.org">Wikimedia Cloud Services</a>.
          </div>