From dcec2141c0ac4a247cf369e7963826f055c21fb0 Mon Sep 17 00:00:00 2001
From: Gregory Ballantine <gballantine@metaunix.net>
Date: Mon, 9 Nov 2026 11:29:04 -0500
Subject: [PATCH] Adding PHP role for web servers; updating web servers config
 with hosted sites

---
 inventory/group_vars/web_servers.yml | 123 +++++++++++++++++++++++++++
 playbooks/php.yml                    |   8 ++
 playbooks/site.yml                   |   2 +
 requirements.yml                     |   2 +
 4 files changed, 135 insertions(+)
 create mode 100644 inventory/group_vars/web_servers.yml
 create mode 100644 playbooks/php.yml

diff --git a/inventory/group_vars/web_servers.yml b/inventory/group_vars/web_servers.yml
new file mode 100644
index 0000000..e387a2c
--- /dev/null
+++ b/inventory/group_vars/web_servers.yml
@@ -0,0 +1,123 @@
+---
+
+### PHP config ###
+php_install_composer: true
+php_enable_php_fpm: true
+php_webserver_daemon: "nginx"
+
+# Ensure the socket directory and permissions allow Nginx access
+php_fpm_pool_user: "nginx"
+php_fpm_pool_group: "nginx"
+php_fpm_listen_owner: "nginx"
+php_fpm_listen_group: "nginx"
+
+# Default Unix socket location on RHEL
+php_fpm_listen: "/run/php-fpm/www.sock"
+
+php_packages:
+  - php-cli
+  - php-common
+  - php-fpm
+  - php-gd
+  - php-ldap
+  - php-mbstring
+  - php-mysqlnd
+  - php-pdo
+  - php-pgsql
+  - php-xml
+  - php-pecl-zip
+
+### Nginx config ###
+nginx_vhosts:
+  # ----------------------------------------
+  # metaunix.net (Default Server)
+  # ----------------------------------------
+  - listen: "80 default_server"
+    server_name: "{{ ansible_fqdn }} metaunix.net www.metaunix.net www.int.metaunix.net"
+    root: "/nfs/web/www"
+    index: "index.html"
+    extra_parameters: |
+      location / {
+          try_files $uri $uri/ =404;
+      }
+
+      location ~ .well-known/acme-challenge/ {
+          root /nfs/web/acme;
+          try_files $uri =404;
+      }
+
+  # ----------------------------------------
+  # wiki.bitgoblin.tech (DokuWiki)
+  # ----------------------------------------
+  - listen: "80"
+    server_name: "wiki.bitgoblin.tech"
+    root: "/nfs/web/dokuwiki"
+    index: "index.php"
+    extra_parameters: |
+      location / {
+          index doku.php;
+          try_files $uri $uri/ @dokuwiki;
+      }
+
+      location @dokuwiki {
+          rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
+          rewrite ^/_detail/(.*) /lib/exe/detail.php?media=$1 last;
+          rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
+          rewrite ^/(.*) /doku.php?id=$1 last;
+      }
+
+      location ~ ^/lib.*\.(gif|png|ico|jpg)$ {
+          expires 30d;
+      }
+
+      location ^~ /conf/ {
+          return 403;
+      }
+
+      location ^~ /data/ {
+          return 403;
+      }
+
+      location ~ \.php$ {
+          fastcgi_split_path_info ^(.+\.php)(/.+)$;
+          fastcgi_pass unix:{{ php_fpm_listen }};
+          fastcgi_index index.php;
+          include fastcgi_params;
+          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+          fastcgi_param HTTPS on;
+          fastcgi_param SERVER_PORT 443;
+          fastcgi_param HTTP_X_FORWARDED_PROTO $http_x_forwarded_proto;
+          fastcgi_param HTTP_X_FORWARDED_SSL on;
+          fastcgi_param REDIRECT_STATUS 200;
+      }
+
+      location ~ .well-known/acme-challenge/ {
+          root /nfs/web/acme;
+          try_files $uri =404;
+      }
+
+  # ----------------------------------------
+  # yourls.bitgoblin.tech
+  # ----------------------------------------
+  - listen: "80"
+    server_name: "yourls.bitgoblin.tech u.bitgoblin.tech"
+    root: "/nfs/web/yourls"
+    index: "index.php"
+    extra_parameters: |
+      location / {
+          try_files $uri $uri/ /yourls-loader.php$is_args$args;
+      }
+
+      location ~ \.php$ {
+          fastcgi_split_path_info ^(.+\.php)(/.+)$;
+          fastcgi_pass unix:{{ php_fpm_listen }};
+          fastcgi_index index.php;
+          include fastcgi.conf;
+          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+          fastcgi_param REDIRECT_STATUS 200;
+      }
+
+      location ~ .well-known/acme-challenge/ {
+          root /nfs/web/acme;
+          try_files $uri =404;
+      }
diff --git a/playbooks/php.yml b/playbooks/php.yml
new file mode 100644
index 0000000..6bb41ca
--- /dev/null
+++ b/playbooks/php.yml
@@ -0,0 +1,8 @@
+---
+
+- name: Install PHP
+  hosts: web_servers
+  become: true
+
+  roles:
+    - geerlingguy.php
diff --git a/playbooks/site.yml b/playbooks/site.yml
index 735e456..936a6c7 100644
--- a/playbooks/site.yml
+++ b/playbooks/site.yml
@@ -22,6 +22,8 @@
   import_playbook: podman.yml
 - name: Docker
   import_playbook: docker.yml
+- name: PHP
+  import_playbook: php.yml
 - name: Apache
   import_playbook: apache.yml
 - name: Nginx
diff --git a/requirements.yml b/requirements.yml
index 37c0639..b62e304 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -34,6 +34,8 @@ roles:
     version: 3.3.0
   - src: geerlingguy.nodejs
     version: 7.1.0
+  - src: geerlingguy.php
+    version: 6.1.0
   - src: geerlingguy.ntp
     version: 4.0.0
   - src: geerlingguy.ruby