diff --git a/library/roles/roundcube/defaults/main.yml b/library/roles/roundcube/defaults/main.yml index 4f1ecb0a..3d00b861 100644 --- a/library/roles/roundcube/defaults/main.yml +++ b/library/roles/roundcube/defaults/main.yml @@ -1,18 +1,19 @@ --- roundcube_version: 1.4.1 -roundcube_dist_filename: 'roundcubemail-{{ roundcube_version }}-complete.tar.gz' +roundcube_dist: 'roundcubemail-{{ roundcube_version }}' +roundcube_dist_filename: '{{ roundcube_dist }}-complete.tar.gz' roundcube_download_url: 'https://github.com/roundcube/roundcubemail/releases/download/{{ roundcube_version }}/{{ roundcube_dist_filename }}' -roundcube_use_redis: True -roundcube_use_memcache: False +roundcube_use_redis: False +roundcube_use_memcache: True +roundcube_local_postgresql: True roundcube_web_basedir: /var/www/html roundcube_web_root: '{{ roundcube_web_basedir }}/roundcube' roundcube_data_base_dir: /srv -roundcube_data_dir: '{{ roundcube_data_base_dir }}/roundcube/data' -roundcube_oc_dir: '{{ roundcube_data_base_dir }}/roundcube/oc_keys' +roundcube_data_dir: '{{ roundcube_data_base_dir }}/roundcube' +roundcube_logs_dir: '{{ roundcube_data_dir }}/logs' +roundcube_temp_dir: '{{ roundcube_data_dir }}/temp' roundcube_servername: '{{ ansible_fqdn }}' -roundcube_servernames: - - { webroot: '{{ roundcube_web_root }}', id: 1, name: '{{ roundcube_servername }}' } roundcube_user: roundcube @@ -22,9 +23,97 @@ roundcube_db_name: roundcubemail roundcube_db_user: roundcube_u #roundcube_db_pwd: 'Use a vault file' -roundcube_admin_user: nc_admin -#roundcube_admin_u_pwd: 'Use a vault file' +roundcube_imap_server: 'localhost' +roundcube_imap_connection_type: 'tls' +roundcube_smtp_server: 'localhost' +roundcube_smtp_port: 587 +roundcube_smtp_automatic_credentials: True +roundcube_support_url: '' +roundcube_product_name: 'Roundcube Webmail' +#roundcube_crypt_key: 'Use a vault file' +roundcube_force_https_connection: true +# 0 - disabled, 1 - username and host only, 2 - username, host, password +roundcube_login_autocomplete: 0 +# 0 - disabled, 1 - only domain part, 2 - domain and local part. +roundcube_login_lc: 0 -roundcube_encryption_enabled: True -roundcube_ldap_auth: False +roundcube_memcache_hosts: + - '127.0.0.1:11211' +roundcube_domain_name: '' +roundcube_http_received_header_encrypt: false +# Set identities access level: +# 0 - many identities with possibility to edit all params +# 1 - many identities with possibility to edit all params but not email address +# 2 - one identity with possibility to edit all params +# 3 - one identity with possibility to edit all params but not email address +# 4 - one identity with possibility to edit only signature +roundcube_identities_level: 0 +roundcube_enable_spellcheck: false +# display remote resources (inline images, styles) +# 0 - Never, always ask +# 1 - Ask if sender is not in address book +# 2 - Always allow +roundcube_show_images: 0 +# compose html formatted messages by default +# 0 - never, +# 1 - always, +# 2 - on reply to HTML message, +# 3 - on forward or reply to HTML message +# 4 - always, except when replying to plain text message +roundcube_html_editor: 0 + +roundcube_default_plugins: + - acl + - additional_message_headers + - archive + - autologon + - database_attachments + - debug_logger + - emoticons + - help + - hide_blockquote + - identicon + - identity_select + - jqueryui + - markasjunk + - newmail_notifier + - new_user_dialog + - new_user_identity + - show_additional_headers + - squirrelmail_usercopy + - subscriptions_option + - userinfo + - zipdownload + +roundcube_optional_plugins: + - virtuser_file + - virtuser_query + - vcard_attachments + - attachment_reminder + - example_addressbook + - http_authentication + - password + - filesystem_attachments + - redundant_attachments + - managesieve + - enigma + - krb_authentication + +roundcube_managesieve_config: True +roundcube_managesieve_auth: 'plain' +roundcube_managesieve_port: 4190 +roundcube_managesieve_host: 'localhost' +roundcube_managesieve_tls: true +roundcube_managesieve_debug: false +roundcube_managesieve_vacation: 1 +roundcube_managesieve_forward: 1 +# IMPORTANT: you must provide a task that downloads each of the defined plugins +# cd /path/to/roundcube/plugins +# $ git clone git://github.com/elm/Roundcube-SMTP-per-Identity-Plugin.git identity_smtp +roundcube_identity_smtp_plugin: False +roundcube_identity_smtp_git: 'git://github.com/elm/Roundcube-SMTP-per-Identity-Plugin.git' +roundcube_identity_smtp_name: identity_smtp +roundcube_additional_plugins: [] +#roundcube_additional_plugins: +# - identity_smtp diff --git a/library/roles/roundcube/meta/main.yml b/library/roles/roundcube/meta/main.yml index 4be987f3..9a61777a 100644 --- a/library/roles/roundcube/meta/main.yml +++ b/library/roles/roundcube/meta/main.yml @@ -1,7 +1,7 @@ --- dependencies: - - { role: '../../library/roles/postgresql' } + - { role: '../../library/roles/postgresql', when: roundcube_local_postgresql } - { role: '../../library/roles/php-fpm' } - { role: '../../library/roles/nginx' } - - { role: '../../library/roles/redis', when nextcloud_use_redis } - - { role: '../../library/roles/memcached', when nextcloud_use_memcache } + - { role: '../../library/roles/redis', when roundcube_use_redis } + - { role: '../../library/roles/memcached', when roundcube_use_memcache } diff --git a/library/roles/roundcube/tasks/roundcube-install.yml b/library/roles/roundcube/tasks/roundcube-install.yml index 25bf7721..6907b9c0 100644 --- a/library/roles/roundcube/tasks/roundcube-install.yml +++ b/library/roles/roundcube/tasks/roundcube-install.yml @@ -3,81 +3,43 @@ - name: Create the roundcube webroot file: dest={{ roundcube_web_basedir }} owner=root group=root state=directory - - name: Create the roundcube data directory - file: dest={{ roundcube_data_dir }} state=directory owner={{ item.user }} group={{ item.user }} - with_items: '{{ phpfpm_pools }}' + - name: Create the roundcube base data directory + file: dest={{ roundcube_data_dir }} owner=root group=root state=directory - - name: Get roundcube - get_url: url={{ roundcube_download_url }} dest=/srv/{{ roundcube_dist_filename }} + - name: Create the roundcube data directories + file: dest={{ item }} state=directory owner={{ roundcube_user }} group={{ roundcube_user }} + with_items: + - '{{ roundcube_logs_dir }}' + - '{{ roundcube_temp_dir }}' - name: Unpack the roundcube archive - unarchive: remote_src=yes src=/srv/{{ roundcube_dist_filename }} dest={{ roundcube_web_basedir }} owner={{ item.user }} group={{ item.user }} + unarchive: remote_src=yes src={{ roundcube_download_url }} dest={{ roundcube_data_dir }} owner=root group=root args: - creates: '{{ item.doc_root }}/index.php' - with_items: '{{ phpfpm_pools }}' + creates: '{{ roundcube_web_root }}/public_html/index.php' + + - name: Move the roundcube installation to the final place + shell: mv {{ roundcube_data_dir }}/{{ roundcube_dist }} {{ roundcube_web_root }} + args: + creates: '{{ roundcube_web_root }}/public_html/index.php' tags: [ 'roundcube' ] +- name: Manage some additional plugins + block: + - name: Install the identity_smtp plugin + git: repo={{ roundcube_identity_smtp_git }} dest={{ roundcube_web_root }}/plugins/{{ roundcube_identity_smtp_name }} + when: roundcube_identity_smtp_plugin | bool + + tags: [ 'roundcube', 'roundcube_plugins', 'roundcube_config' ] + - block: - name: Configure the roundcube instance - shell: cd {{ item.doc_root }} ; php occ maintenance:install --database="{{ roundcube_db }}" --database-host "{{ roundcube_db_host }}" --database-name "{{ roundcube_db_name }}" --database-user "{{ roundcube_db_user }}" --database-pass "{{ nextcloud_db_pwd }}" --admin-user "{{ nextcloud_admin_user }}" --admin-pass "{{ nextcloud_admin_u_pwd }}" --data-dir={{ roundcube_data_dir }} ; touch {{ roundcube_data_dir }}/.ht_roundcube_setup + template: src=config.inc.php.j2 dest={{ roundcube_web_root }}/config/config.inc.php owner=root group=root mode=0444 + + - name: Initialize the roundcube database + shell: PGPASSWORD={{ roundcube_db_pwd }} psql -h {{ roundcube_db_host }} -U {{ roundcube_db_user }} -f {{ roundcube_web_root }}/SQL/postgres.initial.sql {{ roundcube_db_name }} && touch {{ roundcube_logs_dir }}/.roundcube_db.initialized args: - creates: '{{ roundcube_data_dir }}/.ht_roundcube_setup' - with_items: '{{ phpfpm_pools }}' + creates: '{{ roundcube_logs_dir }}/.roundcube_db.initialized' - - name: Set the trusted domains list - shell: cd {{ item.webroot }} ; php occ config:system:set trusted_domains {{ item.id }} --value={{ item.name }} ; touch {{ roundcube_data_dir }}/.ht_roundcube_trusted_domains - args: - creates: '{{ roundcube_data_dir }}/.ht_roundcube_trusted_domains' - with_items: '{{ roundcube_servernames }}' -/* DA QUI IN POI DA CONTROLLARE */ - - name: Setup the cron configuration - shell: cd {{ item.webroot }} ; php occ background:cron ; touch {{ roundcube_data_dir }}/.ht_roundcube_cron - args: - creates: 'touch {{ nextcloud_data_dir }}/.ht_nextcloud_cron' - with_items: '{{ nextcloud_servernames }}' - tags: [ 'nextcloud', 'nextcloud_config_cron' ] + tags: [ 'roundcube', 'roundcube_config' ] - - name: Install the nextcloud cron job - cron: user={{ item.user }} minute="*/15" job="php -f {{ item.doc_root }}/cron.php" name="NextCloud cron job" - with_items: '{{ phpfpm_pools }}' - tags: [ 'nextcloud', 'nextcloud_config_cron' ] - - become: True - become_user: '{{ nextcloud_user }}' - tags: [ 'nextcloud', 'nextcloud_config' ] - -- block: - - name: Create the nextcloud encryption keys directory - become_user: root - file: dest={{ nextcloud_oc_dir }} state=directory owner={{ item.user }} group={{ item.user }} - with_items: '{{ phpfpm_pools }}' - - - name: Activate global encryption - shell: cd {{ item.doc_root }} ; php occ app:enable encryption ; php occ encryption:enable ; php occ encryption:enable-master-key ; php occ encryption:change-key-storage-root {{ nextcloud_oc_dir }} ; touch {{ nextcloud_oc_dir }}/.ht_nextcloud_oc - args: - creates: '{{ nextcloud_oc_dir }}/.ht_nextcloud_oc' - with_items: '{{ phpfpm_pools }}' - - become: True - become_user: '{{ nextcloud_user }}' - when: nextcloud_encryption_enabled - tags: [ 'nextcloud', 'nextcloud_config', 'nextcloud_config_oc' ] - -- block: - - name: Enable ldap - shell: cd {{ item.doc_root }} ; php occ app:enable user_ldap ; touch {{ item.doc_root }}/.ht_nextcloud_ldap_enabled - args: - creates: '{{ item.doc_root }}/.ht_nextcloud_ldap_enabled' - with_items: '{{ phpfpm_pools }}' - - - name: Configure ldap - shell: cd {{ item.doc_root }} ; php occ ldap:create-empty-config ; touch {{ item.doc_root }}/.ht_nextcloud_ldap_configured - args: - creates: '{{ item.doc_root }}/.ht_nextcloud_ldap_configured' - with_items: '{{ phpfpm_pools }}' - - become: True - become_user: '{{ nextcloud_user }}' - when: nextcloud_ldap_auth - tags: [ 'nextcloud', 'nextcloud_config', 'nextcloud_config_ldap' ] diff --git a/library/roles/roundcube/tasks/roundcube-nginx.yml b/library/roles/roundcube/tasks/roundcube-nginx.yml index b65e5f7f..c5b1b69d 100644 --- a/library/roles/roundcube/tasks/roundcube-nginx.yml +++ b/library/roles/roundcube/tasks/roundcube-nginx.yml @@ -1,7 +1,7 @@ --- - block: - name: Install the nginx virtualhosts - template: src=nginx-virthost.conf dest=/etc/nginx/sites-available/{{ item.virthost }} owner=root group=root mode=0444 + template: src=nginx-virthost.conf.j2 dest=/etc/nginx/sites-available/{{ item.virthost }} owner=root group=root mode=0444 with_items: '{{ phpfpm_pools }}' notify: Reload nginx diff --git a/library/roles/roundcube/templates/config.inc.php.j2 b/library/roles/roundcube/templates/config.inc.php.j2 new file mode 100644 index 00000000..5a51ef5b --- /dev/null +++ b/library/roles/roundcube/templates/config.inc.php.j2 @@ -0,0 +1,244 @@ + "/images/logo_login_small.png", + // show the image /images/logo_login.png for the Login screen in the Elastic skin + "elastic:login" => "/images/logo_login.png", + // show the image /images/logo_small.png in the Elastic skin + "elastic:*[small]" => "/images/logo_small.png", + // show the image /images/larry.png in the Larry skin + "larry:*" => "/images/larry.png", + // show the image /images/logo_login.png on the login template in all skins + "login" => "/images/logo_login.png", + // show the image /images/logo_print.png for all print type logos in all skins + "[print]" => "/images/logo_print.png", + ); +*/ +$config['skin_logo'] = null; + +// automatically create a new Roundcube user when log-in the first time. +// a new user will be created once the IMAP login succeeds. +// set to false if only registered users can use this service +$config['auto_create_user'] = true; + +// Enables possibility to log in using email address from user identities +$config['user_aliases'] = false; + +// use this folder to store log files +// must be writeable for the user who runs PHP process (Apache user if mod_php is being used) +// This is used by the 'file' log driver. +$config['log_dir'] = '{{ roundcube_logs_dir }}/'; + +// use this folder to store temp files +// must be writeable for the user who runs PHP process (Apache user if mod_php is being used) +$config['temp_dir'] = '{{ roundcube_temp_dir }}/'; + +// expire files in temp_dir after 48 hours +// possible units: s, m, h, d, w +$config['temp_dir_ttl'] = '48h'; + +// Enforce connections over https +// With this option enabled, all non-secure connections will be redirected. +// It can be also a port number, hostname or hostname:port if they are +// different than default HTTP_HOST:443 +$config['force_https'] = {{ roundcube_force_https_connection }}; + +// tell PHP that it should work as under secure connection +// even if it doesn't recognize it as secure ($_SERVER['HTTPS'] is not set) +// e.g. when you're running Roundcube behind a https proxy +// this option is mutually exclusive to 'force_https' and only either one of them should be set to true. +$config['use_https'] = false; + +// Allow browser-autocompletion on login form. +// 0 - disabled, 1 - username and host only, 2 - username, host, password +$config['login_autocomplete'] = {{ roundcube_login_autocomplete }}; + +// Forces conversion of logins to lower case. +// 0 - disabled, 1 - only domain part, 2 - domain and local part. +// If users authentication is case-insensitive this must be enabled. +// Note: After enabling it all user records need to be updated, e.g. with query: +// UPDATE users SET username = LOWER(username); +$config['login_lc'] = {{ roundcube_login_lc }}; + +$config['display_product_info'] = 0; + +{% if roundcube_use_memcache %} +$config['session_storage'] = 'memcache'; +{% elif roundcube_use_redis %} +$config['session_storage'] = 'redis'; +{% else %} +$config['session_storage'] = 'db'; +{% endif %} + +{% if haproxy_ips is defined %} +$config['proxy_whitelist'] = array({% for h in haproxy_ips %}'{{ h }}'{% if not loop.last %}, {% endif %} {% endfor %}); +{% endif %} + +$config['mail_domain'] = '{{ roundcube_domain_name }}'; +$config['http_received_header_encrypt'] = {{ roundcube_http_received_header_encrypt }}; +$config['identities_level'] = {{ roundcube_identities_level }}; + +$config['create_default_folders'] = true; +$config['show_real_foldernames'] = true; +$config['enable_spellcheck'] = {{ roundcube_enable_spellcheck }}; +$config['show_images'] = {{ roundcube_show_images }}; +$config['htmleditor'] = {{ roundcube_html_editor }}; + +{% if roundcube_managesieve_config %} +// managesieve server port +$rcmail_config['managesieve_port'] = {{ roundcube_managesieve_port }}; +$config['managesieve_auth_type'] = '{{ roundcube_managesieve_auth }}'; +$rcmail_config['managesieve_host'] = '{{ roundcube_managesieve_host }}'; +$rcmail_config['managesieve_usetls'] = {{ roundcube_managesieve_tls }}; +$config['managesieve_debug'] = {{ roundcube_managesieve_debug }}; +$config['managesieve_vacation'] = {{ roundcube_managesieve_vacation }}; +$config['managesieve_forward'] = {{ roundcube_managesieve_forward }}; +{% endif %} + diff --git a/library/roles/roundcube/templates/nginx-virthost.conf.j2 b/library/roles/roundcube/templates/nginx-virthost.conf.j2 new file mode 100644 index 00000000..7d339866 --- /dev/null +++ b/library/roles/roundcube/templates/nginx-virthost.conf.j2 @@ -0,0 +1,132 @@ +upstream php-handler { + server {{ item.listen }}; +} + +server { + listen 80; + {% if haproxy_ips is not defined %} + listen [::]:80; + {% endif %} + server_name {{ item.nginx_servername }}; + # enforce https + location ~ /\.(?!well-known).* { + deny all; + access_log off; + log_not_found off; + return 404; + } + include /etc/nginx/snippets/letsencrypt-proxy.conf; + location / { + return 301 https://$server_name$request_uri; + } +} + +server { + listen 443 ssl http2; + {% if haproxy_ips is not defined %} + listen [::]:443 ssl http2; + {% endif %} + server_name {{ item.nginx_servername }}; + + include /etc/nginx/snippets/nginx-server-ssl.conf; + server_tokens off; + + {% if haproxy_ips is defined %} + # We are behind haproxy + {% for ip in haproxy_ips %} + set_real_ip_from {{ ip }}; + {% endfor %} + real_ip_header X-Forwarded-For; + {% endif %} + + index index.php; + + # Add headers to serve security related headers + # Before enabling Strict-Transport-Security headers please read into this + # topic first. + # add_header Strict-Transport-Security "max-age=15768000; + # includeSubDomains; preload;"; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag none; + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + + # Path to the root of your installation + root {{ item.doc_root }}; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + location = /favicon.ico { + log_not_found off; + access_log off; + } + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + # Uncomment if your server is build with the ngx_pagespeed module + # This module is currently not supported. + #pagespeed off; + + location ~ \.php$ { + include /etc/nginx/snippets/fastcgi-php.conf; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param HTTPS on; + #Avoid sending the security headers twice + fastcgi_param modHeadersAvailable true; + fastcgi_param front_controller_active true; + fastcgi_pass php-handler; + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } + + # Adding the cache control header for js and css files + # Make sure it is BELOW the PHP block + location ~ \.(?:css|js|woff|svg|gif)$ { + try_files $uri /index.php$uri$is_args$args; + add_header Cache-Control "public, max-age=15778463"; + # Add headers to serve security related headers (It is intended to + # have those duplicated to the ones above) + # Before enabling Strict-Transport-Security headers please read into + # this topic first. + # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"; + # + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + add_header X-Content-Type-Options nosniff; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Robots-Tag none; + add_header X-Download-Options noopen; + add_header X-Permitted-Cross-Domain-Policies none; + # Optional: Don't log access to assets + access_log off; + } + + location ~ \.(?:png|html|ttf|ico|jpg|jpeg)$ { + try_files $uri /index.php$uri$is_args$args; + # Optional: Don't log access to other assets + access_log off; + } +} + diff --git a/library/roles/roundcube/vars/main.yml b/library/roles/roundcube/vars/main.yml index 797adb8a..0d7c4810 100644 --- a/library/roles/roundcube/vars/main.yml +++ b/library/roles/roundcube/vars/main.yml @@ -2,7 +2,7 @@ nginx_use_common_virthost: False phpfpm_default_user: '{{ roundcube_user }}' phpfpm_default_pool_name: roundcube -redis_install: True +redis_install: False http_port: 80 https_port: 443 @@ -21,8 +21,9 @@ php_additional_packages: - 'php{{ php_version }}-bz2' - 'php{{ php_version }}-gmp' - 'php-imagick' - - 'php-redis' - 'php-apcu' + - postgresql-client + - 'php{{ php_version }}-memcache' phpfpm_default_memory_limit: "64M" @@ -35,7 +36,6 @@ php_global_settings: - { option: 'session.gc_maxlifetime', value: '21600' } - { option: 'session.gc_divisor', value: '500' } - { option: 'session.gc_probability', value: '1' } - - { option: 'always_populate_raw_post_data', value: '-1' } - { option: 'allow_url_fopen', value: 'on' } - { option: 'max_execution_time', value: '240' } @@ -51,7 +51,6 @@ php_global_settings: php_cli_global_settings: '{{ php_global_settings }}' - phpfpm_pools: - - { pool_name: '{{ phpfpm_default_pool_name }}', app_context: '{{ phpfpm_default_context }}', user: '{{ phpfpm_default_user }}', group: '{{ phpfpm_default_group }}', listen: '{{ phpfpm_default_listen }}', allowed_clients: '{{ phpfpm_default_allowed_clients }}', pm: '{{ phpfpm_default_pm }}', pm_max_children: '{{ phpfpm_default_pm_max_children }}', pm_start_servers: '{{ phpfpm_default_pm_start_servers }}', pm_min_spare: '{{ phpfpm_default_pm_min_spare_servers }}', pm_max_spare: '{{ phpfpm_default_pm_max_spare_servers }}', pm_max_requests: '{{ phpfpm_default_pm_max_requests }}', pm_status_enabled: '{{ phpfpm_default_pm_status_enabled }}', pm_status_path: '{{ phpfpm_default_pm_status_path }}', ping_enabled: '{{ phpfpm_default_ping_enabled }}', ping_path: '{{ phpfpm_default_ping_path }}', ping_response: '{{ phpfpm_default_ping_response }}', display_errors: '{{ phpfpm_default_display_errors }}', log_errors: '{{ phpfpm_default_log_errors }}', memory_limit: '{{ phpfpm_default_memory_limit }}', slowlog_timeout: '{{ phpfpm_default_slowlog_timeout }}', rlimit_files: '{{ phpfpm_default_rlimit_files }}', php_extensions: '{{ phpfpm_default_extensions }}', define_custom_variables: '{{ phpfpm_default_define_custom_variables }}', doc_root: '{{ roundcube_web_root }}', req_term_timeout: '240s', virthost: '{{ roundcube_servername }}', nginx_servername: '{{ roundcube_servername }}' } + - { pool_name: '{{ phpfpm_default_pool_name }}', app_context: '{{ phpfpm_default_context }}', user: '{{ phpfpm_default_user }}', group: '{{ phpfpm_default_group }}', listen: '{{ phpfpm_default_listen }}', allowed_clients: '{{ phpfpm_default_allowed_clients }}', pm: '{{ phpfpm_default_pm }}', pm_max_children: '{{ phpfpm_default_pm_max_children }}', pm_start_servers: '{{ phpfpm_default_pm_start_servers }}', pm_min_spare: '{{ phpfpm_default_pm_min_spare_servers }}', pm_max_spare: '{{ phpfpm_default_pm_max_spare_servers }}', pm_max_requests: '{{ phpfpm_default_pm_max_requests }}', pm_status_enabled: '{{ phpfpm_default_pm_status_enabled }}', pm_status_path: '{{ phpfpm_default_pm_status_path }}', ping_enabled: '{{ phpfpm_default_ping_enabled }}', ping_path: '{{ phpfpm_default_ping_path }}', ping_response: '{{ phpfpm_default_ping_response }}', display_errors: '{{ phpfpm_default_display_errors }}', log_errors: '{{ phpfpm_default_log_errors }}', memory_limit: '{{ phpfpm_default_memory_limit }}', slowlog_timeout: '{{ phpfpm_default_slowlog_timeout }}', rlimit_files: '{{ phpfpm_default_rlimit_files }}', php_extensions: '{{ phpfpm_default_extensions }}', define_custom_variables: '{{ phpfpm_default_define_custom_variables }}', doc_root: '{{ roundcube_web_root }}/public_html', req_term_timeout: '240s', virthost: '{{ roundcube_servername }}', nginx_servername: '{{ roundcube_servername }}' }