Rebuild ansible on the project deploy template

- playbook.yml (hosts: monoco) + vars/default.yml, requirements.yml
- roles: network (shared docker network), greatbear (registry pull,
  bind mount /var/lib/greatbear/pb_data, .env upload, health wait),
  caddy (blockinfile snippet into the shared Caddyfile + docker exec reload)
- image honors PB_DATA_DIR and runs as root to match the bind-mount pattern
- frontend on www.greatbear.in (+apex) with /api/* and /_* proxied to
  PocketBase; admin.greatbear.in redirects to the admin UI

ansible/roles/app/tasks/main.yml

@@ -1,58 +0,0 @@
----
-# Pull the image from the private registry and (re)create the app container.
-- name: Log in to the private registry
-  community.docker.docker_login:
-    registry_url: "{{ registry_url }}"
-    username: "{{ registry_username }}"
-    password: "{{ registry_password }}"
-
-- name: Pull the application image
-  community.docker.docker_image:
-    name: "{{ app_image }}"
-    tag: "{{ app_image_tag }}"
-    source: pull
-    force_source: true
-
-- name: Run the application container
-  community.docker.docker_container:
-    name: "{{ app_container_name }}"
-    image: "{{ app_image }}:{{ app_image_tag }}"
-    state: started
-    recreate: true
-    restart_policy: unless-stopped
-    published_ports:
-      - "{{ app_site_publish }}"
-      - "{{ app_admin_publish }}"
-    volumes:
-      - "{{ app_volume_name }}:/data"
-    env:
-      PORT: "3000"
-      PB_URL: "http://127.0.0.1:8090"
-      PB_SUPERUSER_EMAIL: "{{ pb_superuser_email }}"
-      PB_SUPERUSER_PASSWORD: "{{ pb_superuser_password }}"
-    comparisons:
-      image: ignore   # recreate: true already handles image updates
-    container_default_behavior: compatibility
-
-- name: Wait for PocketBase to become healthy
-  ansible.builtin.uri:
-    url: http://127.0.0.1:8090/api/health
-    status_code: 200
-  register: pb_health
-  retries: 30
-  delay: 5
-  until: pb_health.status == 200
-
-- name: Wait for the site to respond
-  ansible.builtin.uri:
-    url: http://127.0.0.1:3000/
-    status_code: 200
-  register: site_health
-  retries: 30
-  delay: 5
-  until: site_health.status == 200
-
-- name: Log out of the private registry
-  community.docker.docker_login:
-    registry_url: "{{ registry_url }}"
-    state: absent

ansible/roles/caddy/defaults/main.yaml

@@ -0,0 +1,3 @@
+---
+caddy_container: caddy
+caddy_caddyfile_path: /var/lib/caddy/conf/Caddyfile

ansible/roles/caddy/handlers/main.yaml

@@ -0,0 +1,5 @@
+---
+- name: Reload Caddy configuration
+  ansible.builtin.command: "docker exec -w /etc/caddy {{ caddy_container }} caddy reload"
+  listen: "Reload Caddy"
+  changed_when: true

ansible/roles/caddy/handlers/main.yml

@@ -1,5 +0,0 @@
----
-- name: Reload Caddy
-  ansible.builtin.systemd:
-    name: "{{ caddy_service }}"
-    state: reloaded

ansible/roles/caddy/tasks/main.yaml

@@ -0,0 +1,26 @@
+---
+- name: Read snippet from template file
+  ansible.builtin.set_fact:
+    caddy_snippet_block: "{{ lookup('template', 'files/Caddyfile.j2') }}"
+
+- name: Read current Caddyfile
+  ansible.builtin.slurp:
+    path: "{{ caddy_caddyfile_path }}"
+  register: caddy_caddyfile_raw
+
+- name: Decode Caddyfile content
+  ansible.builtin.set_fact:
+    caddy_caddyfile_content: "{{ caddy_caddyfile_raw['content'] | b64decode }}"
+
+- name: Check if snippet already exists
+  ansible.builtin.set_fact:
+    caddy_snippet_present: "{{ caddy_snippet_block in caddy_caddyfile_content }}"
+
+- name: Add or update snippet in Caddyfile
+  ansible.builtin.blockinfile:
+    path: "{{ caddy_caddyfile_path }}"
+    marker: "# {mark} Ansible managed Caddy snippet for {{ host }}"
+    block: "{{ caddy_snippet_block }}"
+    create: true
+    mode: "0644"
+  notify: Reload Caddy configuration

ansible/roles/caddy/tasks/main.yml

@@ -1,47 +0,0 @@
----
-# Manage Caddy entries for the site and the PocketBase admin/API host.
-- name: Ensure Caddy config include directory exists
-  ansible.builtin.file:
-    path: "{{ caddy_config_dir }}"
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"
-
-- name: Check whether the main Caddyfile exists
-  ansible.builtin.stat:
-    path: "{{ caddyfile_path }}"
-  register: caddyfile_stat
-
-- name: Ensure the main Caddyfile imports conf.d entries
-  ansible.builtin.lineinfile:
-    path: "{{ caddyfile_path }}"
-    line: "import {{ caddy_config_dir }}/*.conf"
-    insertafter: EOF
-    state: present
-  when: caddyfile_stat.stat.exists
-  notify: Reload Caddy
-
-- name: Install Great Bear Caddy entries
-  ansible.builtin.template:
-    src: greatbear.conf.j2
-    dest: "{{ caddy_config_dir }}/greatbear.conf"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: Reload Caddy
-
-- name: Validate Caddy configuration
-  ansible.builtin.command:
-    cmd: "caddy validate --config {{ caddyfile_path }} --adapter caddyfile"
-  changed_when: false
-  when: caddyfile_stat.stat.exists
-
-- name: Flush handlers (reload Caddy now)
-  ansible.builtin.meta: flush_handlers
-
-- name: Ensure Caddy is enabled and running
-  ansible.builtin.systemd:
-    name: "{{ caddy_service }}"
-    state: started
-    enabled: true

ansible/roles/caddy/templates/greatbear.conf.j2

@@ -1,12 +0,0 @@
-# The Great Bear — managed by Ansible. Changes will be overwritten.
-# Frontend (TanStack Start)
-{{ site_domain }} {
-	encode zstd gzip
-	reverse_proxy 127.0.0.1:3000
-}
-
-# PocketBase API + admin UI (http://{{ admin_domain }}/_/)
-{{ admin_domain }} {
-	encode zstd gzip
-	reverse_proxy 127.0.0.1:8090
-}

ansible/roles/greatbear/tasks/main.yaml

@@ -0,0 +1,56 @@
+---
+- name: Log in to private Docker registry
+  community.docker.docker_login:
+    registry: "{{ registry }}"
+    username: "{{ username }}"
+    password: "{{ password }}"
+
+- name: Pull The Great Bear image
+  community.docker.docker_image:
+    name: "{{ image_name }}"
+    source: pull
+    state: present
+    force_source: true
+
+- name: Ensure Host Directory exists
+  ansible.builtin.file:
+    path: "{{ host_data_path }}"
+    state: directory
+    mode: "0755"
+
+- name: Ensure PocketBase data directory exists
+  ansible.builtin.file:
+    path: "{{ host_data_path }}/pb_data"
+    state: directory
+    mode: "0755"
+
+- name: Upload the .env file
+  ansible.builtin.template:
+    src: "files/.env.j2"
+    dest: "{{ host_data_path }}/.env"
+    mode: "0600"
+
+- name: Create and run The Great Bear container
+  community.docker.docker_container:
+    name: "{{ container_name }}"
+    image: "{{ image_name }}"
+    state: started
+    restart_policy: "unless-stopped"
+    env_file: "{{ host_data_path }}/.env"
+    volumes:
+      - "{{ host_data_path }}/pb_data:/app/pb_data"
+    networks:
+      - name: "{{ docker_network }}"
+
+- name: Wait for the application container to become healthy
+  community.docker.docker_container_info:
+    name: "{{ container_name }}"
+  register: app_info
+  until: app_info.container.State.Health.Status == "healthy"
+  retries: 30
+  delay: 5
+
+- name: Log out of private Docker registry
+  community.docker.docker_login:
+    registry: "{{ registry }}"
+    state: absent

ansible/roles/network/tasks/main.yaml

@@ -0,0 +1,8 @@
+---
+- name: Ensure Docker network exists
+  community.docker.docker_network:
+    name: "{{ docker_network }}"
+    state: present
+    connected:
+      - "{{ caddy_container }}"
+    appends: true