tanshu
9620847108
- Makefile: podman build + push instead of docker buildx. build-production
clones the git remote and builds from it; build-check / build-check-local
build without pushing. Single-architecture (PLATFORM-overridable) rather
than a multi-arch manifest.
- deploy.sh: connect as the unprivileged container user; no become.
- ansible: target emily, rootless Podman Quadlet behind the fleet's shared
Caddy unit (caddy/playbook.yml in ansible-playbooks).
- register role writes greatbear.network (NetworkName=greatbear_net) and
the caddy.container.d drop-in that puts Caddy on it.
- greatbear role: podman login/pull, ~/podman-data/greatbear + .env,
greatbear.container (UserNS=keep-id:uid=0,gid=0, EnvironmentFile,
Network, Volume, no published ports), systemctl --user start and a
podman healthcheck gate, with a diagnostics rescue block.
- caddy role appends the site blocks to the shared Caddyfile and reloads;
handlers reload vs. recreate Caddy (a new network drop-in re-creates it).
- drop the network role, the community.docker requirements and the
ansible/files/ templates.
- .containerignore replaces .dockerignore (Buildah reads it natively).
- README: Podman build, rootless Quadlet deploy. No data migration step —
there is no PocketBase state to carry over.
37 lines
1.6 KiB
YAML
37 lines
1.6 KiB
YAML
---
|
|
# The Great Bear — rootless Podman + Quadlet, behind the fleet's shared Caddy
|
|
# unit (caddy/playbook.yml in the ansible-playbooks repo).
|
|
#
|
|
# Connects as the container user and runs everything as that user: the Quadlet
|
|
# units belong to it, so the connection's PAM session is what makes
|
|
# `systemctl --user` and `podman exec` work without any environment juggling.
|
|
# There is deliberately no `become`: root-only prerequisites (Podman,
|
|
# `loginctl enable-linger`, the low-port sysctl Caddy needs) belong to
|
|
# caddy/playbook.yml, which must have run on this host first.
|
|
#
|
|
# gather_facts is required: podman_user, podman_data_dir and quadlet_dir are
|
|
# derived from the user_id / user_dir facts.
|
|
#
|
|
# Run with: ansible-playbook -u tanshu playbook.yml
|
|
- name: Deploy The Great Bear as a rootless Podman Quadlet
|
|
hosts: emily
|
|
gather_facts: true
|
|
vars_files:
|
|
- vars/default.yml
|
|
|
|
pre_tasks:
|
|
# This must happen before the app unit is started, not after: the generated
|
|
# greatbear.container references {{ network_name }}.network, and Quadlet
|
|
# fails *unit generation* (so `systemctl --user start` reports "unit not
|
|
# found") when a referenced .network file does not exist yet. The same
|
|
# include writes the drop-in that attaches the shared Caddy unit to this
|
|
# network, which is what makes `greatbear` resolvable to Caddy.
|
|
- name: Register The Great Bear's network with Caddy
|
|
ansible.builtin.include_tasks: "{{ playbook_dir }}/roles/register/tasks/main.yaml"
|
|
|
|
roles:
|
|
# The app: data directory, .env, the Quadlet unit, start + healthcheck.
|
|
- greatbear
|
|
# Appends this site's blocks to the shared Caddyfile and reloads Caddy.
|
|
- caddy
|