tanshu
1c78fc5103
deploy.sh no longer needs a manual push before it, and no made-up tag: - It pushes the current branch, refuses a dirty tracked tree, and requires HEAD == origin/main before anything is built, so the image can only be built for a commit the remote actually has. --force and --no-push skip the guards. - The image is tagged :<commit> as well as :latest, and ansible takes -e image_tag=<commit>, so a deploy pins the exact revision; rollback is the same play with an older commit. - Makefile builds `git archive HEAD` instead of cloning the remote (the push guard makes the local commit the remote state) and defaults PLATFORM to linux/arm64, because emily is aarch64 — the same default mozimo uses. Drop build-check-local; build-check already builds the committed tree.
85 lines
3.3 KiB
YAML
85 lines
3.3 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Rootless Podman / Quadlet
|
|
# ---------------------------------------------------------------------------
|
|
# Derived from the connection: this play carries no become, so the Quadlet
|
|
# units belong to whoever Ansible connects as. Requires gather_facts (set in
|
|
# playbook.yml). A host that has already run caddy/playbook.yml from the
|
|
# ansible-playbooks repo has the rootless prerequisites.
|
|
podman_user: "{{ ansible_facts['user_id'] }}"
|
|
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
|
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Image
|
|
# ---------------------------------------------------------------------------
|
|
registry: registry.tanshu.com
|
|
registry_username: ta-registry
|
|
registry_password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
|
|
|
|
image_name: "{{ registry }}/tanshu/greatbear"
|
|
tag: latest
|
|
# deploy.sh passes -e image_tag=<commit>; `tag` is the fallback when running the
|
|
# play by hand. Rollback = -e image_tag=<older-commit>.
|
|
image: "{{ image_name }}:{{ image_tag | default(tag) }}"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# The Great Bear
|
|
# ---------------------------------------------------------------------------
|
|
app_name: greatbear
|
|
container_name: "{{ app_name }}"
|
|
unit_name: "{{ container_name }}.service"
|
|
|
|
# The Quadlet file is <network_name>.network; roles/register pins the Podman
|
|
# network name to <network_name>_net, the name the Docker-era deployment used.
|
|
network_name: "{{ app_name }}"
|
|
|
|
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
|
|
|
# Ports inside the container. Caddy proxies to them over greatbear_net; nothing
|
|
# is published on the host.
|
|
site_port: 3000
|
|
pb_port: 8090
|
|
|
|
# Public hosts for frontend & PocketBase routing.
|
|
host: www.greatbear.in
|
|
apex_host: greatbear.in
|
|
admin_host: admin.greatbear.in
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Shared Caddy unit (caddy/playbook.yml in the ansible-playbooks repo)
|
|
# ---------------------------------------------------------------------------
|
|
caddy_name: caddy
|
|
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
|
|
|
# Appended to the shared Caddyfile by roles/caddy. The sites are served from
|
|
# the container name over greatbear_net; no host ports are involved.
|
|
snippet_block: |
|
|
{{ host }}{% if apex_host is defined and apex_host %}, {{ apex_host }}{% endif %} {
|
|
# PocketBase Admin UI and REST API
|
|
redir /_ /_/
|
|
handle /_/* {
|
|
reverse_proxy {{ container_name }}:{{ pb_port }}
|
|
}
|
|
handle /api/* {
|
|
reverse_proxy {{ container_name }}:{{ pb_port }}
|
|
}
|
|
|
|
# TanStack Start frontend application
|
|
handle {
|
|
reverse_proxy {{ container_name }}:{{ site_port }}
|
|
}
|
|
}
|
|
{% if admin_host is defined and admin_host %}
|
|
{{ admin_host }} {
|
|
redir / /_/
|
|
reverse_proxy {{ container_name }}:{{ pb_port }}
|
|
}
|
|
{% endif %}
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# PocketBase initial superuser credentials (bootstrapped on first start)
|
|
# ---------------------------------------------------------------------------
|
|
pb_admin_email: admin@greatbear.in
|
|
pb_admin_password: GreatBear!Admin2024
|