tanshu
9620847108
- Makefile: podman build + push instead of docker buildx. build-production
clones the git remote and builds from it; build-check / build-check-local
build without pushing. Single-architecture (PLATFORM-overridable) rather
than a multi-arch manifest.
- deploy.sh: connect as the unprivileged container user; no become.
- ansible: target emily, rootless Podman Quadlet behind the fleet's shared
Caddy unit (caddy/playbook.yml in ansible-playbooks).
- register role writes greatbear.network (NetworkName=greatbear_net) and
the caddy.container.d drop-in that puts Caddy on it.
- greatbear role: podman login/pull, ~/podman-data/greatbear + .env,
greatbear.container (UserNS=keep-id:uid=0,gid=0, EnvironmentFile,
Network, Volume, no published ports), systemctl --user start and a
podman healthcheck gate, with a diagnostics rescue block.
- caddy role appends the site blocks to the shared Caddyfile and reloads;
handlers reload vs. recreate Caddy (a new network drop-in re-creates it).
- drop the network role, the community.docker requirements and the
ansible/files/ templates.
- .containerignore replaces .dockerignore (Buildah reads it natively).
- README: Podman build, rootless Quadlet deploy. No data migration step —
there is no PocketBase state to carry over.
64 lines
2.5 KiB
Makefile
64 lines
2.5 KiB
Makefile
# The Great Bear — container image builds.
|
|
#
|
|
# Built with Podman/Buildah, not Docker. The image is always built from a fresh
|
|
# clone of the git remote, so it matches a pushed commit; commit and push before
|
|
# deploying. Registry credentials: `podman login registry.tanshu.com` once per
|
|
# machine (nothing here prompts).
|
|
|
|
IMAGE ?= registry.tanshu.com/tanshu/greatbear
|
|
REPO ?= git@git.tanshu.com:tanshu/greatbear.git
|
|
TAG ?= latest
|
|
|
|
# Target platform. Defaults to the architecture of the machine running make,
|
|
# which is what a native `podman build` would use anyway. Only cross-build when
|
|
# the deploy host differs, e.g.:
|
|
#
|
|
# make build-production PLATFORM=linux/arm64
|
|
#
|
|
# Cross-building needs QEMU binfmt registered on the controller
|
|
# (qemu-user-static), the same requirement `docker buildx --platform` had.
|
|
PLATFORM ?= linux/$(shell uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/' -e 's/armv7l/arm/')
|
|
|
|
.PHONY: build-production
|
|
build-production: ## Build the image with podman from the git remote and push it
|
|
@set -euo pipefail; \
|
|
ctx="$$(mktemp -d)"; \
|
|
trap 'rm -rf "$$ctx"' EXIT; \
|
|
echo "==> cloning $(REPO)"; \
|
|
git clone --quiet --depth 1 "$(REPO)" "$$ctx/src"; \
|
|
echo "==> podman build --platform $(PLATFORM) -t $(IMAGE):$(TAG)"; \
|
|
podman build --pull=always --platform "$(PLATFORM)" \
|
|
-t "$(IMAGE):$(TAG)" \
|
|
-f "$$ctx/src/Dockerfile" "$$ctx/src"; \
|
|
echo "==> podman push $(IMAGE):$(TAG)"; \
|
|
podman push "$(IMAGE):$(TAG)"; \
|
|
if [ "$(TAG)" != "latest" ]; then \
|
|
echo "==> podman push $(IMAGE):latest"; \
|
|
podman tag "$(IMAGE):$(TAG)" "$(IMAGE):latest"; \
|
|
podman push "$(IMAGE):latest"; \
|
|
fi
|
|
|
|
.PHONY: build-check
|
|
build-check: ## Build from the git remote without pushing (compile check)
|
|
@set -euo pipefail; \
|
|
ctx="$$(mktemp -d)"; \
|
|
trap 'rm -rf "$$ctx"' EXIT; \
|
|
echo "==> cloning $(REPO)"; \
|
|
git clone --quiet --depth 1 "$(REPO)" "$$ctx/src"; \
|
|
echo "==> podman build --platform $(PLATFORM) greatbear:test"; \
|
|
podman build --pull=always --platform "$(PLATFORM)" \
|
|
-t localhost/greatbear:test \
|
|
-f "$$ctx/src/Dockerfile" "$$ctx/src"
|
|
|
|
.PHONY: build-check-local
|
|
build-check-local: ## Build the committed local tree (git archive) without pushing
|
|
@set -euo pipefail; \
|
|
ctx="$$(mktemp -d)"; \
|
|
trap 'rm -rf "$$ctx"' EXIT; \
|
|
mkdir -p "$$ctx/src"; \
|
|
git archive --format=tar HEAD | tar -x -C "$$ctx/src"; \
|
|
echo "==> podman build --platform $(PLATFORM) greatbear:test (local HEAD)"; \
|
|
podman build --pull=always --platform "$(PLATFORM)" \
|
|
-t localhost/greatbear:test \
|
|
-f "$$ctx/src/Dockerfile" "$$ctx/src"
|