tanshu
9620847108
- Makefile: podman build + push instead of docker buildx. build-production
clones the git remote and builds from it; build-check / build-check-local
build without pushing. Single-architecture (PLATFORM-overridable) rather
than a multi-arch manifest.
- deploy.sh: connect as the unprivileged container user; no become.
- ansible: target emily, rootless Podman Quadlet behind the fleet's shared
Caddy unit (caddy/playbook.yml in ansible-playbooks).
- register role writes greatbear.network (NetworkName=greatbear_net) and
the caddy.container.d drop-in that puts Caddy on it.
- greatbear role: podman login/pull, ~/podman-data/greatbear + .env,
greatbear.container (UserNS=keep-id:uid=0,gid=0, EnvironmentFile,
Network, Volume, no published ports), systemctl --user start and a
podman healthcheck gate, with a diagnostics rescue block.
- caddy role appends the site blocks to the shared Caddyfile and reloads;
handlers reload vs. recreate Caddy (a new network drop-in re-creates it).
- drop the network role, the community.docker requirements and the
ansible/files/ templates.
- .containerignore replaces .dockerignore (Buildah reads it natively).
- README: Podman build, rootless Quadlet deploy. No data migration step —
there is no PocketBase state to carry over.
68 lines
2.4 KiB
YAML
68 lines
2.4 KiB
YAML
---
|
|
# Register The Great Bear's network with the shared Caddy unit.
|
|
#
|
|
# Caddy is the base unit (caddy/playbook.yml in the ansible-playbooks repo) and
|
|
# knows nothing about its upstreams. A service adds itself by writing two files
|
|
# into the Quadlet directory:
|
|
#
|
|
# 1. its own greatbear.network unit, and
|
|
# 2. a drop-in next to caddy.container that pulls that network into Caddy.
|
|
#
|
|
# This mirrors ansible-playbooks/caddy/roles/register/tasks/main.yaml, vendored
|
|
# so this repo's deploy.sh stands on its own. Keep the bytes in sync with it.
|
|
#
|
|
# Included from playbook.yml's pre_tasks, before the app unit is generated. Runs
|
|
# as the connection user, which must be {{ podman_user }}.
|
|
|
|
- name: Ensure the Quadlet directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ quadlet_dir }}"
|
|
state: directory
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: '0755'
|
|
|
|
- name: "Create the {{ network_name }} network unit"
|
|
ansible.builtin.copy:
|
|
dest: "{{ quadlet_dir }}/{{ network_name }}.network"
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: '0644'
|
|
content: |
|
|
# {{ network_name }} — logical app network.
|
|
# Managed by Ansible. Do not edit by hand.
|
|
#
|
|
# NetworkName pins the Podman network name. Without it Quadlet would
|
|
# create "systemd-{{ network_name }}".
|
|
#
|
|
# isolate blocks traffic between separate Podman networks, so a container
|
|
# on this network cannot reach one that is only on another. Caddy still
|
|
# reaches it, because it is a member of it.
|
|
[Network]
|
|
NetworkName={{ network_name }}_net
|
|
Options=isolate=true
|
|
notify: Restart Caddy
|
|
|
|
- name: Ensure the Caddy Quadlet drop-in directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ quadlet_dir }}/{{ caddy_name }}.container.d"
|
|
state: directory
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: '0755'
|
|
|
|
- name: "Register {{ network_name }} with Caddy"
|
|
ansible.builtin.copy:
|
|
dest: "{{ quadlet_dir }}/{{ caddy_name }}.container.d/50-{{ network_name }}.conf"
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: '0644'
|
|
content: |
|
|
# Added by The Great Bear's playbook. Do not edit by hand.
|
|
#
|
|
# Quadlet merges this into caddy.container. Deleting this file removes
|
|
# the network from Caddy on the next daemon-reload.
|
|
[Container]
|
|
Network={{ network_name }}.network
|
|
notify: Restart Caddy
|