tanshu
9620847108
- Makefile: podman build + push instead of docker buildx. build-production
clones the git remote and builds from it; build-check / build-check-local
build without pushing. Single-architecture (PLATFORM-overridable) rather
than a multi-arch manifest.
- deploy.sh: connect as the unprivileged container user; no become.
- ansible: target emily, rootless Podman Quadlet behind the fleet's shared
Caddy unit (caddy/playbook.yml in ansible-playbooks).
- register role writes greatbear.network (NetworkName=greatbear_net) and
the caddy.container.d drop-in that puts Caddy on it.
- greatbear role: podman login/pull, ~/podman-data/greatbear + .env,
greatbear.container (UserNS=keep-id:uid=0,gid=0, EnvironmentFile,
Network, Volume, no published ports), systemctl --user start and a
podman healthcheck gate, with a diagnostics rescue block.
- caddy role appends the site blocks to the shared Caddyfile and reloads;
handlers reload vs. recreate Caddy (a new network drop-in re-creates it).
- drop the network role, the community.docker requirements and the
ansible/files/ templates.
- .containerignore replaces .dockerignore (Buildah reads it natively).
- README: Podman build, rootless Quadlet deploy. No data migration step —
there is no PocketBase state to carry over.
83 lines
3.2 KiB
YAML
83 lines
3.2 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Rootless Podman / Quadlet
|
|
# ---------------------------------------------------------------------------
|
|
# Derived from the connection: this play carries no become, so the Quadlet
|
|
# units belong to whoever Ansible connects as. Requires gather_facts (set in
|
|
# playbook.yml). A host that has already run caddy/playbook.yml from the
|
|
# ansible-playbooks repo has the rootless prerequisites.
|
|
podman_user: "{{ ansible_facts['user_id'] }}"
|
|
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
|
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Image
|
|
# ---------------------------------------------------------------------------
|
|
registry: registry.tanshu.com
|
|
registry_username: ta-registry
|
|
registry_password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
|
|
|
|
image_name: "{{ registry }}/tanshu/greatbear"
|
|
tag: latest
|
|
image: "{{ image_name }}:{{ tag }}"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# The Great Bear
|
|
# ---------------------------------------------------------------------------
|
|
app_name: greatbear
|
|
container_name: "{{ app_name }}"
|
|
unit_name: "{{ container_name }}.service"
|
|
|
|
# The Quadlet file is <network_name>.network; roles/register pins the Podman
|
|
# network name to <network_name>_net, the name the Docker-era deployment used.
|
|
network_name: "{{ app_name }}"
|
|
|
|
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
|
|
|
# Ports inside the container. Caddy proxies to them over greatbear_net; nothing
|
|
# is published on the host.
|
|
site_port: 3000
|
|
pb_port: 8090
|
|
|
|
# Public hosts for frontend & PocketBase routing.
|
|
host: www.greatbear.in
|
|
apex_host: greatbear.in
|
|
admin_host: admin.greatbear.in
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Shared Caddy unit (caddy/playbook.yml in the ansible-playbooks repo)
|
|
# ---------------------------------------------------------------------------
|
|
caddy_name: caddy
|
|
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
|
|
|
# Appended to the shared Caddyfile by roles/caddy. The sites are served from
|
|
# the container name over greatbear_net; no host ports are involved.
|
|
snippet_block: |
|
|
{{ host }}{% if apex_host is defined and apex_host %}, {{ apex_host }}{% endif %} {
|
|
# PocketBase Admin UI and REST API
|
|
redir /_ /_/
|
|
handle /_/* {
|
|
reverse_proxy {{ container_name }}:{{ pb_port }}
|
|
}
|
|
handle /api/* {
|
|
reverse_proxy {{ container_name }}:{{ pb_port }}
|
|
}
|
|
|
|
# TanStack Start frontend application
|
|
handle {
|
|
reverse_proxy {{ container_name }}:{{ site_port }}
|
|
}
|
|
}
|
|
{% if admin_host is defined and admin_host %}
|
|
{{ admin_host }} {
|
|
redir / /_/
|
|
reverse_proxy {{ container_name }}:{{ pb_port }}
|
|
}
|
|
{% endif %}
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# PocketBase initial superuser credentials (bootstrapped on first start)
|
|
# ---------------------------------------------------------------------------
|
|
pb_admin_email: admin@greatbear.in
|
|
pb_admin_password: GreatBear!Admin2024
|