Let Docker allocate the network subnet again

Reverts the explicit subnets: the pools were freed by deleting five networks, so
the network role is back to its single idempotent task - ensure the network
exists and Caddy is on it - and the Sites no longer declare a subnet. The
deployment readme keeps the note that a new Site needs a config, and therefore a
new tag, but no longer asks for a free /24.

If the pools fill up again the failure is recognisable: 'all predefined address
pools have been fully subnetted', and the choices are deleting stale networks or
declaring a subnet per Site.

ansible/readme.md

@@ -52,10 +52,9 @@ machine's `~/.ssh/config` says. (`ssh` on some machines complains about
 a local file-permission bug whose fix is `sudo chown -R root:root
 /etc/ssh/ssh_config.d`, not something this playbook works around.)
 
-Adding a Site is one line in `hosts`, a copy of `vars/hopsngrains.yml`, a
+Adding a Site is one line in `hosts`, a copy of `vars/hopsngrains.yml`, and a
-`config/<site>.site.json`, and a **free subnet** — this host's Docker address
+`config/<site>.site.json`. The image is shared, so the config has to be in it:
-pools are exhausted, so `network_subnet` (a free `/24` from `10.210.0.0/16`) is
+a new Site needs a new tag.
-required and a network is only created with it.
 
 ## Checking it landed
 

ansible/roles/network/tasks/main.yaml

@@ -1,29 +1,5 @@
 ---
-- name: Look for the app network
+- name: 'Ensure {{ docker_network }} exists and Caddy is on it'
-  docker_network_info:
-    name: '{{ docker_network }}'
-  register: menu_network
-
-- name: Fail when this Site declares no subnet
-  fail:
-    msg: >-
-      {{ inventory_hostname }} needs a network_subnet in its vars file. This host's
-      default address pools are exhausted (every 172.17-172.30/16 and every
-      192.168.0-240/20 is taken), so Docker refuses to allocate one and a network
-      has to be created with an explicit subnet.
-  when: network_subnet | default('') == ''
-
-# An existing network is left exactly as it is: Docker cannot change a network's
-# subnet in place, and the Sites already running have theirs.
-- name: Create the app network with this Site's subnet
-  docker_network:
-    name: '{{ docker_network }}'
-    ipam_config:
-      - subnet: '{{ network_subnet }}'
-    state: present
-  when: not menu_network.exists
-
-- name: Put Caddy on the app network
   docker_network:
     name: '{{ docker_network }}'
     state: present

ansible/vars/default.yml

@@ -8,9 +8,6 @@ site: '{{ inventory_hostname }}'
 image_name: registry.tanshu.com/menu-admin
 image_tag: "{{ tag | default('latest') }}"
 
-# Every Site sets network_subnet: the host's Docker address pools are exhausted,
-# so a network created without an explicit subnet is refused. Use a free /24 from
-# 10.210.0.0/16, one per Site.
 app_uid: 1000
 app_gid: 1000
 

ansible/vars/greatbear.yml

@@ -11,7 +11,3 @@ docker_network: '{{ docker_container }}_net'
 # Everything the app writes — data/ and the untracked site.env. Deliberately the
 # directory the old static menus were served from.
 app_root: '/var/lib/{{ host }}'
-
-# The host's default Docker pools are exhausted, so every Site names a subnet.
-# This one already exists from the pool; the value is what a rebuild would use.
-network_subnet: 10.210.2.0/24

ansible/vars/hngmohali.yml

@@ -11,6 +11,3 @@ docker_network: '{{ docker_container }}_net'
 # Everything the app writes — data/ and the untracked site.env. Deliberately the
 # directory the old static menus were served from.
 app_root: '/var/lib/{{ host }}'
-
-# The host's default Docker pools are exhausted, so every Site names a subnet.
-network_subnet: 10.210.3.0/24

ansible/vars/hopsngrains.yml

@@ -19,7 +19,3 @@ docker_network: '{{ docker_container }}_net'
 # writes its own data/ inside it; the old menu files can be emptied out when
 # they are no longer wanted, and the directory itself must stay.
 app_root: '/var/lib/{{ host }}'
-
-# The host's default Docker pools are exhausted, so every Site names a subnet.
-# This one already exists from the pool; the value is what a rebuild would use.
-network_subnet: 10.210.1.0/24

test/site-configs.test.ts

@@ -52,8 +52,6 @@ describe('every Site in the inventory is complete', () => {
       assert.match(varsRaw, /^title: /m, `${name}: ${varFile} has no title`);
       assert.match(varsRaw, /^host: 'menu\.\{\{ title \}\}'/m, `${name}: host is not quoted`);
       assert.match(varsRaw, /^app_root: /m, `${name}: no app_root`);
-      // Without this the play fails on a host whose Docker pools are full.
-      assert.match(varsRaw, /^network_subnet: /m, `${name}: no network_subnet`);
     }
   });