tanshu
e68f8ab00d
The fleet on emily is rootless Podman with Quadlet units under ~/.config/containers/systemd and state in ~/podman-data, all behind one shared Caddy unit. This brings the menus in line instead of leaving them the last Docker deployment. The build moves with them: podman reads a Containerfile as readily as a Dockerfile, so the name now says which toolchain is real. The app is one .container and one .network file. Two details carry it. UserNS=keep-id maps the image's own node account onto the user that owns the units, so data/ and site.env stay owned by tanshu: plain tar backups, no subuids. provision-site-env.sh writes site.env with the same mapping rather than --user, which under rootless Podman would have produced a subuid-owned file the app could not read. And the Site registers its own network with Caddy by writing a drop-in beside caddy.container, so Caddy never lists its upstreams and never changes when a Site is added. The unit keeps the Docker-era container name for the scripts and muscle memory that look it up, while the Caddyfile proxies to a dotless NetworkAlias, because a container name with dots in it is a liability in DNS. The unit keeps podman's Pull=missing, so a restart or a reboot never depends on the registry being reachable, while the play pulls explicitly at deploy time. That is also where a missing `podman login` for the private registry now fails, with the instruction, rather than as a unit that will not start. copy-site-data.sh moves a Site's data across, and is not a plain rsync: /var/lib/menu.* on monoco belongs to uid 1000 while the ssh user there is 1001, so the read needs sudo; monoco cannot ssh to emily, so the workstation relays the tar; and the extraction runs as tanshu on emily, which is what makes the files land owned by the user keep-id maps the app onto. It proves the copy by comparing a SHA-256 of the whole tree against the source and checking every file's owner. Not yet done: the copies themselves and the DNS move, which need a human.
25 lines
1.1 KiB
INI
25 lines
1.1 KiB
INI
# The Ansible inventory for the menus. Every Site runs on the same box — emily,
|
|
# the rootless Podman host — so each entry names it and points at the vars file
|
|
# that describes it.
|
|
#
|
|
# cd ansible
|
|
# ansible-playbook --inventory=hosts playbook.yml # every Site
|
|
# ansible-playbook --inventory=hosts playbook.yml --limit hopsngrains
|
|
#
|
|
# This play carries no become: it writes rootless Quadlet units, which belong to
|
|
# whoever Ansible connects as, so it must connect as that user.
|
|
#
|
|
# ansible_host is written as the resolvable name rather than an ssh alias, so the
|
|
# inventory works on any machine, whatever its ~/.ssh/config says. emily has no
|
|
# DNS name yet, so that name is its address today; when DNS — or monoco's elastic
|
|
# address — moves to it at cutover, this is the one line that changes.
|
|
|
|
[menus]
|
|
hopsngrains ansible_host=35.154.14.59 var_file=vars/hopsngrains.yml
|
|
greatbear ansible_host=35.154.14.59 var_file=vars/greatbear.yml
|
|
hngmohali ansible_host=35.154.14.59 var_file=vars/hngmohali.yml
|
|
|
|
[all:vars]
|
|
ansible_user=tanshu
|
|
ansible_python_interpreter=/usr/bin/python3
|