tanshu
537a4f1e46
menu-admin was the odd one out: it built from the working directory with a date tag and a multi-arch manifest, deployed with `-e tag=`, and kept the Docker-era container name. The other two apps build from `git archive HEAD` and tag with the commit, so what runs on the host is exactly what git knows about; build only for the architecture emily actually runs; and use one slug for the container, its network and its data directory. The build is now their three lines: `podman build --platform linux/arm64` from `git archive HEAD`, tagged `:<commit>` and `:latest`, pushed with `podman push` rather than a manifest. `deploy.sh` pushes the commit first, then refuses a dirty tracked tree or a HEAD that is not origin/main — which is what makes the commit tag trustworthy — takes the same `--force` and `--no-push`, and ends in the same `-u tanshu ... -e image_tag=<commit>`. Its own lint/typecheck/test gate stays, but behind `--checks`, so a plain deploy behaves as theirs does. The registry credential moves into vars/default.yml and the role logs in, pulls and logs out around it, as their roles do. The image is only pulled at deploy time, so the unit keeps podman's default `Pull=missing` and a reboot never needs the registry. This is the same plaintext credential the other two repos carry. One real bug goes with it: the healthcheck gate ran before the handler that restarts a changed unit, so a run that only changed the unit checked the stale container. `meta: flush_handlers` before the gate is the fix the sibling repos already made. The container, network and data directory are all menu-<site> now. The dotted Docker-era name and the NetworkAlias it needed are gone, so `podman logs menu-<site>` and `systemctl --user status menu-<site>` are the same two commands across all three apps. The Dockerfile keeps its name for the same reason: podman reads it as readily as a Containerfile, and the siblings use that name too.
68 lines
2.4 KiB
YAML
68 lines
2.4 KiB
YAML
---
|
|
# Register this Site's network with the shared Caddy unit.
|
|
#
|
|
# Caddy is the base unit (caddy/playbook.yml in the ansible-playbooks repo) and
|
|
# knows nothing about its upstreams. A service adds itself by writing two files
|
|
# into the Quadlet directory:
|
|
#
|
|
# 1. its own menu-<site>.network unit, and
|
|
# 2. a drop-in next to caddy.container that pulls that network into Caddy.
|
|
#
|
|
# This mirrors ansible-playbooks/caddy/roles/register/tasks/main.yaml, vendored
|
|
# so this repo's deploy.sh stands on its own. Keep the bytes in sync with it.
|
|
#
|
|
# Included from playbook.yml's pre_tasks, before the app unit is generated. Runs
|
|
# as the connection user, which must be {{ podman_user }}.
|
|
|
|
- name: Ensure the Quadlet directory exists
|
|
ansible.builtin.file:
|
|
path: '{{ quadlet_dir }}'
|
|
state: directory
|
|
owner: '{{ podman_user }}'
|
|
group: '{{ podman_user }}'
|
|
mode: '0755'
|
|
|
|
- name: 'Create the {{ network_name }} network unit'
|
|
ansible.builtin.copy:
|
|
dest: '{{ quadlet_dir }}/{{ network_name }}.network'
|
|
owner: '{{ podman_user }}'
|
|
group: '{{ podman_user }}'
|
|
mode: '0644'
|
|
content: |
|
|
# {{ network_name }} — logical app network.
|
|
# Managed by Ansible. Do not edit by hand.
|
|
#
|
|
# NetworkName pins the Podman network name. Without it Quadlet would
|
|
# create "systemd-{{ network_name }}".
|
|
#
|
|
# isolate blocks traffic between separate Podman networks, so a container
|
|
# on this network cannot reach one that is only on another. Caddy still
|
|
# reaches it, because it is a member of it.
|
|
[Network]
|
|
NetworkName={{ network_name }}_net
|
|
Options=isolate=true
|
|
notify: Restart Caddy
|
|
|
|
- name: Ensure the Caddy Quadlet drop-in directory exists
|
|
ansible.builtin.file:
|
|
path: '{{ quadlet_dir }}/{{ caddy_name }}.container.d'
|
|
state: directory
|
|
owner: '{{ podman_user }}'
|
|
group: '{{ podman_user }}'
|
|
mode: '0755'
|
|
|
|
- name: 'Register {{ network_name }} with Caddy'
|
|
ansible.builtin.copy:
|
|
dest: '{{ quadlet_dir }}/{{ caddy_name }}.container.d/50-{{ network_name }}.conf'
|
|
owner: '{{ podman_user }}'
|
|
group: '{{ podman_user }}'
|
|
mode: '0644'
|
|
content: |
|
|
# Added by the menu-admin playbook. Do not edit by hand.
|
|
#
|
|
# Quadlet merges this into caddy.container. Deleting this file removes
|
|
# the network from Caddy on the next daemon-reload.
|
|
[Container]
|
|
Network={{ network_name }}.network
|
|
notify: Restart Caddy
|