tanshu
e68f8ab00d
The fleet on emily is rootless Podman with Quadlet units under ~/.config/containers/systemd and state in ~/podman-data, all behind one shared Caddy unit. This brings the menus in line instead of leaving them the last Docker deployment. The build moves with them: podman reads a Containerfile as readily as a Dockerfile, so the name now says which toolchain is real. The app is one .container and one .network file. Two details carry it. UserNS=keep-id maps the image's own node account onto the user that owns the units, so data/ and site.env stay owned by tanshu: plain tar backups, no subuids. provision-site-env.sh writes site.env with the same mapping rather than --user, which under rootless Podman would have produced a subuid-owned file the app could not read. And the Site registers its own network with Caddy by writing a drop-in beside caddy.container, so Caddy never lists its upstreams and never changes when a Site is added. The unit keeps the Docker-era container name for the scripts and muscle memory that look it up, while the Caddyfile proxies to a dotless NetworkAlias, because a container name with dots in it is a liability in DNS. The unit keeps podman's Pull=missing, so a restart or a reboot never depends on the registry being reachable, while the play pulls explicitly at deploy time. That is also where a missing `podman login` for the private registry now fails, with the instruction, rather than as a unit that will not start. copy-site-data.sh moves a Site's data across, and is not a plain rsync: /var/lib/menu.* on monoco belongs to uid 1000 while the ssh user there is 1001, so the read needs sudo; monoco cannot ssh to emily, so the workstation relays the tar; and the extraction runs as tanshu on emily, which is what makes the files land owned by the user keep-id maps the app onto. It proves the copy by comparing a SHA-256 of the whole tree against the source and checking every file's owner. Not yet done: the copies themselves and the DNS move, which need a human.
23 lines
691 B
YAML
23 lines
691 B
YAML
# Local development. Production is the playbook in ansible/; this file exists so
|
|
# the container can be tried out without touching a server.
|
|
#
|
|
# npm run seed && podman compose up --build
|
|
#
|
|
# `podman compose` needs a provider on PATH — podman-compose or docker-compose.
|
|
# The image is built from the Containerfile beside this file.
|
|
services:
|
|
menu:
|
|
build: .
|
|
image: menu-admin:dev
|
|
ports:
|
|
- '3000:3000'
|
|
environment:
|
|
MENU_ROOT: /data
|
|
MENU_SITE_CONFIG: /etc/menu-app/site.json
|
|
SECURE_COOKIES: 'false'
|
|
LOG_LEVEL: info
|
|
volumes:
|
|
- ./config/hopsngrains.site.json:/etc/menu-app/site.json:ro
|
|
- ./.dev:/data
|
|
restart: unless-stopped
|