#################################################
# mozimo — rootless Podman + Quadlet deployment
#################################################
---
# Everything runs unprivileged as the ssh user: the containers are systemd
# *user* services generated from Quadlet units, and Caddy is the host's shared
# reverse proxy, which each service registers itself with (a network drop-in
# plus a block in its Caddyfile).
#
#   ansible-playbook playbook.yml -e image_tag=<commit>
#
# Before DNS points at this host, skip the Caddy role — appending the site
# block makes Caddy try to issue certificates for a name that still resolves
# elsewhere (it retries, but the log is noisy):
#
#   ansible-playbook playbook.yml -e image_tag=<commit> --skip-tags caddy
- hosts: emily
  become: false
  gather_facts: true
  vars_files:
    - vars/default.yml

  environment:
    # rootless podman and `systemctl --user` both need the user's runtime
    # directory, and an ansible ssh session has no login session to set it.
    XDG_RUNTIME_DIR: "{{ xdg_runtime_dir }}"

  roles:
    - upload
    - network
    - mozimo
    - analytics
    - role: caddy
      tags: [caddy]