tanshu
d04314ab1c
Retargets the build and the playbook off rootful Docker on monoco, following the conventions already in place on emily's other services: Quadlet units in ~/.config/containers/systemd, per-service data in ~/podman-data, and a shared Caddy that every service registers itself with — a network drop-in plus a marked block in its Caddyfile. Nothing is published on the host; Caddy reaches the containers by name over mozimo_net. - Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64 (both hosts are aarch64). podman has no built-in QEMU the way buildx's builder image does, so a foreign-platform failure now points at qemu-user-static. - deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was passing TAG=, so the tag silently came from `git rev-parse` instead. - ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and systemctl --user. Docker modules become Quadlet templates with user-service handlers, and the network role now ships mozimo.network plus the Caddy drop-in rather than calling docker_network. - UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the host user, so PocketBase and Vince write host-owned files instead of subuid-owned ones; the play asserts the pinned uid still matches the host. - ansible/README.md: the unit layout, the service-registration convention, and the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover, rollback). Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed) and a disposable Quadlet unit on that host proving the uid mapping, the EnvironmentFile and the isolated network. The real build and cutover have not been run.
25 lines
874 B
YAML
25 lines
874 B
YAML
---
|
|
# Self-hosted first-party analytics (Vince — Plausible-protocol, single
|
|
# binary). Reachable only on mozimo's network:
|
|
# - Caddy proxies /stats/* on the apex host here (prefix stripped), serving
|
|
# the tracker script and event API first-party;
|
|
# - Caddy publishes the dashboard on {{ stats_host }}.
|
|
#
|
|
# Analytics history lives in {{ vince_directory }} and is migrated separately
|
|
# from monoco — see ansible/README.md.
|
|
- name: Pull the Vince image
|
|
ansible.builtin.command: "podman pull {{ vince_image }}"
|
|
changed_when: false
|
|
|
|
- name: Install the Vince Quadlet unit
|
|
ansible.builtin.template:
|
|
src: vince.container.j2
|
|
dest: "{{ quadlet_dir }}/{{ vince_container }}.container"
|
|
mode: "0644"
|
|
notify: Restart Vince
|
|
|
|
- name: Generate the user service from the Quadlet unit
|
|
ansible.builtin.systemd_service:
|
|
daemon_reload: true
|
|
scope: user
|