tanshu
d04314ab1c
Retargets the build and the playbook off rootful Docker on monoco, following the conventions already in place on emily's other services: Quadlet units in ~/.config/containers/systemd, per-service data in ~/podman-data, and a shared Caddy that every service registers itself with — a network drop-in plus a marked block in its Caddyfile. Nothing is published on the host; Caddy reaches the containers by name over mozimo_net. - Makefile: podman build + push instead of docker buildx, PLATFORMS=linux/arm64 (both hosts are aarch64). podman has no built-in QEMU the way buildx's builder image does, so a foreign-platform failure now points at qemu-user-static. - deploy.sh: pass COMMIT= to make, which the Makefile actually reads; it was passing TAG=, so the tag silently came from `git rev-parse` instead. - ansible: hosts emily, become false, XDG_RUNTIME_DIR for rootless podman and systemctl --user. Docker modules become Quadlet templates with user-service handlers, and the network role now ships mozimo.network plus the Caddy drop-in rather than calling docker_network. - UserNS=keep-id maps the container's uid 1000 (node) and root (vince) onto the host user, so PocketBase and Vince write host-owned files instead of subuid-owned ones; the play asserts the pinned uid still matches the host. - ansible/README.md: the unit layout, the service-registration convention, and the monoco -> emily migration (PocketBase 23 MB + Vince 119 MB, DNS cutover, rollback). Verified by a check-mode rehearsal against emily (13 ok / 8 changed / 0 failed) and a disposable Quadlet unit on that host proving the uid mapping, the EnvironmentFile and the isolated network. The real build and cutover have not been run.
72 lines
2.9 KiB
YAML
72 lines
2.9 KiB
YAML
---
|
|
# mozimo deployment — rootless Podman + Quadlet, on the host named emily.
|
|
#
|
|
# The layout follows the convention already in place on that host (see the
|
|
# caddy / tandoor / postgres playbooks that manage its other services):
|
|
#
|
|
# ~/.config/containers/systemd/ Quadlet units, generated into user services
|
|
# ~/podman-data/<service>/ each service's data
|
|
# ~/podman-data/caddy/conf/Caddyfile the shared Caddy config; every service
|
|
# appends its own block to it
|
|
#
|
|
# Nothing here needs root: podman runs as the ssh user, the units are user
|
|
# services, and the shared Caddy is already a user service on that host.
|
|
|
|
registry: registry.tanshu.com
|
|
username: ta-registry
|
|
password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
|
|
|
|
title: mozimo
|
|
tag: latest
|
|
|
|
# The unprivileged user that owns the containers. `ansible_user` on emily is
|
|
# the same account, so no become is involved anywhere in this play.
|
|
podman_user: tanshu
|
|
# `id -u tanshu` on emily. Pinned rather than read from facts because the
|
|
# play-level environment (XDG_RUNTIME_DIR) is templated before facts exist;
|
|
# the upload role asserts the two still agree.
|
|
podman_uid: 1001
|
|
xdg_runtime_dir: "/run/user/{{ podman_uid }}"
|
|
podman_data: "/home/{{ podman_user }}/podman-data"
|
|
quadlet_dir: "/home/{{ podman_user }}/.config/containers/systemd"
|
|
|
|
# mozimo's data root: PocketBase database and files, the Shopify token cache,
|
|
# and the runtime .env that the unit reads.
|
|
host_directory: "{{ podman_data }}/{{ title }}"
|
|
|
|
# image tag: deploy.sh passes -e image_tag=<commit>; "tag" is the fallback
|
|
# when running the playbook by hand — rollback = -e image_tag=<older-commit>
|
|
image: "{{ registry }}/{{ title }}:{{ image_tag | default(tag) }}"
|
|
app_container: "{{ title }}"
|
|
|
|
# apex is the canonical origin and serves the app; www 301-redirects to it
|
|
apex_host: "mozimo.in"
|
|
www_host: "www.mozimo.in"
|
|
www_port: 3000
|
|
cms_host: "cms.mozimo.in"
|
|
cms_port: 8090
|
|
|
|
# mozimo gets its own podman network, and registers itself with the shared
|
|
# Caddy through a drop-in rather than by editing Caddy's unit.
|
|
network_name: "{{ title }}_net"
|
|
network_quadlet: "{{ title }}"
|
|
|
|
# The shared Caddy on emily. Each service owns a block in its Caddyfile
|
|
# (blockinfile markers) and a drop-in that adds its network to Caddy.
|
|
caddy_container: caddy
|
|
caddy_service: caddy
|
|
caddyfile_path: "{{ podman_data }}/caddy/conf/Caddyfile"
|
|
caddy_dropin_dir: "{{ quadlet_dir }}/caddy.container.d"
|
|
caddy_dropin_file: "50-{{ title }}.conf"
|
|
|
|
# self-hosted first-party analytics (Vince) — script/events proxied at
|
|
# /stats/* on the apex host, dashboard published on stats_host
|
|
vince_container: vince
|
|
vince_port: 8000
|
|
vince_admin_name: admin
|
|
# change this before first deploy — it (re)sets the dashboard login
|
|
vince_admin_password: "ChangeMe-Vince-2025!"
|
|
vince_site_domain: mozimo.in
|
|
vince_directory: "{{ podman_data }}/vince"
|
|
stats_host: stats.mozimo.in
|