Run TriliumNext Notes as a rootless Podman Quadlet

Replaces the 2022 nginx + docker_container playbook with a Quadlet systemd user
unit on emily, and moves state from /var/lib/trillium to ~/podman-data/trilium.
There is no database to attach: the state is one SQLite file (document.db, with
its WAL sidecars), config.ini, session_secret.txt and Trilium's own backup/
directory, so unlike bitwarden/ and tandoor/ this play has no postgres role and
nothing to restore from the shared cluster.

The old playbook was wrong about what monoco actually runs, in three ways that
each break the deployment on their own. monoco has been on TriliumNext since
June 2025 (`triliumnext/notes:latest`, v0.95.0), not the retired zadam/trilium
the playbook pulls, and its document.db carries the schema migrations that came
with the change; the data directory is /home/node/trilium-data, not
/root/trilium-data; and the container sits on trillium_net behind Caddy, with
nothing published on the host. All three were read off the live host.

UserNS=keep-id:uid=1000,gid=1000, because the entrypoint starts as container-root
and drops to the image's node user, and uid 1000 is also what owns the whole
Docker-era tree -- so the copied data arrives already in the right shape and
needs no chown pass. The unit defines no HealthCmd=: unlike audiobookshelf, this
image ships its own HEALTHCHECK, and the play runs it with podman healthcheck
run.

The mount assertion is a mount check and not a file check, which is where this
play has to differ from audiobookshelf's. Asserting that document.db appeared on
the host works there because the app creates it; here the migration puts it on
the host before the app has ever run, so the file proves nothing. It asserts
against podman inspect instead, and checks Source as well as Destination -- a
Destination-only check would be satisfied by an anonymous volume mounted where
the bind mount should be, which is exactly the silent case. Bind mount,
anonymous volume, no mount and a payload with no Mounts key were each run
against the expression before this commit; only the first passes.

The site is unchanged; the service name is not. The live container is
`trillium`, with an extra l, and that exists only in the hand-made docker run
that created it. Everything on emily is `trilium`, following the app and this
directory, and the only place the misspelling survives is the copy source path
/var/lib/trillium that the readme documents.

The readme carries the monoco -> emily copy command by command: why the source
needs sudo (log/, tmp/ and backup/ are 0700 and backup/ is state), why the copy
cannot be hot (document.db is live SQLite in WAL mode), and why the digest
comparison has to happen before the first start, since Trilium can migrate the
document as it opens it. Of the 106 MB, 91 MB is regenerable logs, and the
no-sudo variant that skips them says out loud what it drops.

The integration goes through the shared include rather than a local copy --
caddy/roles/register for the network and the Caddy drop-in -- as in the other
service playbooks, and it runs in pre_tasks because Quadlet fails unit
generation, not merely startup, when a referenced .network file does not exist
yet. The dead files/nginx.conf.j2 goes with the nginx front end: Caddy handles
the WebSocket upgrade the live editor needs and imposes no request-body limit,
so there is nothing to carry over.

trilium/playbook.yml

@@ -1,54 +1,52 @@
-#################################################
-# DO Community Playbooks: Docker
-#################################################
 ---
-- hosts: all
-  become: true
+# TriliumNext Notes as a rootless Podman Quadlet unit, behind the shared Caddy
+# unit (see caddy/playbook.yml).
+#
+# Unlike bitwarden/ and tandoor/, this app has no database to attach: its state
+# is one SQLite file (document.db, with its WAL sidecars) plus config.ini,
+# session_secret.txt and an app-managed backup/ directory, all in a single
+# directory — so there is no postgres role here and nothing to restore from the
+# shared cluster.
+#
+# Connects as the container user and runs everything as that user: the Quadlet
+# units belong to it, so the connection's PAM session is what makes
+# `systemctl --user` work without any environment juggling.
+#
+# gather_facts is required: podman_user and the home directory come from the
+# user_id / user_dir facts.
+#
+# The rootless-Podman prerequisites (installing podman, enabling lingering, the
+# low-port sysctl, creating the Quadlet directory) are deliberately NOT applied
+# here. They are the shared task file at caddy/roles/podman/tasks/main.yaml, and
+# a host that has already run caddy/playbook.yml has them:
+#
+#   - name: Rootless Podman prerequisites
+#     ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/podman/tasks/main.yaml"
+#
+# The variables this play needs are duplicated at the top of vars/default.yml, so
+# it stands on its own. (Applying the commented include above would also need
+# podman_unprivileged_port_start, which lives in caddy/vars/default.yml.)
+#
+# Run with: ansible-playbook -u tanshu trilium/playbook.yml
+- name: Deploy TriliumNext Notes as a rootless Podman Quadlet
+  hosts: emily
+  gather_facts: true
   vars_files:
     - vars/default.yml
 
-  tasks:
-    - name: Pull default Trilium image
-      docker_image:
-        name: "{{ container_image }}"
-        source: pull
-
-    # Creates the number of containers defined by the variable create_containers, using values from vars file
-    - name: Create Trilium container
-      docker_container:
-        name: "{{ container_name }}"
-        image: "{{ container_image }}"
-        state: started
-        restart_policy: "unless-stopped"
-        published_ports:
-          - 127.0.0.1:8888:8080
-        volumes:
-          - /var/lib/trilium:/root/trilium-data
-
-    - name: Check if Nginx conf file exists
-      stat: path="/etc/nginx/sites-available/{{ http_conf }}"
-      register: status
-
-    - name: No need to reload Nginx
-      debug: msg= {{ "No need to reload Nginx as sites-available entries have already been created" }}
-
-    - name: Set Nginx conf file
-      when: status.stat.exists == false
-      template:
-        src: "files/nginx.conf.j2"
-        dest: "/etc/nginx/sites-available/{{ http_conf }}"
-
-    - name: Enable new site
-      when: status.stat.exists == false
-      file:
-        src: "/etc/nginx/sites-available/{{ http_conf }}"
-        dest: "/etc/nginx/sites-enabled/{{ http_conf }}"
-        state: link
-      notify: Reload Nginx
-
-  handlers:
-    - name: Reload Nginx
-      service:
-        name: nginx
-        state: reloaded
+  pre_tasks:
+    # This must happen before the app unit is started, not after: the generated
+    # unit references {{ network_name }}.network, and Quadlet fails *unit
+    # generation* (so `systemctl --user start` reports "unit not found") when a
+    # referenced .network file does not exist yet. The same include writes the
+    # Caddy-side drop-in that attaches Caddy to this network.
+    #
+    # network_name is a play var, so the include can see it directly.
+    - name: Register Trilium's network with Caddy
+      ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/register/tasks/main.yaml"
 
+  roles:
+    # The app: the data directory, the Quadlet unit, start + verify.
+    - trilium
+    # Appends this site's block to the shared Caddyfile and reloads Caddy.
+    - caddy