Add the sms-wa-bridge playbook

sms-wa-bridge/vars/default.yml

@@ -0,0 +1,113 @@
+---
+# ---------------------------------------------------------------------------
+# Rootless Podman / Quadlet
+# ---------------------------------------------------------------------------
+# Duplicated on purpose from caddy/vars/default.yml: a play cannot include that
+# file wholesale, because it also sets `host_directory` — to the Caddy data
+# directory — and every playbook defines that for itself. Keep these three in
+# sync with caddy/vars/default.yml. (Its fourth, podman_unprivileged_port_start,
+# belongs to the podman tasks, which this play does not run: the bridge
+# publishes nothing host-side.)
+#
+# podman_user is derived from the connection: this play carries no become, so
+# the Quadlet units belong to whoever Ansible connects as. Requires gather_facts
+# (set in playbook.yml).
+podman_user: "{{ ansible_facts['user_id'] }}"
+podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
+quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
+
+# ---------------------------------------------------------------------------
+# sms-wa-bridge
+# ---------------------------------------------------------------------------
+host: bridge.tanshu.dev
+
+container_name: sms-wa-bridge
+unit_name: "{{ container_name }}.service"
+
+# The Quadlet file is <network_name>.network, and caddy/roles/register pins the
+# Podman network name to <network_name>_net — so: sms-wa-bridge.network,
+# sms-wa-bridge_net, which is the name the Docker-era deployment used.
+network_name: "{{ container_name }}"
+
+# There is no registry: the image was built locally on monoco with
+# `docker build -t sms-wa-bridge` and exists nowhere else. Two ways to get it
+# onto emily, and the playbook supports both:
+#
+#   * `docker save sms-wa-bridge:latest | podman load` — the recommended route,
+#     and the one readme.md documents. It carries over the *exact* image whose
+#     WhatsApp session was paired; a rebuild re-resolves whatsapp-web.js
+#     (^1.26.0 in package.json), and a differently-versioned client can refuse
+#     that session and force a new QR scan.
+#   * `podman build` from the vendored context in files/build/ — what the play
+#     does by itself when no image is present, so a host with no monoco still
+#     gets a working deployment.
+#
+# Fully qualified either way: rootless Podman resolves short names against
+# unqualified-search-registries, and there is no TTY to answer a prompt when a
+# systemd unit starts. The unit also sets Pull=never, so an image that is not
+# there fails loudly instead of silently becoming a Docker Hub lookup.
+image: localhost/sms-wa-bridge:latest
+
+# What `podman load` actually calls a docker-saved unqualified tag: it qualifies
+# it against the default registry instead of `localhost`. Verified on emily with
+# a real `docker save` round trip. The play re-tags this name to `image` above,
+# so loading the image before the play is enough — see readme.md.
+image_docker_hub: docker.io/library/sms-wa-bridge:latest
+
+# `podman build` is skipped when the image is already present. Set this to true
+# to rebuild from files/build/ anyway, e.g. after editing server.js:
+#
+#   ansible-playbook -u tanshu ../sms-wa-bridge/playbook.yml -e rebuild_image=true
+rebuild_image: false
+
+# The whole of this service's state, and a faithful analogue of monoco's
+# /var/lib/sms-wa-bridge — same four entries, same layout, so the tar in
+# readme.md lands as-is:
+#
+#   wwebjs_auth/      the paired WhatsApp session (336 MB of the 336 MB tree)
+#   wwebjs_session/   empty, and vestigial; carried over to keep the shape
+#   rules.json        routing rules, re-read from disk on every request
+#   bridge.log        the app's own log file
+host_directory: "{{ podman_data_dir }}/{{ container_name }}"
+
+# The image build context, kept out of host_directory so the data tree stays a
+# faithful copy of the old one. Only used when the play builds the image.
+build_dir: "{{ podman_data_dir }}/{{ container_name }}-build"
+
+# The port server.js listens on inside the container (PORT's default). Caddy
+# proxies to it; nothing is published on the host, exactly as on monoco.
+container_port: 8080
+
+# The shared secret MacroDroid sends as `X-Auth`, carried over verbatim from the
+# Docker-era container so the cutover is a URL change and nothing else. It is
+# committed in plaintext because it always has been (the old app readme had it,
+# and the Docker-era container took it as an -e flag); the unit keeps it out of
+# its own world-readable file via EnvironmentFile=.
+auth_secret: "64f205031acc01744b6edc23"
+
+# AUTH_SECRET lives here rather than as an Environment= line in the unit: that
+# file is world-readable in ~/.config. Read by podman (--env-file), not by
+# Ansible, so it has to be written before the unit starts.
+env_file: "{{ host_directory }}/{{ container_name }}.env"
+
+# The image ships no HEALTHCHECK, so the unit defines one and the play gates on
+# it. /health is the app's own endpoint and `wget` is what the runtime image has
+# — the Dockerfile installs wget, not curl. It answers 200 whenever the HTTP
+# server is up, so this proves the server is serving; it does *not* prove
+# WhatsApp is paired. That is what the /health *payload* shows, and the play
+# reports it.
+health_cmd: "wget -q -O /dev/null http://127.0.0.1:{{ container_port }}/health"
+
+# ---------------------------------------------------------------------------
+# The shared Caddy unit and its Caddyfile, both owned by caddy/playbook.yml
+# ---------------------------------------------------------------------------
+caddy_name: caddy
+caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
+
+# The same two lines monoco's Caddyfile has had since the bridge was deployed
+# (`bridge.tanshu.dev -> sms-wa-bridge:8080`), so nothing about the public
+# contract changes but the host it runs on.
+snippet_block: |
+  {{ host }} {
+      reverse_proxy {{ container_name }}:{{ container_port }}
+  }