Cut the comment bloat from the Podman playbooks
Comment blocks now stay within three lines and explain only the non-obvious. Long histories, include examples, and commented-out code are gone. No task, key, or value changed; the only data change is comment text inside the generated unit files.
This commit is contained in:
tanshu committed
1 parent
2aab1aec1e
commit
476a6d7cd0
85 files changed
+372
-2433
No files matched your search
@@ -1,112 +1,48 @@
|
||||
---
|
||||
# ---------------------------------------------------------------------------
|
||||
# Rootless Podman / Quadlet
|
||||
# ---------------------------------------------------------------------------
|
||||
# Duplicated on purpose from caddy/vars/default.yml: a play cannot include that
|
||||
# file wholesale, because it also sets `host_directory` — to the Caddy data
|
||||
# directory — and every playbook defines that for itself. Keep these three in
|
||||
# sync with caddy/vars/default.yml. (Its fourth, podman_unprivileged_port_start,
|
||||
# belongs to the podman tasks, which this play does not run: the bridge
|
||||
# publishes nothing host-side.)
|
||||
#
|
||||
# podman_user is derived from the connection: this play carries no become, so
|
||||
# the Quadlet units belong to whoever Ansible connects as. Requires gather_facts
|
||||
# (set in playbook.yml).
|
||||
# Derived from the connection user; requires gather_facts.
|
||||
podman_user: "{{ ansible_facts['user_id'] }}"
|
||||
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
||||
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# sms-wa-bridge
|
||||
# ---------------------------------------------------------------------------
|
||||
host: bridge.tanshu.dev
|
||||
|
||||
container_name: sms-wa-bridge
|
||||
unit_name: "{{ container_name }}.service"
|
||||
|
||||
# The Quadlet file is <network_name>.network, and caddy/roles/register pins the
|
||||
# Podman network name to <network_name>_net — so: sms-wa-bridge.network,
|
||||
# sms-wa-bridge_net, which is the name the Docker-era deployment used.
|
||||
# The Quadlet file is <network_name>.network; register pins <network_name>_net.
|
||||
network_name: "{{ container_name }}"
|
||||
|
||||
# There is no registry: the image was built locally on monoco with
|
||||
# `docker build -t sms-wa-bridge` and exists nowhere else. Two ways to get it
|
||||
# onto emily, and the playbook supports both:
|
||||
#
|
||||
# * `docker save sms-wa-bridge:latest | podman load` — the recommended route,
|
||||
# and the one readme.md documents. It carries over the *exact* image whose
|
||||
# WhatsApp session was paired; a rebuild re-resolves whatsapp-web.js
|
||||
# (^1.26.0 in package.json), and a differently-versioned client can refuse
|
||||
# that session and force a new QR scan.
|
||||
# * `podman build` from the vendored context in files/build/ — what the play
|
||||
# does by itself when no image is present, so a host with no monoco still
|
||||
# gets a working deployment.
|
||||
#
|
||||
# Fully qualified either way: rootless Podman resolves short names against
|
||||
# unqualified-search-registries, and there is no TTY to answer a prompt when a
|
||||
# systemd unit starts. The unit also sets Pull=never, so an image that is not
|
||||
# there fails loudly instead of silently becoming a Docker Hub lookup.
|
||||
# The image exists in no registry; load it from monoco or build it here.
|
||||
# A rebuild can re-resolve whatsapp-web.js and break the paired session, so prefer podman load.
|
||||
# Keep it fully qualified so rootless Podman never prompts; there is no TTY.
|
||||
image: localhost/sms-wa-bridge:latest
|
||||
|
||||
# What `podman load` actually calls a docker-saved unqualified tag: it qualifies
|
||||
# it against the default registry instead of `localhost`. Verified on emily with
|
||||
# a real `docker save` round trip. The play re-tags this name to `image` above,
|
||||
# so loading the image before the play is enough — see readme.md.
|
||||
# What podman load calls a docker-saved tag; the play re-tags it to image.
|
||||
image_docker_hub: docker.io/library/sms-wa-bridge:latest
|
||||
|
||||
# `podman build` is skipped when the image is already present. Set this to true
|
||||
# to rebuild from files/build/ anyway, e.g. after editing server.js:
|
||||
#
|
||||
# ansible-playbook -u tanshu ../sms-wa-bridge/playbook.yml -e rebuild_image=true
|
||||
# Set true to rebuild from files/build/ after editing server.js.
|
||||
rebuild_image: false
|
||||
|
||||
# The whole of this service's state, and a faithful analogue of monoco's
|
||||
# /var/lib/sms-wa-bridge — same four entries, same layout, so the tar in
|
||||
# readme.md lands as-is:
|
||||
#
|
||||
# wwebjs_auth/ the paired WhatsApp session (336 MB of the 336 MB tree)
|
||||
# wwebjs_session/ empty, and vestigial; carried over to keep the shape
|
||||
# rules.json routing rules, re-read from disk on every request
|
||||
# bridge.log the app's own log file
|
||||
# Same four entries and layout as monoco's /var/lib/sms-wa-bridge, so the tar lands as-is.
|
||||
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
||||
|
||||
# The image build context, kept out of host_directory so the data tree stays a
|
||||
# faithful copy of the old one. Only used when the play builds the image.
|
||||
build_dir: "{{ podman_data_dir }}/{{ container_name }}-build"
|
||||
|
||||
# The port server.js listens on inside the container (PORT's default). Caddy
|
||||
# proxies to it; nothing is published on the host, exactly as on monoco.
|
||||
container_port: 8080
|
||||
|
||||
# The shared secret MacroDroid sends as `X-Auth`, carried over verbatim from the
|
||||
# Docker-era container so the cutover is a URL change and nothing else. It is
|
||||
# committed in plaintext because it always has been (the old app readme had it,
|
||||
# and the Docker-era container took it as an -e flag); the unit keeps it out of
|
||||
# its own world-readable file via EnvironmentFile=.
|
||||
# Kept verbatim so the cutover only changes the URL.
|
||||
auth_secret: "64f205031acc01744b6edc23"
|
||||
|
||||
# AUTH_SECRET lives here rather than as an Environment= line in the unit: that
|
||||
# file is world-readable in ~/.config. Read by podman (--env-file), not by
|
||||
# Ansible, so it has to be written before the unit starts.
|
||||
# Read by podman through EnvironmentFile=, not by Ansible, so write it before the unit starts.
|
||||
env_file: "{{ host_directory }}/{{ container_name }}.env"
|
||||
|
||||
# The image ships no HEALTHCHECK, so the unit defines one and the play gates on
|
||||
# it. /health is the app's own endpoint and `wget` is what the runtime image has
|
||||
# — the Dockerfile installs wget, not curl. It answers 200 whenever the HTTP
|
||||
# server is up, so this proves the server is serving; it does *not* prove
|
||||
# WhatsApp is paired. That is what the /health *payload* shows, and the play
|
||||
# reports it.
|
||||
# The runtime image has wget, not curl.
|
||||
# /health answers 200 whenever the server is up, not when WhatsApp is paired.
|
||||
health_cmd: "wget -q -O /dev/null http://127.0.0.1:{{ container_port }}/health"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# The shared Caddy unit and its Caddyfile, both owned by caddy/playbook.yml
|
||||
# ---------------------------------------------------------------------------
|
||||
caddy_name: caddy
|
||||
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
||||
|
||||
# The same two lines monoco's Caddyfile has had since the bridge was deployed
|
||||
# (`bridge.tanshu.dev -> sms-wa-bridge:8080`), so nothing about the public
|
||||
# contract changes but the host it runs on.
|
||||
snippet_block: |
|
||||
{{ host }} {
|
||||
reverse_proxy {{ container_name }}:{{ container_port }}
|
||||
|
||||
Reference in new issue
Block a user