Add the Yamtrack playbook

yamtrack/vars/default.yml

@@ -0,0 +1,113 @@
+---
+# ---------------------------------------------------------------------------
+# Rootless Podman / Quadlet
+# ---------------------------------------------------------------------------
+# Duplicated on purpose from caddy/vars/default.yml: a play cannot include that
+# file wholesale, because it also sets `host_directory` — to the Caddy data
+# directory — and every playbook defines that for itself. Keep these three in
+# sync with caddy/vars/default.yml. (Its fourth, podman_unprivileged_port_start,
+# belongs to the podman tasks, which this play does not run: Yamtrack listens on
+# 8000 inside the container and publishes nothing host-side.)
+#
+# podman_user is derived from the connection: this play carries no become, so
+# the Quadlet units belong to whoever Ansible connects as. Requires gather_facts
+# (set in playbook.yml).
+podman_user: "{{ ansible_facts['user_id'] }}"
+podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
+quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
+
+# ---------------------------------------------------------------------------
+# Yamtrack
+# ---------------------------------------------------------------------------
+host: track.tanshu.com
+
+container_name: yamtrack
+unit_name: "{{ container_name }}.service"
+
+# Fully qualified on purpose: rootless Podman resolves short names against
+# unqualified-search-registries, and there is no TTY to answer a prompt when
+# the systemd unit starts. ghcr.io was already qualified; the tag is explicit
+# for the same reason. Nothing is pinned — see readme.md, "Notes and gotchas".
+image: ghcr.io/fuzzygrim/yamtrack:latest
+
+# The Quadlet file is <network_name>.network. caddy/roles/register pins the
+# Podman network name to <network_name>_net (so: yamtrack.network, yamtrack_net,
+# which is the name the Docker-era deployment used).
+network_name: "{{ container_name }}"
+
+host_directory: "{{ podman_data_dir }}/{{ container_name }}"
+
+# The image's bind mount: /yamtrack/db holds db.sqlite3 and its WAL sidecars.
+# Nothing else on /yamtrack is state — staticfiles/ is baked into the image and
+# the code is read-only — so this is the only directory worth keeping.
+data_dir: "{{ host_directory }}/data"
+
+# The port inside the container that Caddy proxies to: the image's own nginx
+# listens there and forwards to gunicorn. Reproduces the Docker-era Caddyfile
+# entry (`reverse_proxy yamtrack:8000`) exactly.
+container_port: 8000
+
+# SECRET, TZ and REDIS_URL live here rather than as Environment= lines in the
+# unit file: that file is world-readable in ~/.config. Read by systemd through
+# EnvironmentFile=, not by Ansible, so it has to be written before the unit
+# starts.
+env_file: "{{ host_directory }}/{{ container_name }}.env"
+
+# The uid this unit maps onto podman_user, and the PUID/PGID the image's
+# entrypoint is given. It is 0 — container root — and that is deliberate:
+#
+#   1. `--userns=keep-id` does two things: it maps one container uid onto the
+#      connecting user, and it runs the container *as that uid*. The entrypoint's
+#      first act is `groupmod`/`usermod`, which rewrite /etc/group and
+#      /etc/passwd — files owned by container-root in the image. With
+#      `keep-id:uid=1000` those run as `abc` and die on "cannot lock /etc/group"
+#      (the unit exits 10) before supervisord is ever reached. Root is required.
+#   2. Mapping container root onto podman_user is what keeps
+#      ~/podman-data/yamtrack owned by podman_user rather than by a subuid. It is
+#      the same choice caddy, bitwarden and tandoor make.
+#
+# It is also rendered as PUID/PGID in the environment file: the entrypoint's own
+# default is 1000, which under this mapping is a subuid on the host, so its
+# `chown -R abc:abc db` would strand the database on an unmapped uid. See
+# readme.md, "Who runs as whom".
+app_uid: 0
+app_gid: 0
+
+yamtrack_tz: "Asia/Kolkata"
+
+# The Django SECRET_KEY, as the image calls it (`SECRET`). Carried over verbatim
+# from the Docker-era playbook so existing sessions and password-reset tokens
+# stay valid — rotating it logs every user out. Committed in plaintext as
+# before; flagged as a follow-up, not changed here.
+yamtrack_secret: "c14c5970eb728fbf8b2325fd3004069d"
+
+# What the old container passed as URLS, which Yamtrack turns into its CSRF
+# trusted origins. ALLOWED_HOSTS is deliberately not set: its default is `*`,
+# which is what the Docker-era container relied on.
+urls: "https://{{ host }}"
+
+# ---------------------------------------------------------------------------
+# Valkey (the shared cache / Celery broker)
+# ---------------------------------------------------------------------------
+# Yamtrack hard-requires Redis: its cache backend is django_redis with no
+# fallback, the Celery worker and beat need a broker, and several metadata
+# providers talk to Redis directly. It is a *separate* playbook, deployed before
+# this one: yamtrack/roles/valkey only attaches its network to that shared unit.
+#
+# The Docker-era container was given `redis://valkey:6379`, and valkey is what
+# the container is called, so the URL is unchanged.
+valkey_container: valkey
+valkey_unit: "{{ valkey_container }}.service"
+redis_url: "redis://{{ valkey_container }}:6379"
+
+# ---------------------------------------------------------------------------
+# Caddy
+# ---------------------------------------------------------------------------
+# The shared Caddy unit and its Caddyfile, both owned by caddy/playbook.yml.
+caddy_name: caddy
+caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
+
+snippet_block: |
+  {{ host }} {
+      reverse_proxy {{ container_name }}:{{ container_port }}
+  }