Run Wiki.js as a rootless Podman Quadlet

wikijs/playbook.yml

@@ -1,69 +1,54 @@
-#################################################
-# DO Community Playbooks: Docker
-#################################################
 ---
-- hosts: all
-  become: true
+# Wiki.js as a rootless Podman Quadlet unit, behind the shared Caddy unit
+# (caddy/playbook.yml) and with its data in the shared Postgres unit
+# (postgres/playbook.yml).
+#
+# Connects as the container user and runs everything as that user: the Quadlet
+# units belong to it, so the connection's PAM session is what makes
+# `systemctl --user` work without any environment juggling.
+#
+# gather_facts is required: podman_user and the home directory come from the
+# user_id / user_dir facts.
+#
+# The rootless-Podman prerequisites (installing podman, enabling lingering, the
+# low-port sysctl, creating the Quadlet directory) are deliberately NOT applied
+# here. They are the shared task file at caddy/roles/podman/tasks/main.yaml, and
+# a host that has already run caddy/playbook.yml has them:
+#
+#   - name: Rootless Podman prerequisites
+#     ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/podman/tasks/main.yaml"
+#
+# The variables this play needs are duplicated at the top of vars/default.yml, so
+# it stands on its own. (Applying the commented include above would also need
+# podman_unprivileged_port_start, which lives in caddy/vars/default.yml.)
+#
+# Run with: ansible-playbook -u tanshu wikijs/playbook.yml
+- name: Deploy Wiki.js as a rootless Podman Quadlet
+  hosts: emily
+  gather_facts: true
   vars_files:
     - vars/default.yml
 
-  tasks:
-    - name: Pull Wiki.js image
-      docker_image:
-        name: "{{ image_name }}"
-        source: pull
-        state: present
-        force_source: yes
-
-    - name: Ensure Host Directory exists
-      file:
-          path: "/var/lib/{{ host_directory }}"
-          state: directory
-          group: www-data
-          owner: www-data
-          mode: 0655
-
-    - name: Upload the .env file
-      template:
-        src: "files/.env"
-        dest: "/var/lib/{{ host_directory }}/.env"
-
-    - name: Create Wiki.js container
-      docker_container:
-        name: "{{ container_name }}"
-        image: "{{ image_name }}"
-        state: started
-        restart_policy: "unless-stopped"
-        env_file: "/var/lib/{{ host_directory }}/.env"
-        links:
-          - "postgres:db"
-        published_ports:
-          - "127.0.0.1:3443:3000"
-
-    - name: Check if Nginx conf file exists
-      stat: path="/etc/nginx/sites-available/{{ http_conf }}"
-      register: status
-
-    - name: No need to reload Nginx
-      debug: msg= {{ "No need to reload Nginx as sites-available entries have already been created" }}
-
-    - name: Set Nginx conf file
-      when: status.stat.exists == false
-      template:
-        src: "files/nginx.conf.j2"
-        dest: "/etc/nginx/sites-available/{{ http_conf }}"
-
-    - name: Enable new site
-      when: status.stat.exists == false
-      file:
-        src: "/etc/nginx/sites-available/{{ http_conf }}"
-        dest: "/etc/nginx/sites-enabled/{{ http_conf }}"
-        state: link
-      notify: Reload Nginx
-
-  handlers:
-    - name: Reload Nginx
-      service:
-        name: nginx
-        state: reloaded
+  pre_tasks:
+    # This must happen before the app unit is started, not after: the generated
+    # unit references {{ network_name }}.network, and Quadlet fails *unit
+    # generation* (so `systemctl --user start` reports "unit not found") when a
+    # referenced .network file does not exist yet. The same include writes the
+    # Caddy-side drop-in that attaches Caddy to this network, and the Postgres
+    # attach below needs the network unit to exist as well.
+    #
+    # network_name is a play var, so the include can see it directly.
+    - name: Register Wiki.js's network with Caddy
+      ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/register/tasks/main.yaml"
 
+  roles:
+    # Attaches this app's network to the shared Postgres unit, which is what
+    # makes DB_HOST=db resolve, and owns the "Restart Postgres" handler that
+    # postgres/roles/attach notifies. Runs first so the database is reachable
+    # before the app starts.
+    - postgres
+    # The app: content and upload directories, the 0600 environment file, the
+    # Quadlet unit, start + verify.
+    - wikijs
+    # Appends this site's block to the shared Caddyfile and reloads Caddy.
+    - caddy