Run Wiki.js as a rootless Podman Quadlet

wikijs/roles/postgres/tasks/main.yaml

@@ -0,0 +1,32 @@
+---
+# Attach this app's network to the shared Postgres unit.
+#
+# Postgres knows nothing about its clients, exactly like Caddy: a service joins
+# by dropping 50-hiwikijs.conf and the shared 10-network-aliases.conf next to
+# postgres.container. The canonical way to do that is the shared include below —
+# it writes the same bytes every service writes, asserts that hiwikijs.network
+# already exists, and notifies the "Restart Postgres" handler defined in this
+# role.
+#
+# This runs in the roles phase, which is after the register include in
+# playbook.yml's pre_tasks has created hiwikijs.network.
+
+- name: Attach Wiki.js to Postgres
+  ansible.builtin.include_tasks: "{{ playbook_dir }}/../postgres/roles/attach/tasks/main.yaml"
+
+# On a first attach both drop-ins are new, so Postgres has to be recreated to
+# join hiwikijs_net — and the shared 10-network-aliases.conf is what creates the
+# `db` alias DB_HOST asks for. That restart is a *handler*, which by default runs
+# at the end of the play, after the wikijs role has already started the app. The
+# app would then come up before `db` resolves, fail its own HTTP probe, and fail
+# the play on a machine where nothing is actually wrong.
+#
+# Flushing applies the new drop-in before the app starts. On later runs the
+# drop-ins are unchanged, nothing is pending, and this is a no-op.
+#
+# Note that flush_handlers flushes *everything* pending, which includes the
+# "Restart Caddy" that the register include notified in pre_tasks — and that is
+# the right thing here: the Caddy drop-in is new too, and Caddy has to be
+# recreated to join the network before it can proxy to hiwikijs.
+- name: Apply the Postgres network change before starting Wiki.js
+  ansible.builtin.meta: flush_handlers