Do not create a host file for the entrypoint's PHP session config

The role created ~/podman-data/nextcloud/redis-session.ini and the unit bind-mounted
it over the image path, purely because the entrypoint cannot write there itself.
Removed: the task, the mount, and -- because it is the only thing that triggers the
write -- REDIS_HOST from the environment file. The entrypoint now skips
configure_redis_session entirely and starts.

The Redis attach stays. The valkey role still puts nextcloud_net on the cache
container with the alias `redis`, so an instance whose config.php names that host
reaches it. Writing that configuration is config.php's business, and the readme
gives the three `occ config:system:set` lines for anyone who wants it, including
that this playbook will not do it for them.

The only thing lost is PHP session storage, which falls back to the container's own
filesystem -- a redeploy logs users out. That is the trade for not shipping a file
whose sole purpose is to work around a directory the image owns as root.

The env template and the valkey role comment both say why REDIS_HOST is absent, so
that adding it back is recognisable as the regression it is.

nextcloud/roles/nextcloud/tasks/main.yaml

@@ -17,22 +17,6 @@
     group: "{{ podman_user }}"
     mode: '0755'
 
-# The entrypoint generates PHP's session config with a redirect into
-# /usr/local/etc/php/conf.d, a directory the image creates as root and never
-# chowns. That write is refused, the entrypoint exits 2, and the unit crash-loops
-# into systemd's start limit. Bind-mounting a file over that path gives the write
-# somewhere it is allowed; the file has to exist first, or the mount lands as a
-# directory.
-- name: Create the file the entrypoint writes PHP's session config to
-  ansible.builtin.file:
-    path: "{{ host_directory }}/redis-session.ini"
-    state: touch
-    owner: "{{ podman_user }}"
-    group: "{{ podman_user }}"
-    mode: '0644'
-    access_time: preserve
-    modification_time: preserve
-
 # Read by the entrypoint, not by Ansible, so it has to exist before the unit
 # starts. Mode 0600: POSTGRES_PASSWORD is in it, and the unit file is
 # world-readable.

nextcloud/roles/nextcloud/templates/nextcloud.container.j2

@@ -32,11 +32,6 @@ Network={{ network_name }}.network
 # rsyncs new code in and upgrades the database in place.
 Volume={{ host_directory }}:{{ webroot }}
 
-# PHP's session config, which the entrypoint generates on every start. Without
-# this mount it cannot: /usr/local/etc/php/conf.d belongs to the image's root.
-# See the file task in roles/nextcloud for the failure this prevents.
-Volume={{ host_directory }}/redis-session.ini:/usr/local/etc/php/conf.d/redis-session.ini
-
 [Service]
 Restart=always
 # A first start initialises the webroot; a start after an image bump rsyncs code

nextcloud/roles/nextcloud/templates/nextcloud.env.j2

@@ -4,13 +4,16 @@
 # Mode 0600: this file is read by systemd, and POSTGRES_PASSWORD is in it.
 #
 # POSTGRES_* are what the entrypoint installs with on a fresh webroot; on an
-# installed instance they only have to agree with config.php. REDIS_HOST is live on
-# every start — the entrypoint regenerates PHP's session config from it.
+# installed instance they only have to agree with config.php.
+#
+# REDIS_HOST is deliberately absent: it makes the entrypoint write PHP's session
+# config into /usr/local/etc/php/conf.d, which the image owns as root and this
+# container cannot write — the unit crash-loops on it. Redis is config.php's
+# business, not this variable's. See readme.md, "Redis".
 POSTGRES_DB={{ pg_database }}
 POSTGRES_USER={{ pg_user }}
 POSTGRES_PASSWORD={{ pg_password }}
 POSTGRES_HOST={{ db_host }}
-REDIS_HOST={{ redis_host }}
 {% if nextcloud_admin_user | length > 0 and nextcloud_admin_password | length > 0 %}
 # Consumed only while there is no config.php, by the entrypoint's unattended
 # install. Empty by default, which leaves the setup wizard in charge.

nextcloud/roles/valkey/tasks/main.yaml

@@ -8,10 +8,9 @@
 # asserts that nextcloud.network already exists, and notifies the "Restart
 # Valkey" handler defined in this role.
 #
-# `redis` is the alias the app connects to, not the container name: REDIS_HOST is
-# what the image writes the PHP session handler from, and what this play puts in
-# config.php's Redis configuration on an unattended install. Renaming it would
-# mean editing a live instance's configuration for nothing.
+# `redis` is the alias the app connects to, not the container name: it is the host
+# an instance configured for Redis has in config.php. This playbook does not write
+# that configuration, it only makes the name resolvable.
 
 - name: Attach Nextcloud to Valkey
   ansible.builtin.include_tasks: "{{ playbook_dir }}/../valkey/roles/attach/tasks/main.yaml"