250456e3fe1ca58fa836fe182c0519327bba898c
2
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 tanshu
|
3d4ccdd6d1 |
TriliumNext: User=0 for keep-id, and our own health check
The first run of this playbook against emily failed, and all three reasons are worth recording because none of them is visible from the files alone. keep-id runs the container *process* as the uid it maps, so UserNS=keep-id:uid=1000,gid=1000 started the container as `node` rather than root -- and the image's start-docker.sh is written to start as root, ending with `exec su -c "node ./main.mjs" node`. `su` from a non-root uid asks for a password the node account does not have, so the container died with "su: Authentication failure" and Restart=always turned that into a crash loop. User=0 forces the process back to root and changes nothing about the mapping: node is still tanshu, so the app is still what writes the data directory and it stays tanshu's. nextcloud.container carries the same pair for the same reason. The health check had to be defined rather than inherited. `latest` floated between the two pulls -- monoco runs v0.95.0 (built 2025-06-15) and emily pulled v0.106.0 (built 2026-09-25) -- and v0.106.0 ships no HEALTHCHECK where v0.95.0 had docker_healthcheck.cjs, so `podman healthcheck run` failed with "no defined healthcheck". The unit now defines HealthCmd= against /api/health-check, the endpoint the app advertises itself in the healthcheck-url file it writes into the data directory, and the image has curl for it (but not wget). The verify and health-check steps are folded in with the start, because they fail the same way and want the same evidence. `systemctl start` reports success as soon as systemd holds the unit, so a container that dies a second later surfaced only as "activating" from `is-active`; the reason -- that "su: Authentication failure" -- was in the journal and nowhere the play looked. The rescue now dumps status, journal and podman logs for any of the three, which is how the su failure was found in the first place. The version float becomes a documented risk rather than a hypothetical: the cutover upgrades the app as well as the runtime, and the first start migrates document.db forward. That is one-way for the copy on emily, so the readme compares digests before the first start, keeps monoco's own tree as the rollback, and notes that pinning a tag here would decouple the two changes. Verified on emily rather than by inspection: the rendered unit was run first as a throwaway Quadlet unit against a scratch volume, then the playbook itself ran to ok=22/changed=6/failed=0 with the mount assertion passing, `healthcheck run` returning 0, podman reporting healthy, and the app's files landing in ~/podman-data/trilium owned by tanshu. The data directory was emptied afterwards and the unit left stopped, ready for the copy from monoco, which has not run yet. |
||
|
tanshu
|
09c964f34b |
Run TriliumNext Notes as a rootless Podman Quadlet
Replaces the 2022 nginx + docker_container playbook with a Quadlet systemd user unit on emily, and moves state from /var/lib/trillium to ~/podman-data/trilium. There is no database to attach: the state is one SQLite file (document.db, with its WAL sidecars), config.ini, session_secret.txt and Trilium's own backup/ directory, so unlike bitwarden/ and tandoor/ this play has no postgres role and nothing to restore from the shared cluster. The old playbook was wrong about what monoco actually runs, in three ways that each break the deployment on their own. monoco has been on TriliumNext since June 2025 (`triliumnext/notes:latest`, v0.95.0), not the retired zadam/trilium the playbook pulls, and its document.db carries the schema migrations that came with the change; the data directory is /home/node/trilium-data, not /root/trilium-data; and the container sits on trillium_net behind Caddy, with nothing published on the host. All three were read off the live host. UserNS=keep-id:uid=1000,gid=1000, because the entrypoint starts as container-root and drops to the image's node user, and uid 1000 is also what owns the whole Docker-era tree -- so the copied data arrives already in the right shape and needs no chown pass. The unit defines no HealthCmd=: unlike audiobookshelf, this image ships its own HEALTHCHECK, and the play runs it with podman healthcheck run. The mount assertion is a mount check and not a file check, which is where this play has to differ from audiobookshelf's. Asserting that document.db appeared on the host works there because the app creates it; here the migration puts it on the host before the app has ever run, so the file proves nothing. It asserts against podman inspect instead, and checks Source as well as Destination -- a Destination-only check would be satisfied by an anonymous volume mounted where the bind mount should be, which is exactly the silent case. Bind mount, anonymous volume, no mount and a payload with no Mounts key were each run against the expression before this commit; only the first passes. The site is unchanged; the service name is not. The live container is `trillium`, with an extra l, and that exists only in the hand-made docker run that created it. Everything on emily is `trilium`, following the app and this directory, and the only place the misspelling survives is the copy source path /var/lib/trillium that the readme documents. The readme carries the monoco -> emily copy command by command: why the source needs sudo (log/, tmp/ and backup/ are 0700 and backup/ is state), why the copy cannot be hot (document.db is live SQLite in WAL mode), and why the digest comparison has to happen before the first start, since Trilium can migrate the document as it opens it. Of the 106 MB, 91 MB is regenerable logs, and the no-sudo variant that skips them says out loud what it drops. The integration goes through the shared include rather than a local copy -- caddy/roles/register for the network and the Caddy drop-in -- as in the other service playbooks, and it runs in pre_tasks because Quadlet fails unit generation, not merely startup, when a referenced .network file does not exist yet. The dead files/nginx.conf.j2 goes with the nginx front end: Caddy handles the WebSocket upgrade the live editor needs and imposes no request-body limit, so there is nothing to carry over. |