tanshu
05452127ec
The role had grown machinery that the problem does not require. Removed: - The init-sync lock pre-create. It guarded against one file in the webroot being owned by a subuid, which is cosmetic: the file is 0644, so it is readable and removable by host-side tools either way. - The image ID read/pull pair. No other service playbook pulls an image, and the update path is two commands the readme now spells out. - redis-session.ini.j2 and its three variables. The mount is load-bearing -- the entrypoint cannot write into the image's conf.d and dies trying -- but the template is not: the entrypoint writes that file itself on every start. One touched empty file and one Volume line replace the template and the variables. - The config.php stat, the wizard note, the maintenance-mode wait, the occ status report, the getent checks, the timer report. The installed/not-installed branching existed only because the readiness gates were written for an installed instance; with a gate that fits both, none of the branching is needed. - Comments that narrated this play's earlier runs rather than the system. What is left is four tasks before the start, a start-plus-gate block whose rescue collects the journal, and four tasks for the background-job timer: 149 lines and about 130 of them code, against 313 before. The readme loses its migration-era bulk for the same reason and is 297 lines, in line with the other services'. The one gate is now Nextcloud's own status.php inside the container. It answers only once the entrypoint has finished -- including any `occ upgrade`, which runs before Apache starts, so an update in progress is waited out rather than missed -- it reports `installed` either way, so a fresh webroot and an installed instance go through the same check, and it carries `maintenance` as well, which is the one state a probe would otherwise call healthy while every page returned 503.
98 lines
4.0 KiB
YAML
98 lines
4.0 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Rootless Podman / Quadlet
|
|
# ---------------------------------------------------------------------------
|
|
# Duplicated from caddy/vars/default.yml (which also sets `host_directory` for
|
|
# Caddy, so it cannot be included wholesale). Keep the three in sync. Its fourth,
|
|
# podman_unprivileged_port_start, is not needed here: Nextcloud publishes nothing
|
|
# host-side.
|
|
podman_user: "{{ ansible_facts['user_id'] }}"
|
|
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
|
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Nextcloud
|
|
# ---------------------------------------------------------------------------
|
|
# The site's hostname: what Caddy serves, and the trusted domain for an unattended
|
|
# install.
|
|
host: cloud.hopsngrains.com
|
|
|
|
container_name: nextcloud
|
|
unit_name: "{{ container_name }}.service"
|
|
|
|
# Fully qualified: rootless Podman resolves short names against
|
|
# unqualified-search-registries, and a unit has no TTY to answer the prompt.
|
|
image: docker.io/library/nextcloud:latest
|
|
|
|
# caddy/roles/register pins the Podman network name to <network_name>_net, so the
|
|
# file is nextcloud.network and the network is nextcloud_net.
|
|
network_name: "{{ container_name }}"
|
|
|
|
# The image's VOLUME and Apache document root, and — unlike the other services
|
|
# here — the code as well as the state: config.php, data/, custom_apps/ and every
|
|
# PHP file live under it. See readme.md, "What is state, and what is not".
|
|
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
|
webroot: /var/www/html
|
|
|
|
# www-data. The entrypoint rsyncs the code in as this uid and Apache runs its
|
|
# workers as it, so this is the one uid to map onto the connection user.
|
|
app_uid: 33
|
|
app_gid: 33
|
|
|
|
# Apache's port inside the container, and the one Caddy proxies to.
|
|
container_port: 80
|
|
|
|
env_file: "{{ host_directory }}/nextcloud.env"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Shared services (each its own playbook)
|
|
# ---------------------------------------------------------------------------
|
|
# Postgres, and the alias its attach role adds.
|
|
postgres_container: postgres
|
|
postgres_unit: "{{ postgres_container }}.service"
|
|
db_host: db
|
|
|
|
# The database this play creates if it is missing, and the credentials in
|
|
# postgres/vars/default.yml that the cluster was initialised with.
|
|
pg_user: postgres
|
|
pg_password: '123456'
|
|
pg_database: nextcloud
|
|
|
|
# Valkey, and the alias its attach role adds. REDIS_HOST is not cosmetic:
|
|
# config.php puts `memcache.locking` on Redis, so an unresolvable `redis` breaks
|
|
# uploads rather than merely slowing them down.
|
|
valkey_container: valkey
|
|
valkey_unit: "{{ valkey_container }}.service"
|
|
redis_host: redis
|
|
|
|
caddy_name: caddy
|
|
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# First-run install (optional)
|
|
# ---------------------------------------------------------------------------
|
|
# Empty by default: a fresh webroot is initialised by the image and the setup
|
|
# wizard takes over. Set both to have the image install unattended instead, with
|
|
# trusted_domains set from `host`. Inert once config.php exists.
|
|
nextcloud_admin_user: ""
|
|
nextcloud_admin_password: ""
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Background jobs
|
|
# ---------------------------------------------------------------------------
|
|
cron_unit: "{{ container_name }}-cron"
|
|
cron_schedule: "*:0/5"
|
|
user_unit_dir: "{{ ansible_facts['user_dir'] }}/.config/systemd/user"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Caddy site block
|
|
# ---------------------------------------------------------------------------
|
|
snippet_block: |
|
|
{{ host }} {
|
|
reverse_proxy {{ container_name }}:{{ container_port }}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
|
|
}
|
|
}
|