tanshu
4cd9308ae3
Replaces the docker_container role with a Quadlet systemd user unit, and moves state from /var/lib/tandoor to ~/podman-data/tandoor. Tandoor's entrypoint starts as root and drops privileges, but root is what ends up owning the data, so keep-id maps container root onto the connecting user and everything stays owned by tanshu rather than a subuid. The play does not run the rootless-Podman prerequisites: they are the shared task file at caddy/roles/podman, and a host that has run caddy/playbook.yml has them. Both integrations go through the shared includes rather than local copies -- caddy/roles/register for the network and the Caddy drop-in, postgres/roles/ attach for the database -- so this app writes the same drop-in bytes as every other service and a new service never means editing Caddy or Postgres. Three ordering details are load-bearing: - The register include runs in pre_tasks, before the unit is started. Quadlet fails unit *generation*, not merely startup, when a referenced .network file does not exist yet, so starting first reports "unit not found". - roles/postgres flushes handlers immediately after attaching. The restart that joins Postgres to this network is a handler, so by default it runs at the end of the play -- after the app has already started and failed to resolve `db`. - The role waits for a real HTTP response from inside the container instead of trusting systemctl is-active. The entrypoint runs Django migrations before gunicorn answers, and until it does the image's own nginx returns 502, which Caddy relays verbatim -- complete with `server: nginx`, which reads as a stray reverse proxy that is not actually there. Also drops the dead nginx.conf.j2 and the network role, both superseded by the shared includes, and moves .env into the role's templates/ as tandoor.env.j2, rendered at mode 0600 and read through EnvironmentFile=.
54 lines
2.4 KiB
YAML
Executable File
54 lines
2.4 KiB
YAML
Executable File
---
|
|
# Tandoor Recipes as a rootless Podman Quadlet unit, behind the shared Caddy
|
|
# unit (see caddy/playbook.yml) and the shared Postgres unit
|
|
# (postgres/playbook.yml).
|
|
#
|
|
# Connects as the container user and runs everything as that user: the Quadlet
|
|
# units belong to it, so the connection's PAM session is what makes
|
|
# `systemctl --user` work without any environment juggling.
|
|
#
|
|
# gather_facts is required: podman_user and the home directory come from the
|
|
# user_id / user_dir facts.
|
|
#
|
|
# The rootless-Podman prerequisites (installing podman, enabling lingering, the
|
|
# low-port sysctl, creating the Quadlet directory) are deliberately NOT applied
|
|
# here. They are the shared task file at caddy/roles/podman/tasks/main.yaml, and
|
|
# a host that has already run caddy/playbook.yml has them:
|
|
#
|
|
# - name: Rootless Podman prerequisites
|
|
# ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/podman/tasks/main.yaml"
|
|
#
|
|
# The variables this play needs are duplicated at the top of vars/default.yml, so
|
|
# it stands on its own. (Applying the commented include above would also need
|
|
# podman_unprivileged_port_start, which lives in caddy/vars/default.yml.)
|
|
#
|
|
# Run with: ansible-playbook -u tanshu tandoor/playbook.yml
|
|
- name: Deploy Tandoor as a rootless Podman Quadlet
|
|
hosts: emily
|
|
gather_facts: true
|
|
vars_files:
|
|
- vars/default.yml
|
|
|
|
pre_tasks:
|
|
# This must happen before the app unit is started, not after: the generated
|
|
# unit references {{ network_name }}.network, and Quadlet fails *unit
|
|
# generation* (so `systemctl --user start` reports "unit not found") when a
|
|
# referenced .network file does not exist yet. The same include writes the
|
|
# Caddy-side drop-in that attaches Caddy to this network, and the Postgres
|
|
# attach below needs the network unit to exist as well.
|
|
#
|
|
# network_name is a play var, so the include can see it directly.
|
|
- name: Register Tandoor's network with Caddy
|
|
ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/register/tasks/main.yaml"
|
|
|
|
roles:
|
|
# Attaches this app's network to the shared Postgres unit, which is what
|
|
# makes POSTGRES_HOST=db resolve, and owns the "Restart Postgres" handler
|
|
# that postgres/roles/attach notifies. Runs first so the database is
|
|
# reachable before the app starts.
|
|
- postgres
|
|
# The app: data directories, .env, the Quadlet unit, start + verify.
|
|
- tandoor
|
|
# Appends this site's block to the shared Caddyfile and reloads Caddy.
|
|
- caddy
|