tanshu
05452127ec
The role had grown machinery that the problem does not require. Removed: - The init-sync lock pre-create. It guarded against one file in the webroot being owned by a subuid, which is cosmetic: the file is 0644, so it is readable and removable by host-side tools either way. - The image ID read/pull pair. No other service playbook pulls an image, and the update path is two commands the readme now spells out. - redis-session.ini.j2 and its three variables. The mount is load-bearing -- the entrypoint cannot write into the image's conf.d and dies trying -- but the template is not: the entrypoint writes that file itself on every start. One touched empty file and one Volume line replace the template and the variables. - The config.php stat, the wizard note, the maintenance-mode wait, the occ status report, the getent checks, the timer report. The installed/not-installed branching existed only because the readiness gates were written for an installed instance; with a gate that fits both, none of the branching is needed. - Comments that narrated this play's earlier runs rather than the system. What is left is four tasks before the start, a start-plus-gate block whose rescue collects the journal, and four tasks for the background-job timer: 149 lines and about 130 of them code, against 313 before. The readme loses its migration-era bulk for the same reason and is 297 lines, in line with the other services'. The one gate is now Nextcloud's own status.php inside the container. It answers only once the entrypoint has finished -- including any `occ upgrade`, which runs before Apache starts, so an update in progress is waited out rather than missed -- it reports `installed` either way, so a fresh webroot and an installed instance go through the same check, and it carries `maintenance` as well, which is the one state a probe would otherwise call healthy while every page returned 503.
54 lines
2.6 KiB
YAML
Executable File
54 lines
2.6 KiB
YAML
Executable File
---
|
|
# Nextcloud as a rootless Podman Quadlet unit, behind the shared Caddy, with its
|
|
# database in the shared Postgres and its cache in the shared Valkey. Each of
|
|
# those is its own playbook and has to have been run first: caddy, postgres,
|
|
# valkey, then this.
|
|
#
|
|
# Idempotent and standalone: the first run creates and starts the container (a
|
|
# fresh webroot then serves the setup wizard), and later runs converge it —
|
|
# Quadlet recreates the container when the unit or its environment changes.
|
|
#
|
|
# Runs as the connection user with no become: the units belong to that user, so
|
|
# the SSH session's own PAM session is what makes `systemctl --user` work.
|
|
# gather_facts is required — podman_user and the home directory come from the
|
|
# user_id / user_dir facts.
|
|
#
|
|
# The rootless-Podman prerequisites (podman, lingering, the low-port sysctl, the
|
|
# Quadlet directory) are not applied here; they are the shared task file at
|
|
# caddy/roles/podman, and a host that has run caddy/playbook.yml has them.
|
|
#
|
|
# Run with: ansible-playbook -u tanshu nextcloud/playbook.yml
|
|
- name: Deploy Nextcloud as a rootless Podman Quadlet
|
|
hosts: emily
|
|
gather_facts: true
|
|
vars_files:
|
|
- vars/default.yml
|
|
|
|
pre_tasks:
|
|
# This must happen before the app unit is started, not after: the generated
|
|
# unit references {{ network_name }}.network, and Quadlet fails *unit
|
|
# generation* (so `systemctl --user start` reports "unit not found") when a
|
|
# referenced .network file does not exist yet. The same include writes the
|
|
# Caddy-side drop-in that attaches Caddy to this network, and both attaches
|
|
# below need the network unit to exist as well.
|
|
#
|
|
# network_name is a play var, so the include can see it directly.
|
|
- name: Register Nextcloud's network with Caddy
|
|
ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/register/tasks/main.yaml"
|
|
|
|
roles:
|
|
# Attaches this app's network to the shared Postgres unit, which is what
|
|
# makes config.php's `db` host resolve, and owns the "Restart Postgres"
|
|
# handler that postgres/roles/attach notifies. Runs first so the database is
|
|
# reachable before the app starts.
|
|
- postgres
|
|
# The same at the cache end: attaches this app's network to the shared Valkey
|
|
# unit, which is what makes config.php's `redis` host resolve, and owns the
|
|
# "Restart Valkey" handler that valkey/roles/attach notifies.
|
|
- valkey
|
|
# The app: the webroot, the 0600 environment file, the Quadlet unit, the
|
|
# background-job timer, start + verify.
|
|
- nextcloud
|
|
# Appends this site's block to the shared Caddyfile and reloads Caddy.
|
|
- caddy
|