tanshu
060173db5e
Replaces the docker_container role with Quadlet systemd user units under ~/.config/containers/systemd, and moves state from /var/lib/caddy to ~/podman-data/caddy. Caddy is now the base unit and no longer lists its upstream networks. Each service registers itself by writing its own <name>.network unit plus a drop-in into caddy.container.d/, so adding or removing a service never means editing the Caddy playbook. Drop-ins are used rather than blockinfile because this playbook re-templates caddy.container on every run, which would wipe appended blocks. The play runs as the connecting user instead of using become: the rootless units belong to it, so the connection's PAM session is what makes systemctl --user work without setting XDG_RUNTIME_DIR. podman_user and the data directory are derived from facts, so the play fails loudly if that resolves to root. Two things that bit us and are worth keeping: - The privileged-port sysctl is applied inline with sysctl -w, not via a handler. Handlers only run at the end of the play, by which point Caddy has already failed to bind 80/443. - The Caddyfile is seeded with a minimal valid config. Caddy exits 1 with a bare "EOF" on an empty config file, so touching it into existence made the service crash-loop.
33 lines
1.1 KiB
YAML
33 lines
1.1 KiB
YAML
---
|
|
# All handlers run as the connection user ({{ podman_user }}), so systemctl
|
|
# --user works without setting XDG_RUNTIME_DIR.
|
|
|
|
- name: Reload systemd user units
|
|
ansible.builtin.command: systemctl --user daemon-reload
|
|
changed_when: true
|
|
listen: Reload systemd user units
|
|
|
|
- name: Restart Caddy
|
|
ansible.builtin.systemd_service:
|
|
name: "{{ caddy_unit }}"
|
|
scope: user
|
|
state: restarted
|
|
daemon_reload: true
|
|
listen: Restart Caddy
|
|
|
|
# Reference implementation for service playbooks. A service that appends a site
|
|
# block to {{ caddyfile_path }} should notify this instead of restarting the
|
|
# container, and defines its own copy of the handler in its caddy role, e.g.:
|
|
#
|
|
# - name: Reload Caddy configuration
|
|
# ansible.builtin.command: podman exec {{ caddy_name }} caddy reload --config /etc/caddy/Caddyfile
|
|
# listen: "Reload Caddy"
|
|
#
|
|
# Note the container path is /etc/caddy/Caddyfile (the mount), not caddyfile_path.
|
|
- name: Reload Caddy configuration
|
|
ansible.builtin.command: >-
|
|
podman exec {{ caddy_name }}
|
|
caddy reload --config /etc/caddy/Caddyfile
|
|
changed_when: true
|
|
listen: Reload Caddy
|