tanshu
c3e0e4989c
The role created ~/podman-data/nextcloud/redis-session.ini and the unit bind-mounted it over the image path, purely because the entrypoint cannot write there itself. Removed: the task, the mount, and -- because it is the only thing that triggers the write -- REDIS_HOST from the environment file. The entrypoint now skips configure_redis_session entirely and starts. The Redis attach stays. The valkey role still puts nextcloud_net on the cache container with the alias `redis`, so an instance whose config.php names that host reaches it. Writing that configuration is config.php's business, and the readme gives the three `occ config:system:set` lines for anyone who wants it, including that this playbook will not do it for them. The only thing lost is PHP session storage, which falls back to the container's own filesystem -- a redeploy logs users out. That is the trade for not shipping a file whose sole purpose is to work around a directory the image owns as root. The env template and the valkey role comment both say why REDIS_HOST is absent, so that adding it back is recognisable as the regression it is.
97 lines
4.0 KiB
YAML
97 lines
4.0 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Rootless Podman / Quadlet
|
|
# ---------------------------------------------------------------------------
|
|
# Duplicated from caddy/vars/default.yml (which also sets `host_directory` for
|
|
# Caddy, so it cannot be included wholesale). Keep the three in sync. Its fourth,
|
|
# podman_unprivileged_port_start, is not needed here: Nextcloud publishes nothing
|
|
# host-side.
|
|
podman_user: "{{ ansible_facts['user_id'] }}"
|
|
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
|
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Nextcloud
|
|
# ---------------------------------------------------------------------------
|
|
# The site's hostname: what Caddy serves, and the trusted domain for an unattended
|
|
# install.
|
|
host: cloud.hopsngrains.com
|
|
|
|
container_name: nextcloud
|
|
unit_name: "{{ container_name }}.service"
|
|
|
|
# Fully qualified: rootless Podman resolves short names against
|
|
# unqualified-search-registries, and a unit has no TTY to answer the prompt.
|
|
image: docker.io/library/nextcloud:latest
|
|
|
|
# caddy/roles/register pins the Podman network name to <network_name>_net, so the
|
|
# file is nextcloud.network and the network is nextcloud_net.
|
|
network_name: "{{ container_name }}"
|
|
|
|
# The image's VOLUME and Apache document root, and — unlike the other services
|
|
# here — the code as well as the state: config.php, data/, custom_apps/ and every
|
|
# PHP file live under it. See readme.md, "What is state, and what is not".
|
|
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
|
webroot: /var/www/html
|
|
|
|
# www-data. The entrypoint rsyncs the code in as this uid and Apache runs its
|
|
# workers as it, so this is the one uid to map onto the connection user.
|
|
app_uid: 33
|
|
app_gid: 33
|
|
|
|
# Apache's port inside the container, and the one Caddy proxies to.
|
|
container_port: 80
|
|
|
|
env_file: "{{ host_directory }}/nextcloud.env"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Shared services (each its own playbook)
|
|
# ---------------------------------------------------------------------------
|
|
# Postgres, and the alias its attach role adds.
|
|
postgres_container: postgres
|
|
postgres_unit: "{{ postgres_container }}.service"
|
|
db_host: db
|
|
|
|
# The database this play creates if it is missing, and the credentials in
|
|
# postgres/vars/default.yml that the cluster was initialised with.
|
|
pg_user: postgres
|
|
pg_password: '123456'
|
|
pg_database: nextcloud
|
|
|
|
# Valkey, which the attach role puts this app's network on with the alias
|
|
# `redis`. Whether Nextcloud uses it is config.php's decision: the cache and
|
|
# `memcache.locking` live there, not in this playbook. See readme.md.
|
|
valkey_container: valkey
|
|
valkey_unit: "{{ valkey_container }}.service"
|
|
|
|
caddy_name: caddy
|
|
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# First-run install (optional)
|
|
# ---------------------------------------------------------------------------
|
|
# Empty by default: a fresh webroot is initialised by the image and the setup
|
|
# wizard takes over. Set both to have the image install unattended instead, with
|
|
# trusted_domains set from `host`. Inert once config.php exists.
|
|
nextcloud_admin_user: ""
|
|
nextcloud_admin_password: ""
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Background jobs
|
|
# ---------------------------------------------------------------------------
|
|
# Nextcloud wants cron.php every five minutes. Not a variable worth exposing
|
|
# beyond the interval, since the schedule is the part someone may change.
|
|
cron_minute: "*/5"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Caddy site block
|
|
# ---------------------------------------------------------------------------
|
|
snippet_block: |
|
|
{{ host }} {
|
|
reverse_proxy {{ container_name }}:{{ container_port }}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
|
|
}
|
|
}
|