114 lines
5.5 KiB
YAML
114 lines
5.5 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Rootless Podman / Quadlet
|
|
# ---------------------------------------------------------------------------
|
|
# Duplicated on purpose from caddy/vars/default.yml: a play cannot include that
|
|
# file wholesale, because it also sets `host_directory` — to the Caddy data
|
|
# directory — and every playbook defines that for itself. Keep these three in
|
|
# sync with caddy/vars/default.yml. (Its fourth, podman_unprivileged_port_start,
|
|
# belongs to the podman tasks, which this play does not run: Yamtrack listens on
|
|
# 8000 inside the container and publishes nothing host-side.)
|
|
#
|
|
# podman_user is derived from the connection: this play carries no become, so
|
|
# the Quadlet units belong to whoever Ansible connects as. Requires gather_facts
|
|
# (set in playbook.yml).
|
|
podman_user: "{{ ansible_facts['user_id'] }}"
|
|
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
|
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Yamtrack
|
|
# ---------------------------------------------------------------------------
|
|
host: track.tanshu.com
|
|
|
|
container_name: yamtrack
|
|
unit_name: "{{ container_name }}.service"
|
|
|
|
# Fully qualified on purpose: rootless Podman resolves short names against
|
|
# unqualified-search-registries, and there is no TTY to answer a prompt when
|
|
# the systemd unit starts. ghcr.io was already qualified; the tag is explicit
|
|
# for the same reason. Nothing is pinned — see readme.md, "Notes and gotchas".
|
|
image: ghcr.io/fuzzygrim/yamtrack:latest
|
|
|
|
# The Quadlet file is <network_name>.network. caddy/roles/register pins the
|
|
# Podman network name to <network_name>_net (so: yamtrack.network, yamtrack_net,
|
|
# which is the name the Docker-era deployment used).
|
|
network_name: "{{ container_name }}"
|
|
|
|
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
|
|
|
# The image's bind mount: /yamtrack/db holds db.sqlite3 and its WAL sidecars.
|
|
# Nothing else on /yamtrack is state — staticfiles/ is baked into the image and
|
|
# the code is read-only — so this is the only directory worth keeping.
|
|
data_dir: "{{ host_directory }}/data"
|
|
|
|
# The port inside the container that Caddy proxies to: the image's own nginx
|
|
# listens there and forwards to gunicorn. Reproduces the Docker-era Caddyfile
|
|
# entry (`reverse_proxy yamtrack:8000`) exactly.
|
|
container_port: 8000
|
|
|
|
# SECRET, TZ and REDIS_URL live here rather than as Environment= lines in the
|
|
# unit file: that file is world-readable in ~/.config. Read by systemd through
|
|
# EnvironmentFile=, not by Ansible, so it has to be written before the unit
|
|
# starts.
|
|
env_file: "{{ host_directory }}/{{ container_name }}.env"
|
|
|
|
# The uid this unit maps onto podman_user, and the PUID/PGID the image's
|
|
# entrypoint is given. It is 0 — container root — and that is deliberate:
|
|
#
|
|
# 1. `--userns=keep-id` does two things: it maps one container uid onto the
|
|
# connecting user, and it runs the container *as that uid*. The entrypoint's
|
|
# first act is `groupmod`/`usermod`, which rewrite /etc/group and
|
|
# /etc/passwd — files owned by container-root in the image. With
|
|
# `keep-id:uid=1000` those run as `abc` and die on "cannot lock /etc/group"
|
|
# (the unit exits 10) before supervisord is ever reached. Root is required.
|
|
# 2. Mapping container root onto podman_user is what keeps
|
|
# ~/podman-data/yamtrack owned by podman_user rather than by a subuid. It is
|
|
# the same choice caddy, bitwarden and tandoor make.
|
|
#
|
|
# It is also rendered as PUID/PGID in the environment file: the entrypoint's own
|
|
# default is 1000, which under this mapping is a subuid on the host, so its
|
|
# `chown -R abc:abc db` would strand the database on an unmapped uid. See
|
|
# readme.md, "Who runs as whom".
|
|
app_uid: 0
|
|
app_gid: 0
|
|
|
|
yamtrack_tz: "Asia/Kolkata"
|
|
|
|
# The Django SECRET_KEY, as the image calls it (`SECRET`). Carried over verbatim
|
|
# from the Docker-era playbook so existing sessions and password-reset tokens
|
|
# stay valid — rotating it logs every user out. Committed in plaintext as
|
|
# before; flagged as a follow-up, not changed here.
|
|
yamtrack_secret: "c14c5970eb728fbf8b2325fd3004069d"
|
|
|
|
# What the old container passed as URLS, which Yamtrack turns into its CSRF
|
|
# trusted origins. ALLOWED_HOSTS is deliberately not set: its default is `*`,
|
|
# which is what the Docker-era container relied on.
|
|
urls: "https://{{ host }}"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Valkey (the shared cache / Celery broker)
|
|
# ---------------------------------------------------------------------------
|
|
# Yamtrack hard-requires Redis: its cache backend is django_redis with no
|
|
# fallback, the Celery worker and beat need a broker, and several metadata
|
|
# providers talk to Redis directly. It is a *separate* playbook, deployed before
|
|
# this one: yamtrack/roles/valkey only attaches its network to that shared unit.
|
|
#
|
|
# The Docker-era container was given `redis://valkey:6379`, and valkey is what
|
|
# the container is called, so the URL is unchanged.
|
|
valkey_container: valkey
|
|
valkey_unit: "{{ valkey_container }}.service"
|
|
redis_url: "redis://{{ valkey_container }}:6379"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Caddy
|
|
# ---------------------------------------------------------------------------
|
|
# The shared Caddy unit and its Caddyfile, both owned by caddy/playbook.yml.
|
|
caddy_name: caddy
|
|
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
|
|
|
snippet_block: |
|
|
{{ host }} {
|
|
reverse_proxy {{ container_name }}:{{ container_port }}
|
|
}
|