tanshu
4297e5a71e
Replaces the docker_container playbook, which published 5432 on 0.0.0.0 and kept its data in /var/lib/postgresql. Postgres is now the base Quadlet unit, the same shape as Caddy: it knows nothing about its clients, and a service attaches itself by dropping a file into postgres.container.d/ via postgres/roles/attach. Nothing here changes when a service is added or removed. Pinned to 18, which is two decisions rather than one tag. Postgres 18 moved both the image's VOLUME (/var/lib/postgresql/data -> /var/lib/postgresql) and its default PGDATA (/var/lib/postgresql/data/pgdata -> /var/lib/postgresql/18/docker), and the 18 entrypoint refuses to start when it finds a cluster in the old layout. So postgres_major is the single knob: it picks the image tag and the PGDATA path together, and the mount is now the parent directory. That also settles the migration: a PGDATA copy cannot cross a major version, so monoco's 17.5 cluster comes across as a pg_dumpall. Three things that bit us and are worth keeping: - PGDATA and its version directory are created by the role, not left to the container. The entrypoint runs as container-root, which under keep-id is a subuid on the host, and it only chowns PGDATA and its contents -- so ~/podman-data/postgres/18 would have been stranded subuid-owned, and the host user could not even rm -rf it without podman unshare. - NetworkAlias= applies to every network the container joins, which is what a database hub wants, but it is one fixed value in a shared drop-in rather than per-service: two services writing their own would make Quadlet pass --network-alias twice. It is not in postgres.container itself because on a fresh host that unit has no Network= at all. - The credentials live in a 0600 file read with EnvironmentFile=, not in Environment= lines: the unit is world-readable in ~/.config. The play no longer uses become, and does not apply the rootless-Podman prerequisites -- those are the shared task file at caddy/roles/podman, and the three variables they need are duplicated at the top of vars/default.yml. migrate-from-monoco.md records the one-time 17.5 -> 18.6 move: the dump, transfer and restore commands, the checks that prove the restore is complete (per-database table counts against the source), and the verified result. The dead nginx/php-fpm templates in postgres/files/ are removed.
32 lines
1.0 KiB
YAML
32 lines
1.0 KiB
YAML
---
|
|
# All handlers run as the connection user ({{ podman_user }}), so systemctl
|
|
# --user works without setting XDG_RUNTIME_DIR.
|
|
|
|
- name: Reload systemd user units
|
|
ansible.builtin.command: systemctl --user daemon-reload
|
|
changed_when: true
|
|
listen: Reload systemd user units
|
|
|
|
- name: Restart Postgres
|
|
ansible.builtin.systemd_service:
|
|
name: "{{ postgres_unit }}"
|
|
scope: user
|
|
state: restarted
|
|
daemon_reload: true
|
|
listen: Restart Postgres
|
|
|
|
# Reference implementation for service playbooks. A service that attaches its
|
|
# network with postgres/roles/attach must notify "Restart Postgres", and defines
|
|
# its own copy of this handler, e.g.:
|
|
#
|
|
# - name: Restart Postgres
|
|
# ansible.builtin.systemd_service:
|
|
# name: postgres.service
|
|
# scope: user
|
|
# state: restarted
|
|
# daemon_reload: true
|
|
# listen: Restart Postgres
|
|
#
|
|
# A new drop-in changes the generated unit, so Postgres has to be recreated to
|
|
# join the network — Quadlet has no live equivalent of `podman network connect`.
|