tanshu
4cd9308ae3
Replaces the docker_container role with a Quadlet systemd user unit, and moves state from /var/lib/tandoor to ~/podman-data/tandoor. Tandoor's entrypoint starts as root and drops privileges, but root is what ends up owning the data, so keep-id maps container root onto the connecting user and everything stays owned by tanshu rather than a subuid. The play does not run the rootless-Podman prerequisites: they are the shared task file at caddy/roles/podman, and a host that has run caddy/playbook.yml has them. Both integrations go through the shared includes rather than local copies -- caddy/roles/register for the network and the Caddy drop-in, postgres/roles/ attach for the database -- so this app writes the same drop-in bytes as every other service and a new service never means editing Caddy or Postgres. Three ordering details are load-bearing: - The register include runs in pre_tasks, before the unit is started. Quadlet fails unit *generation*, not merely startup, when a referenced .network file does not exist yet, so starting first reports "unit not found". - roles/postgres flushes handlers immediately after attaching. The restart that joins Postgres to this network is a handler, so by default it runs at the end of the play -- after the app has already started and failed to resolve `db`. - The role waits for a real HTTP response from inside the container instead of trusting systemctl is-active. The entrypoint runs Django migrations before gunicorn answers, and until it does the image's own nginx returns 502, which Caddy relays verbatim -- complete with `server: nginx`, which reads as a stray reverse proxy that is not actually there. Also drops the dead nginx.conf.j2 and the network role, both superseded by the shared includes, and moves .env into the role's templates/ as tandoor.env.j2, rendered at mode 0600 and read through EnvironmentFile=.
Ansible Playbooks
A collection of minimalist Ansible playbooks for automating server setups, based on DigitalOcean's Community guides.
- Initial Server Setup for Ubuntu 18.04 *
- Apache on Ubuntu 18.04
- Postgres on Ubuntu 19.10
- Redis on Ubuntu 19.10
- Bitwarden Ubuntu 19.10
- Gitea on Ubuntu 19.10
*the Initial Server Setup should be your starting point for fresh servers.
Playbook Structure
The playbooks contained in this repository were created for educational purposes, and should serve as a base for you to create your own playbooks and roles.
Although we opt to not use roles, our playbooks follow a distinctive structure to facilitate reuse while keeping them mostly self-contained and straightforward.
For instance, this is how the lemp playbook is structured:
lemp_ubuntu1804
├── files
│ ├── info.php.j2
│ └── nginx.conf.j2
├── vars
│ └── default.yml
├── playbook.yml
└── readme.md
files/: directory containing templates and other files required by the playbook.vars/: directory to save variable files. Adefault.ymlvar file is included by default.playbook.yml: the playbook file.readme.md: instructions and links related to this playbook.
Getting Started
To set up your Ansible environment, please follow our guide on How to Install and Configure Ansible on Ubuntu 18.04.
Connection Test
From your local machine or Ansible control node, run:
ansible all -m ping -u remote_user
If you're able to get a "pong" reply back from your node(s), your setup works as expected and you'll be able to run both ad-hoc commands and playbooks on your nodes, using Ansible.
Guides
The following guides cover how to use the playbooks you'll find in this repository.
Initial Server Setup
Once you have executed the initial server setup, you can choose from any of the available server setup playbooks:
Web Servers
- Apache on Ubuntu 18.04
- LEMP (Linux, Nginx, MySQL, PHP) on Ubuntu 18.04
- LAMP (Linux, Apache, MySQL, PHP) on Ubuntu 18.04