tanshu
5d63f3f0e0
The timer was justified partly on XDG_RUNTIME_DIR: a user crontab "would need it faked into every line". That is wrong here. The caddy playbook enables lingering, so /run/user/<uid> exists whether or not anyone is logged in, and that is where podman keeps the state `exec` reads. Nothing needs to be set. The one real constraint is that the job cannot go in root's crontab: root cannot `podman exec` into another user's rootless containers. This user's crontab is fine, and the play runs as that user, so `ansible.builtin.cron` with no `user:` writes exactly there. That replaces four tasks and two template files with one task and no files, and it is what the service had before the Quadlet conversion. The cost is that cron sends its output to local mail instead of the journal; the readme says so and names the timer as the alternative. While here, the XDG_RUNTIME_DIR asides come out of the comments that carried them: the play runs over SSH, so `systemctl --user` works because systemd's user manager is reachable over that connection, and that is all a reader needs to know.
98 lines
4.0 KiB
YAML
98 lines
4.0 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Rootless Podman / Quadlet
|
|
# ---------------------------------------------------------------------------
|
|
# Duplicated from caddy/vars/default.yml (which also sets `host_directory` for
|
|
# Caddy, so it cannot be included wholesale). Keep the three in sync. Its fourth,
|
|
# podman_unprivileged_port_start, is not needed here: Nextcloud publishes nothing
|
|
# host-side.
|
|
podman_user: "{{ ansible_facts['user_id'] }}"
|
|
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
|
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Nextcloud
|
|
# ---------------------------------------------------------------------------
|
|
# The site's hostname: what Caddy serves, and the trusted domain for an unattended
|
|
# install.
|
|
host: cloud.hopsngrains.com
|
|
|
|
container_name: nextcloud
|
|
unit_name: "{{ container_name }}.service"
|
|
|
|
# Fully qualified: rootless Podman resolves short names against
|
|
# unqualified-search-registries, and a unit has no TTY to answer the prompt.
|
|
image: docker.io/library/nextcloud:latest
|
|
|
|
# caddy/roles/register pins the Podman network name to <network_name>_net, so the
|
|
# file is nextcloud.network and the network is nextcloud_net.
|
|
network_name: "{{ container_name }}"
|
|
|
|
# The image's VOLUME and Apache document root, and — unlike the other services
|
|
# here — the code as well as the state: config.php, data/, custom_apps/ and every
|
|
# PHP file live under it. See readme.md, "What is state, and what is not".
|
|
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
|
webroot: /var/www/html
|
|
|
|
# www-data. The entrypoint rsyncs the code in as this uid and Apache runs its
|
|
# workers as it, so this is the one uid to map onto the connection user.
|
|
app_uid: 33
|
|
app_gid: 33
|
|
|
|
# Apache's port inside the container, and the one Caddy proxies to.
|
|
container_port: 80
|
|
|
|
env_file: "{{ host_directory }}/nextcloud.env"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Shared services (each its own playbook)
|
|
# ---------------------------------------------------------------------------
|
|
# Postgres, and the alias its attach role adds.
|
|
postgres_container: postgres
|
|
postgres_unit: "{{ postgres_container }}.service"
|
|
db_host: db
|
|
|
|
# The database this play creates if it is missing, and the credentials in
|
|
# postgres/vars/default.yml that the cluster was initialised with.
|
|
pg_user: postgres
|
|
pg_password: '123456'
|
|
pg_database: nextcloud
|
|
|
|
# Valkey, and the alias its attach role adds. REDIS_HOST is not cosmetic:
|
|
# config.php puts `memcache.locking` on Redis, so an unresolvable `redis` breaks
|
|
# uploads rather than merely slowing them down.
|
|
valkey_container: valkey
|
|
valkey_unit: "{{ valkey_container }}.service"
|
|
redis_host: redis
|
|
|
|
caddy_name: caddy
|
|
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# First-run install (optional)
|
|
# ---------------------------------------------------------------------------
|
|
# Empty by default: a fresh webroot is initialised by the image and the setup
|
|
# wizard takes over. Set both to have the image install unattended instead, with
|
|
# trusted_domains set from `host`. Inert once config.php exists.
|
|
nextcloud_admin_user: ""
|
|
nextcloud_admin_password: ""
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Background jobs
|
|
# ---------------------------------------------------------------------------
|
|
# Nextcloud wants cron.php every five minutes. Not a variable worth exposing
|
|
# beyond the interval, since the schedule is the part someone may change.
|
|
cron_minute: "*/5"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Caddy site block
|
|
# ---------------------------------------------------------------------------
|
|
snippet_block: |
|
|
{{ host }} {
|
|
reverse_proxy {{ container_name }}:{{ container_port }}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
|
|
}
|
|
}
|