tanshu
4cd9308ae3
Replaces the docker_container role with a Quadlet systemd user unit, and moves state from /var/lib/tandoor to ~/podman-data/tandoor. Tandoor's entrypoint starts as root and drops privileges, but root is what ends up owning the data, so keep-id maps container root onto the connecting user and everything stays owned by tanshu rather than a subuid. The play does not run the rootless-Podman prerequisites: they are the shared task file at caddy/roles/podman, and a host that has run caddy/playbook.yml has them. Both integrations go through the shared includes rather than local copies -- caddy/roles/register for the network and the Caddy drop-in, postgres/roles/ attach for the database -- so this app writes the same drop-in bytes as every other service and a new service never means editing Caddy or Postgres. Three ordering details are load-bearing: - The register include runs in pre_tasks, before the unit is started. Quadlet fails unit *generation*, not merely startup, when a referenced .network file does not exist yet, so starting first reports "unit not found". - roles/postgres flushes handlers immediately after attaching. The restart that joins Postgres to this network is a handler, so by default it runs at the end of the play -- after the app has already started and failed to resolve `db`. - The role waits for a real HTTP response from inside the container instead of trusting systemctl is-active. The entrypoint runs Django migrations before gunicorn answers, and until it does the image's own nginx returns 502, which Caddy relays verbatim -- complete with `server: nginx`, which reads as a stray reverse proxy that is not actually there. Also drops the dead nginx.conf.j2 and the network role, both superseded by the shared includes, and moves .env into the role's templates/ as tandoor.env.j2, rendered at mode 0600 and read through EnvironmentFile=.
32 lines
1.3 KiB
YAML
32 lines
1.3 KiB
YAML
---
|
|
# Caddy is its own playbook (caddy/playbook.yml) and a rootless Quadlet unit
|
|
# there. These handlers run as the connection user, so `systemctl --user` and
|
|
# `podman exec` work without any XDG_RUNTIME_DIR juggling.
|
|
|
|
# Notified by this role when the Caddyfile changes. A reload keeps existing
|
|
# connections; a restart would briefly drop every hosted site.
|
|
#
|
|
# Note the config path: /etc/caddy/Caddyfile is the mount inside the container,
|
|
# not {{ caddyfile_path }}, which is the host side of it.
|
|
- name: Reload Caddy configuration
|
|
ansible.builtin.command: >-
|
|
podman exec {{ caddy_name }} caddy reload --config /etc/caddy/Caddyfile
|
|
changed_when: true
|
|
listen: "Reload Caddy"
|
|
|
|
# Notified by caddy/roles/register when this service's network unit, or the
|
|
# drop-in that attaches Caddy to it, is written. Quadlet has no live equivalent
|
|
# of `docker network connect`, so the container has to be recreated — a brief
|
|
# restart of every hosted site, not just this one. See caddy/readme.md,
|
|
# "Trade-off worth knowing".
|
|
#
|
|
# Defined after the reload above so that when both are notified the cheap
|
|
# config reload happens first.
|
|
- name: Restart Caddy
|
|
ansible.builtin.systemd_service:
|
|
name: "{{ caddy_name }}.service"
|
|
scope: user
|
|
state: restarted
|
|
daemon_reload: true
|
|
listen: Restart Caddy
|