tanshu
be53cec757
The playbook is meant to be usable on its own, on any host, the way every other one here is: the first run creates the container, and every run after that converges it. It had picked up a migration shape instead -- a readme that assumed a webroot copied in from monoco, a warning that nagged when config.php was missing, and, worse, readiness gates that only passed for an instance that was already installed. That last one was a real bug for the intended use. On a host with no webroot, the image initialises the code, writes no config.php because it has no admin credentials to install with, and serves the setup wizard -- so `occ status` never reports installed: true, and the play would have spent its whole retry budget and then failed on a first run that was going exactly as designed. What replaces it: - The readiness gate is Apache answering status.php inside the container, which is Nextcloud's own endpoint and reports `installed` either way. It is the one thing `is-active` cannot tell us, and it passes for a wizard that has not been completed. - config.php's presence then decides the report: wait for maintenance mode to clear and print `occ status` for an instance, or say what is left for a human to do for a fresh one -- and succeed. The two optional credentials in vars/default.yml install unattended instead, in which case the same endpoints come back installed and the wizard note never appears. - The app creates its own database. Postgres is a shared unit with one default database and nothing else in this repo knows this app's database name, so a fresh cluster previously reached the installer and failed on "database nextcloud does not exist". It is a lookup and a `createdb`, a no-op afterwards, and it fails with the instruction to run postgres/playbook.yml if the cluster is not there rather than with a bare psql error. - Updates. An update in a Quadlet deployment is "pull, then recreate": the unit names a tag, `podman run` reuses the local image, and nothing fetches a newer one. The role pulls on every run and compares the image ID either side, so an unchanged tag is not a change and a running site is not restarted for nothing. - Handlers are flushed before verification, so a queued recreate -- new image, changed unit, changed environment -- happens before the checks rather than after them, and the checks describe what will keep running. Removed: the entire monoco migration section and its copy commands, the config.php warning that existed only to serve it, the host-specific notes, and the narrative comments about this play's first runs. References to the audit and migration planning docs go with them; the ownership reasoning is stated inline, since it does not depend on where an instance came from. `hosts:` is now the only host-specific thing in the directory. The readme is rewritten around the two paths it now has -- "First run" and "Updates" -- with the deploy order, the session-file trap and the debugging commands kept.
68 lines
3.1 KiB
YAML
Executable File
68 lines
3.1 KiB
YAML
Executable File
---
|
|
# Nextcloud as a rootless Podman Quadlet unit, behind the shared Caddy unit
|
|
# (caddy/playbook.yml), with its database in the shared Postgres unit
|
|
# (postgres/playbook.yml) and its cache in the shared Valkey unit
|
|
# (valkey/playbook.yml).
|
|
#
|
|
# Standalone and idempotent: the first run on a host creates the container and
|
|
# leaves a fresh instance ready for its setup wizard, and every run after that
|
|
# converges the unit, the environment and the image — Quadlet recreates the
|
|
# container when any of them change. Nothing here depends on where the instance
|
|
# came from; only `hosts` is host-specific.
|
|
#
|
|
# Connects as the container user and runs everything as that user: the Quadlet
|
|
# units belong to it, so the connection's PAM session is what makes
|
|
# `systemctl --user` work without any environment juggling.
|
|
#
|
|
# gather_facts is required: podman_user and the home directory come from the
|
|
# user_id / user_dir facts.
|
|
#
|
|
# The rootless-Podman prerequisites (installing podman, enabling lingering, the
|
|
# low-port sysctl, creating the Quadlet directory) are deliberately NOT applied
|
|
# here. They are the shared task file at caddy/roles/podman/tasks/main.yaml, and
|
|
# a host that has already run caddy/playbook.yml has them:
|
|
#
|
|
# - name: Rootless Podman prerequisites
|
|
# ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/podman/tasks/main.yaml"
|
|
#
|
|
# The three shared services it attaches to have to exist first, in this order:
|
|
# caddy, postgres, valkey.
|
|
#
|
|
# The variables this play needs are duplicated at the top of vars/default.yml, so
|
|
# it stands on its own.
|
|
#
|
|
# Run with: ansible-playbook -u tanshu nextcloud/playbook.yml
|
|
- name: Deploy Nextcloud as a rootless Podman Quadlet
|
|
hosts: emily
|
|
gather_facts: true
|
|
vars_files:
|
|
- vars/default.yml
|
|
|
|
pre_tasks:
|
|
# This must happen before the app unit is started, not after: the generated
|
|
# unit references {{ network_name }}.network, and Quadlet fails *unit
|
|
# generation* (so `systemctl --user start` reports "unit not found") when a
|
|
# referenced .network file does not exist yet. The same include writes the
|
|
# Caddy-side drop-in that attaches Caddy to this network, and both attaches
|
|
# below need the network unit to exist as well.
|
|
#
|
|
# network_name is a play var, so the include can see it directly.
|
|
- name: Register Nextcloud's network with Caddy
|
|
ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/register/tasks/main.yaml"
|
|
|
|
roles:
|
|
# Attaches this app's network to the shared Postgres unit, which is what
|
|
# makes config.php's `db` host resolve, and owns the "Restart Postgres"
|
|
# handler that postgres/roles/attach notifies. Runs first so the database is
|
|
# reachable before the app starts.
|
|
- postgres
|
|
# The same at the cache end: attaches this app's network to the shared Valkey
|
|
# unit, which is what makes config.php's `redis` host resolve, and owns the
|
|
# "Restart Valkey" handler that valkey/roles/attach notifies.
|
|
- valkey
|
|
# The app: the webroot, the 0600 environment file, the Quadlet unit, the
|
|
# background-job timer, start + verify.
|
|
- nextcloud
|
|
# Appends this site's block to the shared Caddyfile and reloads Caddy.
|
|
- caddy
|