107 lines
5.0 KiB
YAML
107 lines
5.0 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Rootless Podman / Quadlet
|
|
# ---------------------------------------------------------------------------
|
|
# Duplicated on purpose from caddy/vars/default.yml: a play cannot include that
|
|
# file wholesale, because it also sets `host_directory` — to the Caddy data
|
|
# directory — and every playbook defines that for itself. Keep these three in
|
|
# sync with caddy/vars/default.yml. (Its fourth, podman_unprivileged_port_start,
|
|
# belongs to the podman tasks, which this play does not run: Wiki.js publishes
|
|
# nothing host-side.)
|
|
#
|
|
# podman_user is derived from the connection: this play carries no become, so
|
|
# the Quadlet units belong to whoever Ansible connects as. Requires gather_facts
|
|
# (set in playbook.yml).
|
|
podman_user: "{{ ansible_facts['user_id'] }}"
|
|
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
|
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Wiki.js
|
|
# ---------------------------------------------------------------------------
|
|
# The service keeps the Docker-era name everywhere — container, unit, Podman
|
|
# network and Postgres database are all `hiwikijs`, and the Caddyfile upstream is
|
|
# `hiwikijs:3000`. Only the directory is `wikijs`, because that is the playbook's
|
|
# name. Renaming the container would touch the Caddyfile, the network name and
|
|
# the database for no gain.
|
|
host: wiki.hinchco.in
|
|
|
|
container_name: hiwikijs
|
|
unit_name: "{{ container_name }}.service"
|
|
|
|
# Fully qualified on purpose: registry + org + repo, so rootless Podman never
|
|
# consults unqualified-search-registries. There is no TTY to answer a short-name
|
|
# prompt when the systemd unit starts.
|
|
image: ghcr.io/requarks/wiki:latest
|
|
|
|
# The Quadlet file is <network_name>.network. caddy/roles/register pins the
|
|
# Podman network name to <network_name>_net (so: hiwikijs.network,
|
|
# hiwikijs_net — the name the Docker-era container used).
|
|
network_name: "{{ container_name }}"
|
|
|
|
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
|
|
|
# The uid the app actually runs as: the image's `USER node`, and `node` is uid
|
|
# 1000 there (verified: `docker exec hiwikijs id` → uid=1000(node) gid=1000).
|
|
# keep-id maps that uid onto podman_user, so anything written into the mounts
|
|
# below stays owned by podman_user on the host and never by a subuid.
|
|
#
|
|
# Note this is *not* root: unlike bitwarden and tandoor (uid 0), Wiki.js runs
|
|
# unprivileged, so the mapping goes through 1000. `tanshu` is uid 1001 — "the
|
|
# data is already mine" is false, which is the trap in
|
|
# docs/podman-migration.md §4.1.
|
|
wikijs_uid: 1000
|
|
wikijs_gid: 1000
|
|
|
|
# The image declares VOLUME /wiki/data/content. On Docker that silently became an
|
|
# *anonymous* volume under /var/lib/docker/volumes, which is why nothing under
|
|
# /var/lib ever held the wiki and why the old backup script archived an empty
|
|
# directory (docs/podman-compat-audit.md §3.1). Binding it to a real path is the
|
|
# fix. It is empty on monoco today — see readme.md.
|
|
content_dir: "{{ host_directory }}/content"
|
|
|
|
# Not a declared volume, but it is where Wiki.js's default "Local File System"
|
|
# storage target writes uploads. Empty on monoco today — the wiki's 49 uploaded
|
|
# assets are rows in Postgres (`assetData`, 5.8 MB of the 16 MB database) — so
|
|
# this is insurance: if the storage target is ever switched to local files, the
|
|
# bytes land in a directory that gets backed up instead of in the container's
|
|
# writable layer, where nothing would ever find them.
|
|
uploads_dir: "{{ host_directory }}/uploads"
|
|
|
|
# DB_PASS carries the Postgres password and the Quadlet unit is world-readable in
|
|
# ~/.config, so it goes in this 0600 file instead and is read by systemd through
|
|
# EnvironmentFile=.
|
|
env_file: "{{ host_directory }}/{{ container_name }}.env"
|
|
|
|
# From the image's own config.yml (`port: 3000`, `bindIP: 0.0.0.0`). Caddy
|
|
# proxies to it over the app network; nothing is published host-side.
|
|
container_port: 3000
|
|
|
|
# The shared Postgres unit this app attaches itself to (postgres/playbook.yml).
|
|
# roles/postgres owns this app's drop-ins there and the "Restart Postgres"
|
|
# handler that applies them.
|
|
postgres_container: postgres
|
|
postgres_unit: "{{ postgres_container }}.service"
|
|
|
|
# The credentials the Docker-era playbook embedded in its .env file, kept as-is
|
|
# so the already-restored `hiwikijs` database and the app's own connection string
|
|
# agree. Postgres is authoritative for this service; nothing here is new.
|
|
pg_user: postgres
|
|
pg_password: '123456'
|
|
pg_database: hiwikijs
|
|
|
|
# `db`, not `postgres`: that is literally what the Docker-era container ran with
|
|
# (it was `--link postgres:db`), and postgres/roles/attach writes the shared
|
|
# NetworkAlias=db drop-in that makes it resolve on hiwikijs_net. The container
|
|
# name resolves too, and the play checks both.
|
|
db_host: db
|
|
|
|
# The shared Caddy unit and its Caddyfile, both owned by caddy/playbook.yml.
|
|
caddy_name: caddy
|
|
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
|
|
|
snippet_block: |
|
|
{{ host }} {
|
|
reverse_proxy {{ container_name }}:{{ container_port }}
|
|
}
|