tanshu
060173db5e
Replaces the docker_container role with Quadlet systemd user units under ~/.config/containers/systemd, and moves state from /var/lib/caddy to ~/podman-data/caddy. Caddy is now the base unit and no longer lists its upstream networks. Each service registers itself by writing its own <name>.network unit plus a drop-in into caddy.container.d/, so adding or removing a service never means editing the Caddy playbook. Drop-ins are used rather than blockinfile because this playbook re-templates caddy.container on every run, which would wipe appended blocks. The play runs as the connecting user instead of using become: the rootless units belong to it, so the connection's PAM session is what makes systemctl --user work without setting XDG_RUNTIME_DIR. podman_user and the data directory are derived from facts, so the play fails loudly if that resolves to root. Two things that bit us and are worth keeping: - The privileged-port sysctl is applied inline with sysctl -w, not via a handler. Handlers only run at the end of the play, by which point Caddy has already failed to bind 80/443. - The Caddyfile is seeded with a minimal valid config. Caddy exits 1 with a bare "EOF" on an empty config file, so touching it into existence made the service crash-loop.
67 lines
2.3 KiB
YAML
67 lines
2.3 KiB
YAML
---
|
|
# Register a service's logical network with Caddy.
|
|
#
|
|
# Caddy is the *base* unit and knows nothing about its upstreams. Each service
|
|
# adds itself by writing two files into the Quadlet directory:
|
|
#
|
|
# 1. its own <name>.network unit, and
|
|
# 2. a drop-in next to caddy.container that pulls that network into Caddy.
|
|
#
|
|
# Caddy's own playbook never changes when a service is added or removed.
|
|
#
|
|
# Include this from a service playbook:
|
|
#
|
|
# - name: Register this service with Caddy
|
|
# ansible.builtin.include_tasks: "{{ playbook_dir }}/../caddy/roles/register/tasks/main.yaml"
|
|
# vars:
|
|
# network_name: "{{ container_name }}"
|
|
#
|
|
# The including play must also run the `podman` role (for podman_user and
|
|
# quadlet_dir) and define a "Restart Caddy" handler:
|
|
#
|
|
# - name: Restart Caddy
|
|
# ansible.builtin.systemd_service:
|
|
# name: caddy.service
|
|
# scope: user
|
|
# state: restarted
|
|
# daemon_reload: true
|
|
# listen: Restart Caddy
|
|
#
|
|
# It runs as the connection user, which must be {{ podman_user }}.
|
|
|
|
- name: "Create the {{ network_name }} network unit"
|
|
ansible.builtin.copy:
|
|
dest: "{{ quadlet_dir }}/{{ network_name }}.network"
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: '0644'
|
|
content: |
|
|
# {{ network_name }} — logical app network.
|
|
# Managed by Ansible. Do not edit by hand.
|
|
#
|
|
# NetworkName pins the Podman network name. Without it Quadlet would
|
|
# create "systemd-{{ network_name }}".
|
|
#
|
|
# isolate blocks traffic between separate Podman networks, so a container
|
|
# on this network cannot reach one that is only on another. Caddy and any
|
|
# shared service still reach it, because they are members of it.
|
|
[Network]
|
|
NetworkName={{ network_name }}_net
|
|
Options=isolate=true
|
|
notify: Restart Caddy
|
|
|
|
- name: "Register {{ network_name }} with Caddy"
|
|
ansible.builtin.copy:
|
|
dest: "{{ quadlet_dir }}/{{ caddy_name | default('caddy') }}.container.d/50-{{ network_name }}.conf"
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: '0644'
|
|
content: |
|
|
# Added by the {{ network_name }} playbook. Do not edit by hand.
|
|
#
|
|
# Quadlet merges this into caddy.container. Deleting this file removes
|
|
# the network from Caddy on the next daemon-reload.
|
|
[Container]
|
|
Network={{ network_name }}.network
|
|
notify: Restart Caddy
|