76 lines
2.7 KiB
YAML
76 lines
2.7 KiB
YAML
---
|
|
# ------------------------------------------------------------
|
|
# Stoat deployment - rootless podman-compose, managed by systemd
|
|
# ------------------------------------------------------------
|
|
# These tasks run as root (play-level become), NOT as the stoat
|
|
# user: becoming an unprivileged user trips an ACL bug on Linux
|
|
# ("chmod A+user:..."). Ownership is handed to the service user
|
|
# afterwards via chown, and the systemd unit runs podman-compose
|
|
# as the stoat user via User=.
|
|
- name: Clone Stoat self-hosted repository
|
|
ansible.builtin.git:
|
|
repo: "{{ stoat_repo }}"
|
|
dest: "{{ stoat_install_dir }}"
|
|
version: "{{ stoat_version }}"
|
|
force: true
|
|
|
|
- name: Ensure generate_config.sh is executable
|
|
ansible.builtin.file:
|
|
path: "{{ stoat_install_dir }}/generate_config.sh"
|
|
mode: "0755"
|
|
|
|
# The compose file bind-mounts these directories; create them up
|
|
# front so rootless podman does not fail on missing sources.
|
|
- name: Create data directories referenced by compose bind mounts
|
|
ansible.builtin.file:
|
|
path: "{{ stoat_install_dir }}/data/{{ item }}"
|
|
state: directory
|
|
owner: "{{ stoat_service_user }}"
|
|
group: "{{ stoat_service_user }}"
|
|
mode: "0755"
|
|
loop:
|
|
- db
|
|
- rabbit
|
|
- minio
|
|
- caddy-data
|
|
- caddy-config
|
|
|
|
# generate_config.sh is interactive; it reads two questions from
|
|
# stdin: reverse-proxy? [y/N] and camera/screen sharing? [Y/n].
|
|
# `creates` makes this idempotent - the script refuses to overwrite
|
|
# existing config without --overwrite, which is a destructive
|
|
# operation we never want Ansible to do by accident.
|
|
- name: Generate Stoat configuration and secrets
|
|
ansible.builtin.shell: >-
|
|
printf '{{ 'y' if stoat_reverse_proxy else 'n' }}\n{{ 'y' if stoat_video else 'n' }}\n'
|
|
| ./generate_config.sh {{ stoat_domain }}
|
|
args:
|
|
chdir: "{{ stoat_install_dir }}"
|
|
creates: "{{ stoat_install_dir }}/Revolt.toml"
|
|
|
|
# The generator and clone run as root; hand the whole deployment
|
|
# tree to the service user so rootless podman can read/write it.
|
|
- name: Hand ownership of the deployment tree to the service user
|
|
ansible.builtin.file:
|
|
path: "{{ stoat_install_dir }}"
|
|
state: directory
|
|
owner: "{{ stoat_service_user }}"
|
|
group: "{{ stoat_service_user }}"
|
|
recurse: true
|
|
|
|
- name: Deploy podman-compose systemd unit
|
|
ansible.builtin.template:
|
|
src: podman-compose-stoat.service.j2
|
|
dest: /etc/systemd/system/podman-compose-stoat.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
# First start pulls ~2 GB of images + initializes MongoDB, which can
|
|
# take several minutes. TimeoutStartSec in the unit covers this.
|
|
- name: Enable and start the Stoat service (first pull may take minutes)
|
|
ansible.builtin.systemd:
|
|
name: podman-compose-stoat
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true |