noticket - reorganized podman

ansible/roles/podman/tasks/containers/home/cloud.yml

@@ -0,0 +1,100 @@
+---
+- name: create required cloud volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_subuid.stdout }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ cloud_path }}/apps"
+    - "{{ cloud_path }}/config"
+    - "{{ cloud_path }}/data"
+    - "{{ cloud_path }}/mysql"
+
+- name: unshare chown the nextcloud volumes
+  become: true
+  become_user: "{{ podman_user }}"
+  changed_when: false
+  ansible.builtin.command: |
+    podman unshare chown -R 33:33 {{ cloud_path }}/apps {{ cloud_path }}/data {{ cloud_path}}/config
+
+- name: get user/group id from unshare
+  become: true
+  ansible.builtin.stat:
+    path: "{{ cloud_path }}/data"
+  register: cloud_owner
+
+- name: mount cloud cifs
+  become: true
+  ansible.posix.mount:
+    src: "{{ cloud_cifs_src }}"
+    path: "{{ cloud_path }}/data"
+    fstype: cifs
+    opts: "username=cloud,password={{ cloud_cifs_pass }},uid={{ cloud_owner.stat.uid }},gid={{ cloud_owner.stat.uid }},file_mode=0770,dir_mode=0770"
+    state: mounted
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: cloud-db
+    container_image: "{{ db_image }}"
+
+- name: create cloud-db container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: cloud-db
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MYSQL_ROOT_PASSWORD: "{{ cloud_db_root_pass }}"
+      MYSQL_DATABASE: cloud
+      MYSQL_PASSWORD: "{{ cloud_db_pass }}"
+      MYSQL_USER: cloud
+    volumes:
+      - "{{ cloud_path }}/mysql:/var/lib/mysql"
+
+- name: create systemd startup job for cloud-db
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: cloud-db
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: cloud
+    container_image: "{{ image }}"
+
+- name: create cloud container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: cloud
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MYSQL_PASSWORD: "{{ cloud_db_pass }}"
+      MYSQL_DATABASE: cloud
+      MYSQL_HOST: cloud-db
+      MYSQL_USER: cloud
+    volumes:
+      - "{{ cloud_path }}/apps:/var/www/html/custom_apps"
+      - "{{ cloud_path }}/data:/var/www/html/data"
+      - "{{ cloud_path }}/config:/var/www/html/config"
+    ports:
+      - "8089:80"
+
+- name: create systemd startup job for cloud
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: cloud

ansible/roles/podman/tasks/containers/home/drone.yml

@@ -0,0 +1,79 @@
+---
+- name: create required drone volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ drone_path }}/data"
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: drone
+    container_image: "{{ image }}"
+
+- name: create drone-ci server container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: drone
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      DRONE_LOGS_DEBUG: "false"
+      DRONE_RPC_DEBUG: "false"
+      DRONE_GITHUB_CLIENT_ID: "{{ drone_gh_client_id }}"
+      DRONE_GITHUB_CLIENT_SECRET: "{{ drone_gh_client_sec }}"
+      DRONE_RPC_SECRET: "{{ drone_rpc_secret }}"
+      DRONE_SERVER_HOST: "{{ ci_server_name }}"
+      DRONE_SERVER_PROTO: "{{ drone_server_proto }}"
+      DRONE_USER_FILTER: "{{ drone_user_filter }}"
+    volumes:
+      - "{{ drone_path }}/data:/data"
+    ports:
+      - "8080:80"
+
+- name: create systemd startup job for drone
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: drone
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: drone-runner
+    container_image: "{{ runner_image }}"
+
+- name: create drone-ci worker container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: drone-runner
+    image: "{{ runner_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      DRONE_RPC_SECRET: "{{ drone_rpc_secret }}"
+      DRONE_RPC_HOST: "drone"
+      DRONE_RPC_PROTO: "{{ drone_runner_proto }}"
+      DRONE_RUNNER_CAPACITY: "{{ drone_runner_capacity }}"
+    volumes:
+      - "/run/user/1002/podman/podman.sock:/var/run/docker.sock"
+    ports:
+      - "3000:3000"
+
+- name: create systemd startup job for drone-runner
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: drone-runner

ansible/roles/podman/tasks/containers/home/graylog.yml

@@ -0,0 +1,128 @@
+---
+- name: create required graylog volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ graylog_path }}/mongo"
+    - "{{ graylog_path }}/elastic"
+    - "{{ graylog_path }}/conf"
+    - "{{ graylog_path }}/bin"
+
+- name: copy configuration files
+  become: true
+  ansible.builtin.copy:
+    src: "files/graylog/{{ item.src }}"
+    dest: "{{ graylog_path }}/{{ item.dest }}"
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - src: "graylogctl"
+      dest: "bin/graylogctl"
+    - src: "graylog.conf"
+      dest: "conf/graylog.conf"
+  notify: restorecon podman
+
+- name: unshare chown the elastic volume
+  become: true
+  become_user: "{{ podman_user }}"
+  changed_when: false
+  ansible.builtin.command: |
+    podman unshare chown -R 1000:1000 {{ graylog_path }}/elastic
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: graylog-mongo
+    container_image: "{{ db_image }}"
+
+- name: create graylog mongodb container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: graylog-mongo
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    network:
+      - shared
+    volumes:
+      - "{{ graylog_path }}/mongo:/data/db"
+
+- name: create systemd startup job for graylog-mongo
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: graylog-mongo
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: graylog-elastic
+    container_image: "{{ es_image }}"
+
+- name: create graylog elasticsearch container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: graylog-elastic
+    image: "{{ es_image }}" 
+    restart_policy: on-failure:3
+    network:
+      - shared
+    volumes:
+      - "{{ graylog_path }}/elastic:/usr/share/elasticsearch/data"
+    env:
+      http.host: "0.0.0.0"
+      transport.host: "localhost"
+      network.host: "0.0.0.0"
+      cluster.name: "graylog"
+      ES_JAVA_OPTS: "-Dlog4j2.formatMsgNoLookups=true -Xms512m -Xmx2048m"
+
+- name: create systemd startup job for graylog-elastic
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: graylog-elastic
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: graylog
+    container_image: "{{ image }}"
+
+- name: create graylog container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: graylog
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    sysctl:
+      net.ipv6.conf.all.disable_ipv6: 1
+      net.ipv6.conf.default.disable_ipv6: 1
+    network:
+      - shared
+    volumes:
+      - "{{ graylog_path }}/conf:/usr/share/graylog/data/config"
+      - "{{ graylog_path }}/bin:/usr/share/graylog/bin"
+    env:
+      GRAYLOG_PASSWORD_SECRET: "{{ graylog_secret }}"
+      GRAYLOG_ROOT_PASSWORD_SHA2: "{{ graylog_root_pass_sha2 }}"
+      GRAYLOG_HTTP_EXTERNAL_URI: http://{{ ansible_default_ipv4.address }}:9000/
+      GRAYLOG_HTTP_BIND_ADDRESS: 0.0.0.0:9000
+      GRAYLOG_MONGODB_URI: mongodb://graylog-mongo/graylog
+      GRAYLOG_ELASTICSEARCH_HOSTS: http://graylog-elastic:9200
+    ports:
+      - "{{ graylog_port }}:9000"
+      - "{{ syslog_udp_default }}:{{ syslog_udp_default }}/udp"
+      - "{{ syslog_udp_unifi }}:{{ syslog_udp_unifi }}/udp"
+      - "{{ syslog_udp_error }}:{{ syslog_udp_error }}/udp"
+
+- name: create systemd startup job for graylog
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: graylog

ansible/roles/podman/tasks/containers/home/hass.yml

@@ -0,0 +1,56 @@
+---
+- name: create home-assistant host directory volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ hass_path }}/media"
+    - "{{ hass_path }}/config"
+
+- name: copy configuration and automations
+  become: true
+  ansible.builtin.copy:
+    src: "files/hass/{{ item }}"
+    dest: "{{ hass_path }}/config/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  notify: restorecon podman
+  loop:
+    - configuration.yaml
+    - automations.yaml
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: hass
+    container_image: "{{ image }}"
+
+- name: create home-assistant server container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: hass
+    image: "{{ image }}" 
+    restart_policy: on-failure:3
+    log_driver: journald
+    cap_add:
+      - CAP_NET_RAW
+      - CAP_NET_BIND_SERVICE
+    volumes:
+      - "{{ hass_path }}/config:/config"
+      - "{{ hass_path }}/media:/share"
+    ports:
+      - "8123:8123"
+
+- name: create systemd startup job for hass
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: hass

ansible/roles/podman/tasks/containers/home/nosql.yml

@@ -0,0 +1,44 @@
+---
+- name: create nosql host directory volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ nosql_path }}/conf"
+    - "{{ nosql_path }}/data"
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: nosql
+    container_image: "{{ image }}"
+
+- name: create nosql container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: nosql
+    image: "{{ image }}"
+    command: redis-server --requirepass {{ nosql_password }} 
+    restart_policy: on-failure:3
+    log_driver: journald
+    volumes:
+      - "{{ nosql_path }}/conf:/usr/local/etc/redis/"
+      - "{{ nosql_path }}/data:/var/lib/redis"
+    env:
+      TZ: America/New_York
+      REDIS_REPLICATION_MODE: master
+    ports:
+      - 6379:6379/tcp
+
+- name: create systemd startup job for nosql
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: nosql

ansible/roles/podman/tasks/containers/home/partkeepr.yml

@@ -0,0 +1,66 @@
+---
+- name: create required partkeepr volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ partkeepr_path }}/mysql"
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: partkeepr-db
+    container_image: "{{ db_image }}"
+
+- name: create partkeepr-db container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: partkeepr-db
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
+      MYSQL_DATABASE: partkeepr
+      MYSQL_USER: partkeepr
+      MYSQL_PASSWORD: "{{ partkeepr_mysql_password }}"
+    volumes:
+      - "{{ partkeepr_path }}/mysql:/var/lib/mysql"
+
+- name: create systemd startup job for partkeepr-db
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: partkeepr-db
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: partkeepr
+    container_image: "{{ image }}"
+
+- name: create partkeepr container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: partkeepr
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    ports:
+      - "8081:80"
+
+- name: create systemd startup job for partkeepr
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: partkeepr

ansible/roles/podman/tasks/containers/home/photos.yml

@@ -0,0 +1,107 @@
+---
+- name: create required photos volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ photos_path }}/mysql"
+    - "{{ photos_path }}/storage"
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- name: mount photos cifs
+  become: true
+  ansible.posix.mount:
+    src: "{{ photos_cifs_src }}"
+    path: "{{ photos_path }}/storage"
+    fstype: cifs
+    opts: "username=photos,password={{ photos_cifs_pass }},uid={{ podman_subuid.stdout }},gid={{ podman_subuid.stdout }}"
+    state: mounted
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: photos-db
+    container_image: "{{ db_image }}"
+
+- name: create photos-db container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: photos-db
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MARIADB_AUTO_UPGRADE: "1"
+      MYSQL_ROOT_PASSWORD: "{{ photos_db_root_pass }}"
+      MYSQL_DATABASE: photos
+      MYSQL_USER: photos
+      MYSQL_PASSWORD: "{{ photos_db_pass }}"
+    volumes:
+      - "{{ photos_path }}/mysql:/var/lib/mysql"
+
+- name: create systemd startup job for photos-db
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: photos-db
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: photos
+    container_image: "{{ image }}"
+
+- name: create photos container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: photos
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      PHOTOPRISM_ADMIN_PASSWORD: "{{ photos_user_pass }}"
+      PHOTOPRISM_AUTH_MODE: "password"
+      PHOTOPRISM_SITE_URL: "https://photos.bdebyl.net/"
+      PHOTOPRISM_ORIGINALS_LIMIT: 5000
+      PHOTOPRISM_HTTP_COMPRESSION: "gzip"
+      PHOTOPRISM_LOG_LEVEL: "info"
+      PHOTOPRISM_READONLY: "false"
+      PHOTOPRISM_EXPERIMENTAL: "false"
+      PHOTOPRISM_DISABLE_CHOWN: "false"
+      PHOTOPRISM_DISABLE_WEBDAV: "false"
+      PHOTOPRISM_DISABLE_SETTINGS: "false"
+      PHOTOPRISM_DISABLE_TENSORFLOW: "false"
+      PHOTOPRISM_DISABLE_FACES: "false"
+      PHOTOPRISM_DISABLE_CLASSIFICATION: "false"
+      PHOTOPRISM_DISABLE_RAW: "false"
+      PHOTOPRISM_RAW_PRESETS: "false"
+      PHOTOPRISM_JPEG_QUALITY: 85
+      PHOTOPRISM_DETECT_NSFW: "false"
+      PHOTOPRISM_UPLOAD_NSFW: "true"
+      PHOTOPRISM_DATABASE_DRIVER: "mysql"
+      PHOTOPRISM_DATABASE_SERVER: "photos-db:3306"
+      PHOTOPRISM_DATABASE_NAME: "photos"
+      PHOTOPRISM_DATABASE_USER: "photos"
+      PHOTOPRISM_DATABASE_PASSWORD: "{{ photos_db_pass }}"
+      PHOTOPRISM_SITE_CAPTION: "AI-Powered Photos App"
+      PHOTOPRISM_SITE_DESCRIPTION: ""
+      PHOTOPRISM_SITE_AUTHOR: "Bastian D."
+    volumes:
+      - "{{ photos_path }}/storage:/photoprism/"
+    ports:
+      - "8088:2342"
+
+- name: create systemd startup job for photos
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: photos