deploy_home/ansible/roles/podman/tasks/containers/home/cloud.yml

---
- name: create required cloud volumes
  become: true
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ podman_subuid.stdout }}"
    group: "{{ podman_subuid.stdout }}"
    mode: 0755
  notify: restorecon podman
  loop:
    - "{{ cloud_path }}/apps"
    - "{{ cloud_path }}/config"
    - "{{ cloud_path }}/data"
    - "{{ cloud_path }}/mysql"

- name: unshare chown the nextcloud volumes
  become: true
  become_user: "{{ podman_user }}"
  changed_when: false
  ansible.builtin.command: |
    podman unshare chown -R 33:33 {{ cloud_path }}/apps {{ cloud_path }}/data {{ cloud_path}}/config

- name: flush handlers
  ansible.builtin.meta: flush_handlers

- import_tasks: podman/podman-check.yml
  vars:
    container_name: cloud-db
    container_image: "{{ db_image }}"

- name: create cloud-db container
  become: true
  become_user: "{{ podman_user }}"
  containers.podman.podman_container:
    name: cloud-db
    image: "{{ db_image }}"
    restart_policy: on-failure:3
    log_driver: journald
    network:
      - shared
    env:
      MYSQL_ROOT_PASSWORD: "{{ cloud_db_root_pass }}"
      MYSQL_DATABASE: cloud
      MYSQL_PASSWORD: "{{ cloud_db_pass }}"
      MYSQL_USER: cloud
    volumes:
      - "{{ cloud_path }}/mysql:/var/lib/mysql"

- name: create systemd startup job for cloud-db
  include_tasks: podman/systemd-generate.yml
  vars:
    container_name: cloud-db

- import_tasks: podman/podman-check.yml
  vars:
    container_name: cloud
    container_image: "{{ image }}"

- name: create cloud container
  become: true
  become_user: "{{ podman_user }}"
  containers.podman.podman_container:
    name: cloud
    image: "{{ image }}"
    restart_policy: on-failure:3
    log_driver: journald
    network:
      - shared
    env:
      MYSQL_PASSWORD: "{{ cloud_db_pass }}"
      MYSQL_DATABASE: cloud
      MYSQL_HOST: cloud-db
      MYSQL_USER: cloud
    volumes:
      - "{{ cloud_path }}/apps:/var/www/html/custom_apps"
      - "{{ cloud_path }}/data:/var/www/html/data"
      - "{{ cloud_path }}/config:/var/www/html/config"
    ports:
      - "8089:80"

- name: create systemd startup job for cloud
  include_tasks: podman/systemd-generate.yml
  vars:
    container_name: cloud

# Unbounded by default: nextcloud.log.1 had reached 1.12 GB and was being
# rsynced to TrueNAS and pushed to S3 on every run. Cap at 10 MiB.
- name: cap nextcloud log rotation size for cloud
  become: true
  become_user: "{{ podman_user }}"
  ansible.builtin.command: >
    podman exec -u www-data cloud
    php occ config:system:set log_rotate_size --value 10485760 --type integer
  register: cloud_log_rotate
  changed_when: "'System config value log_rotate_size' in cloud_log_rotate.stdout"
  failed_when: false

# Nextcloud's default ('auto') only expires trash when disk space is needed,
# so 66 GB of >30-day deletions sat untouched on a host with 1.3 TB free --
# the retention was effectively unbounded. 'auto, 30' makes the 30-day
# expiry unconditional while still purging early under space pressure.
- name: set nextcloud trashbin retention for cloud
  become: true
  become_user: "{{ podman_user }}"
  ansible.builtin.command: >
    podman exec -u www-data cloud
    php occ config:system:set trashbin_retention_obligation --value "auto, 30"
  register: cloud_trashbin_retention
  changed_when: "'System config value trashbin_retention_obligation' in cloud_trashbin_retention.stdout"
  failed_when: false

- include_tasks: containers/cloud-cron.yml
  vars:
    cron_name: cloud
    cron_container: cloud
    cron_script_path: /usr/local/bin/cloud-cron.sh

- include_tasks: containers/cloud-backup.yml
  vars:
    backup_name: cloud
    data_path: "{{ cloud_path }}/data"
    config_path: "{{ cloud_path }}/config"
    db_container: cloud-db
    ssh_key_path: /etc/ssh/backup_keys/cloud
    ssh_key_content: "{{ cloud_backup_ssh_key }}"
    ssh_user: cloud
    remote_path: /mnt/glacier/nextcloud
    script_path: /usr/local/bin/cloud-backup.sh