2026-AUG-23

2026-08-23 21:55:12 +09:00
parent ada7e751d8
commit 56fb5716b5
19 changed files with 412 additions and 65 deletions
@@ -1,34 +0,0 @@
-[Quadlet]
-DefaultDependencies=false
-
-[Unit]
-Description=Memos
-
-[Container]
-Image=docker.io/neosmemo/memos:{{ version['containers']['memos'] }}
-ContainerName=memos
-HostName=memos
-PublishPort={{ services['memos']['ports']['http'] }}:5230/tcp
-
-# Volumes
-Volume=%h/data/containers/memos/data:/var/opt/memos:rw
-Volume=%h/containers/memos/ssl:/etc/ssl/memos:ro
-
-# General
-Environment="TZ={{ timezone }}"
-Environment="MEMOS_MODE=prod"
-Environment="MEMOS_PORT=5230"
-Environment="MEMOS_INSTANCE_URL=https://{{ services['memos']['domain']['public'] }}.{{ domain['public'] }}"
-
-# Database (PostgreSQL)
-Environment="MEMOS_DRIVER=postgres"
-Secret=MEMOS_DSN,type=env
-
-[Service]
-ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
-Restart=always
-RestartSec=10s
-TimeoutStopSec=120
-
-[Install]
-WantedBy=default.target
@@ -22,6 +22,9 @@ Environment="ALLOWED_HOSTS={{ services['tandoor']['domain']['public'] }}.{{ doma
 Environment="CSRF_TRUSTED_ORIGINS=https://{{ services['tandoor']['domain']['public'] }}.{{ domain['public'] }}"
 # auth Caddy -> app Caddy -> Tandoor built-in nginx
 Environment="ALLAUTH_TRUSTED_PROXY_COUNT=3"
+# Set Django gunicorn worker as 1, and threads as 2
+Environment="GUNICORN_WORKERS=1"
+Environment="GUNICORN_THREADS=2"

 # Secrets
 Secret=TANDOOR_SECRET_KEY,type=env,target=SECRET_KEY
@@ -252,28 +252,6 @@ identity_providers:
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'
-      # https://www.authelia.com/integration/openid-connect/clients/memos/
-      - client_id: 'memos'
-        client_name: 'Memos'
-        consent_mode: 'implicit'
-        client_secret: '{{ hostvars['console']['memos']['oidc']['hash'] }}'
-        public: false
-        authorization_policy: 'one_factor'
-        require_pkce: false
-        pkce_challenge_method: ''
-        redirect_uris:
-          - 'https://{{ services['memos']['domain']['public'] }}.{{ domain['public'] }}/auth/callback'
-        scopes:
-          - 'openid'
-          - 'profile'
-          - 'email'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
-        access_token_signed_response_alg: 'none'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_post'
      # https://www.authelia.com/integration/openid-connect/clients/mealie/
      - client_id: 'mealie'
        client_name: 'Mealie'
@@ -0,0 +1,39 @@
+#------------------------------------------------------------------------------
+# CUSTOMIZED OPTIONS
+#------------------------------------------------------------------------------
+[mariadb]
+
+# Listen address
+bind-address = 0.0.0.0
+
+# Max connections
+max_connections = 250
+
+# Listen port
+port = {{ services['mariadb']['ports']['tcp'] }}
+
+# SSL
+ssl-ca = /etc/ssl/mariadb/{{ root_cert_filename }}
+ssl-cert = /etc/ssl/mariadb/mariadb.crt
+ssl-key = /etc/ssl/mariadb/mariadb.key
+ssl-cipher = HIGH:!aNULL:!MD5
+require_secure_transport = ON
+
+# InnoDB
+innodb_buffer_pool_size = 512M
+innodb_log_file_size = 5G
+innodb_flush_log_at_trx_commit = 1
+
+# Temporary memory
+tmp_table_size = 16M
+max_heap_table_size = 16M
+
+# IO
+innodb_io_capacity = 200
+
+# SSD
+innodb_flush_neighbors = 0
+
+[client]
+protocol=socket
+skip-ssl
@@ -0,0 +1,37 @@
+[Quadlet]
+DefaultDependencies=false
+
+[Unit]
+Description=MariaDB
+
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=docker.io/library/mariadb:{{ version['containers']['mariadb'] }}
+
+ContainerName=mariadb
+HostName=mariadb
+
+PublishPort={{ services['mariadb']['ports']['tcp'] }}:3306/tcp
+
+Volume=%h/containers/mariadb/data:/var/lib/mysql:rw
+Volume=%h/containers/mariadb/config:/etc/mysql/conf.d/:ro
+Volume=%h/containers/mariadb/ssl:/etc/ssl/mariadb:ro
+Volume=%h/containers/mariadb/init:/docker-entrypoint-initdb.d/:ro
+Volume=%h/data/containers/mariadb/backups:/backups:rw
+
+# General
+Environment="TZ={{ timezone }}"
+
+# root is only available in container (localhost)
+Environment="MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=1"
+Environment="MARIADB_ROOT_HOST=localhost"
+
+[Service]
+Restart=always
+RestartSec=10s
+TimeoutStopSec=120
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,26 @@
+[Unit]
+Description=MariaDB Data %i Backup Service
+After=mariadb.service
+BindsTo=mariadb.service
+
+[Service]
+Type=oneshot
+
+# logging
+StandardOutput=journal
+StandardError=journal
+
+ExecStartPre=/usr/bin/podman exec mariadb sh -c "mkdir -p /backups/%i && chown mysql:root /backups/%i && chmod 770 /backups/%i"
+ExecStartPre=/usr/bin/podman exec mariadb sh -c "mkdir -p /backups/sql && chown mysql:root /backups/sql && chmod 770 /backups/sql"
+
+# Run the script
+## User SQL
+ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c 'mariadb -uroot -N -B -e \"SHOW CREATE USER \'%i\'@\'%%\';\" | sed "s/$/;/" > /backups/%i/mariadb_%i_$(date "+%%Y-%%m-%%d").sql'
+## Database SQL
+ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c 'mariadb-dump -uroot --single-transaction --routines --events --triggers --databases %i_db >> /backups/%i/mariadb_%i_$(date "+%%Y-%%m-%%d").sql'
+## Grant SQL
+ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c 'mariadb -uroot -N -B -e \"SHOW GRANTS FOR \'%i\'@\'%%\';\" | sed "s/$/;/" >> /backups/%i/mariadb_%i_$(date "+%%Y-%%m-%%d").sql'
+ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c 'cp -a /backups/%i/mariadb_%i_$(date "+%%Y-%%m-%%d").sql /backups/sql/mariadb_%i.sql'
+ExecStart=/usr/bin/podman exec -u mysql mariadb sh -c "find /backups/%i -maxdepth 1 -type f -name 'mariadb_%i_*.sql' -mtime +7 -delete"
+ExecStart=/usr/bin/podman exec mariadb sh -c "chown -R mysql:root /backups/%i && chmod 660 /backups/%i/*"
+ExecStart=/usr/bin/podman exec mariadb sh -c "chown -R mysql:root /backups/sql && chmod 660 /backups/sql/mariadb_%i.sql"
@@ -0,0 +1,17 @@
+[Unit]
+Description=Run %i Data Backup service every day
+
+[Timer]
+# Execute service after 1 min on booting
+OnBootSec=1min
+
+# Execute service every day 00:00
+OnCalendar=*-*-* 00:00:00
+# Random time to postpone the timer
+RandomizedDelaySec=15min
+
+# When timer is activated, Service also starts.
+Persistent=true
+
+[Install]
+WantedBy=timers.target