refactor(repo): update dependency and abstract variables

2026-06-25 16:56:11 +09:00
parent a2334bb236
commit a49cdcb9d1
10 changed files with 36 additions and 32 deletions
@@ -21,6 +21,11 @@ domain:

 services:
  # common
+  wireguard:
+    domain:
+      public: "vpn"
+    ports:
+      upd: "11290"
  crowdsec:
    domain:
      internal: "crowdsec"
@@ -12,7 +12,7 @@
 - name: Reload postgresql
  ansible.builtin.command:
    /usr/bin/podman exec -u postgres postgresql sh -c "pg_ctl reload"
-  when: is_postgresql_init.stat.exists
+  when: is_postgresql_init_marker.stat.exists
  changed_when: false
  listen: "notification_reload_postgresql"
  ignore_errors: true # noqa: ignore-errors
@@ -24,7 +24,7 @@
    enabled: true
    daemon_reload: true
    scope: "user"
-  when: is_postgresql_init.stat.exists
+  when: is_postgresql_init_marker.stat.exists
  changed_when: false
  listen: "notification_restart_postgresql"
  ignore_errors: true # noqa: ignore-errors
@@ -15,12 +15,6 @@
        | list
      }}

- name: Delete existing init files
-  ansible.builtin.file:
-    path: "{{ node['home_path'] }}/containers/postgresql/init"
-    state: "absent"
-  become: true
-
 - name: Create postgresql directory
  ansible.builtin.file:
    path: "{{ node['home_path'] }}/{{ item }}"
@@ -101,6 +95,11 @@
  notify: "notification_reload_postgresql"
  no_log: true

+- name: Check postgresql .init marker
+  ansible.builtin.stat:
+    path: "{{ node['home_path'] }}/containers/postgresql/.init"
+  register: "is_postgresql_init_marker"
+
 - name: Check initiating SQL file
  ansible.builtin.find:
    path: "{{ node['home_path'] }}/data/containers/postgresql/backups/sql/"
@@ -112,17 +111,6 @@
  become: true
  register: "postgresql_init_sql_files"

- name: Validate initiating SQL file count
-  ansible.builtin.assert:
-    that:
-      - postgresql_init_sql_files.matched == 0 or postgresql_init_sql_files.matched <= ((connected_services | length) + 1)
-    fail_msg: >-
-      Init SQL count mismatch.
-      expected=0 or above {{ (connected_services | length) + 1 }},
-      actual={{ postgresql_init_sql_files.matched }}.
-      Check pg_cluster.sql and pg_<service>.sql files in
-      {{ node['home_path'] }}/data/containers/postgresql/backups/sql/
-
 - name: Remote copy the initiating SQL
  ansible.builtin.copy:
    src: "{{ node['home_path'] }}/data/containers/postgresql/backups/sql/pg_{{ item }}.sql"
@@ -137,6 +125,7 @@
  become: true
  when:
    - (connected_services | length) > 0
+    - not is_postgresql_init_marker.stat.exists
    - postgresql_init_sql_files.matched == (connected_services | length) + 1

 - name: Deploy container file
@@ -186,6 +175,14 @@
    scope: "user"
  loop: "{{ connected_services }}"

+- name: Create .init file
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/containers/postgresql/.init"
+    state: "touch"
+    mode: "0644"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+
 - name: Check container archive images
  ansible.builtin.stat:
    path: "{{ node['home_path'] }}/archives/containers/\
@@ -9,9 +9,9 @@ define HOSTS4_AUTH = {{ hostvars['fw']['network4']['auth']['server'] }}
 define HOSTS6_AUTH = {{ hostvars['fw']['network6']['auth']['server'] }}
 define PORTS_SSH = 22
 define PORTS_HTTP = 80
-define PORTS_HTTP_FORWARD = 2080
+define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
 define PORTS_HTTPS = 443
-define PORTS_HTTPS_FORWARD = 2443
+define PORTS_HTTPS_FORWARD = {{ services['caddy']['ports']['https'] }}

 table inet nat {
    chain prerouting {
@@ -7,9 +7,9 @@ define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | jo
 define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
 define PORTS_SSH = 22
 define PORTS_HTTP = 80
-define PORTS_HTTP_FORWARD = 2080
+define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
 define PORTS_HTTPS = 443
-define PORTS_HTTPS_FORWARD = 2443
+define PORTS_HTTPS_FORWARD = {{ services['caddy']['ports']['https'] }}

 table inet nat {
    chain prerouting {
@@ -25,12 +25,12 @@
 {{ hostvars['fw']['network4']['blocky']['server'] }} blocky.{{ domain['internal'] }}
 {{ hostvars['fw']['network4']['bind']['server'] }} bind.{{ domain['internal'] }}
 # DB, LDAP, CA, Prometheus, Loki, mail (infra)
-{{ hostvars['fw']['network4']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} mail.{{ domain['internal'] }} ca.{{ domain['internal'] }}
+{{ hostvars['fw']['network4']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }}
 # IPv6
 # Crowdsec, blocky, bind(fw)
 {{ hostvars['fw']['network6']['firewall']['server'] }} ntp.{{ domain['internal'] }} crowdsec.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['blocky']['server'] }} blocky.{{ domain['internal'] }}
 {{ hostvars['fw']['network6']['bind']['server'] }} bind.{{ domain['internal'] }}
 # DB, LDAP, CA, Prometheus, Loki, mail (infra)
-{{ hostvars['fw']['network6']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} mail.{{ domain['internal'] }} ca.{{ domain['internal'] }}
+{{ hostvars['fw']['network6']['infra']['server'] }} postgresql.{{ domain['internal'] }} ldap.{{ domain['internal'] }} prometheus.{{ domain['internal'] }} loki.{{ domain['internal'] }} maddy.{{ domain['internal'] }} ca.{{ domain['internal'] }}
 {% endif %}
@@ -48,7 +48,7 @@ define PORTS_WEB = { 80, 443 }
 define PORTS_DHCP = { 67, 68, 546, 547 }
 define PORTS_DNS = 53
 define PORTS_NTP = 123
-define PORTS_VPN = 11290
+define PORTS_VPN = {{ services['wireguard']['ports']['udp'] }}
 define PORTS_CROWDSEC = {{ services['crowdsec']['ports']['https'] }}

 table inet nat {
@@ -2,7 +2,7 @@
 Name=wg0
 Kind=wireguard
 [WireGuard]
-ListenPort=11290
+ListenPort={{ services['wireguard']['ports']['udp'] }}
 PrivateKey={{ hostvars['console']['wireguard']['server']['private_key'] }}
 [WireGuardPeer]
 PublicKey={{ hostvars['console']['wireguard']['console']['public_key'] }}
@@ -13,9 +13,9 @@ define PORTS_CA = {{ services['ca']['ports']['https'] }}
 define PORTS_LDAPS = 636
 define PORTS_LDAPS_FORWARD = {{ services['ldap']['ports']['ldaps'] }}
 define PORTS_HTTP = 80
-define PORTS_HTTP_FORWARD = 2080
+define PORTS_HTTP_FORWARD = {{ services['caddy']['ports']['http'] }}
 define PORTS_HTTPS = 443
-define PORTS_HTTPS_FORWARD = 2443
+define PORTS_HTTPS_FORWARD = {{ services['caddy']['ports']['https'] }}
 define PORTS_PROMETHEUS = {{ services['prometheus']['ports']['https'] }}
 define PORTS_LOKI = {{ services['loki']['ports']['https'] }}
 define PORTS_SMTP = 587
@@ -4,8 +4,8 @@ DefaultDependencies=false
 [Unit]
 Description=Maddy

-After=network-online.target
-Wants=network-online.target
+After=postgresql.service ldap.service
+Requires=postgresql.service ldap.service

 [Container]
 Image=docker.io/foxcpp/maddy:{{ version['containers']['maddy'] }}
@@ -19,15 +19,17 @@ PublishPort={{ services['maddy']['ports']['imaps'] }}:993/tcp
 AddHost={{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}:host-gateway
 AddHost={{ services['ldap']['domain']['internal'] }}.{{ domain['internal'] }}:host-gateway

-Volume=%h/containers/maddy/maddy.conf:/data/maddy.conf:ro
 Volume=%h/containers/maddy/ssl:/etc/ssl/maddy:ro
 Volume=%h/data/containers/maddy/data:/data:rw
+Volume=%h/containers/maddy/maddy.conf:/data/maddy.conf:ro

 Environment="TZ={{ timezone }}"
 Secret=MADDY_LDAP_BIND_PASSWORD,type=env
 Secret=MADDY_POSTGRES_URL,type=env

 [Service]
+ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
+ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }} 636
 Restart=always
 RestartSec=10s
 TimeoutStopSec=120