bk node and refactor

ansible/roles/app/tasks/node/set_data_volume.yaml

@@ -1,41 +0,0 @@
----
-- name: Check app data volume filesystem already exists
-  ansible.builtin.command:
-    cmd: "blkid /dev/{{ vm['data_storage']['name'] }}"
-  register: is_app_data
-  changed_when: false
-  failed_when: false
-  become: true
-
-- name: Create ext4 filesystem on app data raw
-  ansible.builtin.command:
-    cmd: "mkfs.ext4 -F /dev/{{ vm['data_storage']['name'] }}"
-  when: is_app_data.rc != 0
-  changed_when: true
-  become: true
-
-- name: Set data volume path
-  ansible.builtin.file:
-    path: "{{ node['home_path'] }}/data"
-    state: "directory"
-    owner: "{{ ansible_user }}"
-    group: "{{ node['group'] }}"
-    mode: "0770"
-
-- name: Mount app data volume
-  ansible.posix.mount:
-    path: "{{ node['home_path'] }}/data"
-    src: "/dev/{{ vm['data_storage']['name'] }}"
-    opts: "noatime"
-    state: "mounted"
-    fstype: "ext4"
-  become: true
-
-- name: Set app data volume path permissions
-  ansible.builtin.file:
-    path: "{{ node['home_path'] }}/data"
-    state: "directory"
-    owner: "{{ ansible_user }}"
-    group: "{{ node['group'] }}"
-    mode: "0770"
-  become: true

ansible/roles/app/tasks/services/set_collabora.yaml

@@ -1,4 +1,11 @@
 ---
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/collabora/code"
+    tag: "{{ version['containers']['collabora'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/collabora/collabora.container.j2"

ansible/roles/app/tasks/services/set_gitea.yaml

@@ -8,6 +8,7 @@
     mode: "0770"
   loop:
     - "data/containers/gitea"
+    - "data/containers/gitea/data"
     - "containers/gitea"
     - "containers/gitea/ssl"
   become: true
@@ -33,6 +34,13 @@
   notify: "notification_restart_gitea"
   no_log: true
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/gitea/gitea"
+    tag: "{{ version['containers']['gitea'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/gitea/gitea.container.j2"

ansible/roles/app/tasks/services/set_homebox.yaml

@@ -0,0 +1,86 @@
+---
+- name: Create homebox directory
+  ansible.builtin.file:
+    path: "{{ node['home_path'] }}/{{ item }}"
+    state: "directory"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0770"
+  loop:
+    - "data/containers/homebox"
+    - "data/containers/homebox/data"
+    - "containers/homebox"
+    - "containers/homebox/ssl"
+  become: true
+
+- name: Deploy root certificate
+  ansible.builtin.copy:
+    content: |
+      {{ hostvars['console']['ca']['root']['crt'] }}
+    dest: "{{ node['home_path'] }}/containers/homebox/ssl/{{ root_cert_filename }}"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0440"
+  become: true
+  notify: "notification_restart_homebox"
+  no_log: true
+
+- name: Register secret value to podman secret
+  containers.podman.podman_secret:
+    name: "{{ item.name }}"
+    data: "{{ item.value }}"
+    state: "present"
+    force: true
+  loop:
+    - name: "HBOX_AUTH_API_KEY_PEPPER"
+      value: "{{ hostvars['console']['homebox']['api_secret'] }}"
+    - name: "HBOX_DATABASE_PASSWORD"
+      value: "{{ hostvars['console']['postgresql']['password']['homebox'] }}"
+    - name: "HBOX_OIDC_CLIENT_SECRET"
+      value: "{{ hostvars['console']['homebox']['oidc']['secret'] }}"
+  notify: "notification_restart_homebox"
+  no_log: true
+
+- name: Pull image
+  containers.podman.podman_image:
+    name: "ghcr.io/sysadminsmedia/homebox"
+    tag: "{{ version['containers']['homebox'] }}"
+    state: "present"
+    pull: true
+
+- name: Deploy homebox.container file
+  ansible.builtin.template:
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/homebox/homebox.container.j2"
+    dest: "{{ node['home_path'] }}/.config/containers/systemd/homebox.container"
+    owner: "{{ ansible_user }}"
+    group: "{{ node['group'] }}"
+    mode: "0644"
+  notify: "notification_restart_homebox"
+
+- name: Enable homebox.service
+  ansible.builtin.systemd:
+    name: "homebox.service"
+    state: "started"
+    enabled: true
+    daemon_reload: true
+    scope: "user"
+
+- name: Check container archive images
+  ansible.builtin.stat:
+    path: "{{ node['home_path'] }}/archives/containers/ghcr.io_sysadminsmedia_homebox_{{ version['containers']['homebox'] }}.tar"
+  register: container_archive_images
+
+- name: Save container archive images
+  containers.podman.podman_save:
+    image:
+      - "ghcr.io/sysadminsmedia/homebox:{{ version['containers']['homebox'] }}"
+    dest: "{{ node['home_path'] }}/archives/containers/ghcr.io_sysadminsmedia_homebox_{{ version['containers']['homebox'] }}.tar"
+    format: "oci-archive"
+    force: false
+  when: not container_archive_images.stat.exists
+
+- name: Fetch container archive images
+  ansible.builtin.fetch:
+    src: "{{ node['home_path'] }}/archives/containers/ghcr.io_sysadminsmedia_homebox_{{ version['containers']['homebox'] }}.tar"
+    dest: "{{ hostvars['console']['node']['data_path'] }}/images/containers/"
+    flat: true

ansible/roles/app/tasks/services/set_immich.yaml

@@ -60,6 +60,7 @@
     mode: "0770"
   loop:
     - "data/containers/immich"
+    - "data/containers/immich/data"
     - "containers/immich"
     - "containers/immich/ssl"
     - "containers/immich/ml"
@@ -85,6 +86,22 @@
   notify: "notification_restart_immich"
   no_log: true
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "{{ item.image }}"
+    tag: "{{ item.tag }}"
+    state: "present"
+    pull: true
+  loop:
+    - name: "immich_ml"
+      image: "ghcr.io/immich-app/immich-machine-learning"
+      tag: "{{ version['containers']['immich'] }}-openvino"
+    - name: "immich"
+      image: "ghcr.io/immich-app/immich-server"
+      tag: "{{ version['containers']['immich'] }}"
+  loop_control:
+    label: "{{ item.name }}"
+
 - name: Deploy immich.container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/immich/immich.container.j2"
@@ -123,14 +140,17 @@
   ansible.builtin.stat:
     path: "{{ node['home_path'] }}/archives/containers/{{ item.file }}.tar"
   loop:
-    - image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
+    - name: "redis"
+      image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
       file: "docker.io_library_redis_{{ version['containers']['redis'] }}"
-    - image: "ghcr.io/immich-app/immich-machine-learning:{{ version['containers']['immich'] }}-openvino"
+    - name: "immich_ml"
+      image: "ghcr.io/immich-app/immich-machine-learning:{{ version['containers']['immich'] }}-openvino"
       file: "ghcr.io_immich-app_immich-machine-learning_{{ version['containers']['immich'] }}-openvino"
-    - image: "ghcr.io/immich-app/immich-server:{{ version['containers']['immich'] }}"
+    - name: "immich"
+      image: "ghcr.io/immich-app/immich-server:{{ version['containers']['immich'] }}"
       file: "ghcr.io_immich-app_immich-server_{{ version['containers']['immich'] }}"
   loop_control:
-    label: "{{ item.file }}"
+    label: "{{ item.name }}"
   register: container_archive_images
 
 - name: Save container archive images

ansible/roles/app/tasks/services/set_mealie.yaml

@@ -39,6 +39,13 @@
   notify: "notification_restart_mealie"
   no_log: true
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "ghcr.io/mealie-recipes/mealie"
+    tag: "{{ version['containers']['mealie'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy mealie.container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/mealie/mealie.container.j2"

ansible/roles/app/tasks/services/set_memos.yaml

@@ -29,13 +29,20 @@
   containers.podman.podman_secret:
     name: "MEMOS_DSN"
     data: "postgresql://memos:{{ hostvars['console']['postgresql']['password']['memos'] | urlencode | replace('/', '%2F') }}\
-        @{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}/memos_db?sslmode=verify-full&\
+        @{{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}/memos_db?sslmode=verify-full&\
         sslrootcert=/etc/ssl/memos/{{ root_cert_filename }}"
     state: "present"
     force: true
   no_log: true
   notify: "notification_restart_memos"
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/neosmemo/memos"
+    tag: "{{ version['containers']['memos'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy memos.container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/memos/memos.container.j2"

ansible/roles/app/tasks/services/set_nextcloud.yaml

@@ -90,7 +90,7 @@
           NEXTCLOUD_UPDATE: "1"
           NEXTCLOUD_ADMIN_USER: "{{ hostvars['console']['nextcloud']['admin']['id'] }}"
           NEXTCLOUD_ADMIN_PASSWORD: "{{ hostvars['console']['nextcloud']['admin']['password'] }}"
-          POSTGRES_HOST: "{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}"
+          POSTGRES_HOST: "{{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}"
           POSTGRES_DB: "nextcloud_db"
           POSTGRES_USER: "nextcloud"
           POSTGRES_PASSWORD: "{{ hostvars['console']['postgresql']['password']['nextcloud'] }}"
@@ -139,6 +139,13 @@
     - "upload.ini"
   notify: "notification_restart_nextcloud"
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/library/nextcloud"
+    tag: "{{ version['containers']['nextcloud'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy nextcloud.container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/nextcloud/nextcloud.container.j2"
@@ -179,12 +186,14 @@
   ansible.builtin.stat:
     path: "{{ node['home_path'] }}/archives/containers/{{ item.file }}.tar"
   loop:
-    - image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
+    - name: "redis"
+      image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
       file: "docker.io_library_redis_{{ version['containers']['redis'] }}"
-    - image: "docker.io/library/nextcloud:{{ version['containers']['nextcloud'] }}"
+    - name: "nextcloud"
+      image: "docker.io/library/nextcloud:{{ version['containers']['nextcloud'] }}"
       file: "docker.io_library_nextcloud_{{ version['containers']['nextcloud'] }}"
   loop_control:
-    label: "{{ item.file }}"
+    label: "{{ item.name }}"
   register: container_archive_images
 
 - name: Save container archive images

ansible/roles/app/tasks/services/set_outline.yaml

@@ -101,6 +101,13 @@
   notify: "notification_restart_outline"
   no_log: true
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/outlinewiki/outline"
+    tag: "{{ version['containers']['outline'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy outline.container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/outline/outline.container.j2"
@@ -122,12 +129,14 @@
   ansible.builtin.stat:
     path: "{{ node['home_path'] }}/archives/containers/{{ item.file }}.tar"
   loop:
-    - image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
+    - name: "redis"
+      image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
       file: "docker.io_library_redis_{{ version['containers']['redis'] }}"
-    - image: "docker.io/outlinewiki/outline:{{ version['containers']['outline'] }}"
+    - name: "outline"
+      image: "docker.io/outlinewiki/outline:{{ version['containers']['outline'] }}"
       file: "docker.io_outlinewiki_outline_{{ version['containers']['outline'] }}"
   loop_control:
-    label: "{{ item.file }}"
+    label: "{{ item.name }}"
   register: container_archive_images
 
 - name: Save container archive images

ansible/roles/app/tasks/services/set_paperless.yaml

@@ -67,6 +67,8 @@
     owner: "{{ ansible_user }}"
     group: "{{ node['group'] }}"
     mode: "0640"
+  register: "is_paperless_containerfile"
+  notify: "notification_restart_paperless"
 
 - name: Deploy root certificate
   ansible.builtin.copy:
@@ -87,6 +89,7 @@
     tag: "{{ version['containers']['paperless'] }}"
     state: "build"
     path: "{{ node['home_path'] }}/containers/paperless/build"
+    force: "{{ is_paperless_containerfile.changed }}"
 
 - name: Prune paperless dangling images
   containers.podman.podman_prune:
@@ -116,7 +119,7 @@
                 "client_id": "paperless",
                 "secret": "{{ hostvars['console']['paperless']['oidc']['secret'] }}",
                 "settings": {
-                  "server_url": "https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}/.well-known/openid-configuration",
+                  "server_url": "https://{{ services['authelia']['domain']['public'] }}.{{ domain['public'] }}/.well-known/openid-configuration",
                   "token_auth_method": "client_secret_post"
                 }
               }
@@ -147,12 +150,14 @@
   ansible.builtin.stat:
     path: "{{ node['home_path'] }}/archives/containers/{{ item.file }}.tar"
   loop:
-    - image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
+    - name: "redis"
+      image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
       file: "docker.io_library_redis_{{ version['containers']['redis'] }}"
-    - image: "{{ domain['internal'] }}/{{ node['name'] }}/paperless-ngx:{{ version['containers']['paperless'] }}"
+    - name: "paperless"
+      image: "{{ domain['internal'] }}/{{ node['name'] }}/paperless-ngx:{{ version['containers']['paperless'] }}"
       file: "{{ domain['internal'] }}_{{ node['name'] }}_paperless-ngx_{{ version['containers']['paperless'] }}"
   loop_control:
-    label: "{{ item.file }}"
+    label: "{{ item.name }}"
   register: container_archive_images
 
 - name: Save container archive images
@@ -161,11 +166,11 @@
       - "{{ item.item.image }}"
     dest: "{{ node['home_path'] }}/archives/containers/{{ item.item.file }}.tar"
     format: "oci-archive"
-    force: false
+    force: "{{ is_paperless_containerfile.changed }}"
   loop: "{{ container_archive_images.results }}"
   loop_control:
     label: "{{ item.item.file }}"
-  when: not item.stat.exists
+  when: not item.stat.exists or (item.item.name == 'paperless' and is_paperless_containerfile.changed)
 
 - name: Fetch container archive images
   ansible.builtin.fetch:

ansible/roles/app/tasks/services/set_sure.yaml

@@ -86,6 +86,13 @@
   notify: "notification_restart_sure"
   no_log: true
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "ghcr.io/we-promise/sure"
+    tag: "{{ version['containers']['sure'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy sure.container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/sure/{{ item }}.j2"
@@ -113,12 +120,14 @@
   ansible.builtin.stat:
     path: "{{ node['home_path'] }}/archives/containers/{{ item.file }}.tar"
   loop:
-    - image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
+    - name: "redis"
+      image: "docker.io/library/redis:{{ version['containers']['redis'] }}"
       file: "docker.io_library_redis_{{ version['containers']['redis'] }}"
-    - image: "ghcr.io/we-promise/sure:{{ version['containers']['sure'] }}"
+    - name: "sure"
+      image: "ghcr.io/we-promise/sure:{{ version['containers']['sure'] }}"
       file: "ghcr.io_we-promise_sure_{{ version['containers']['sure'] }}"
   loop_control:
-    label: "{{ item.file }}"
+    label: "{{ item.name }}"
   register: container_archive_images
 
 - name: Save container archive images

ansible/roles/app/tasks/services/set_vaultwarden.yaml

@@ -8,6 +8,7 @@
     mode: "0770"
   loop:
     - "data/containers/vaultwarden"
+    - "data/containers/vaultwarden/data"
     - "containers/vaultwarden"
     - "containers/vaultwarden/ssl"
 
@@ -34,11 +35,18 @@
       value: "{{ hostvars['console']['vaultwarden']['admin']['hash'] }}"
     - name: "VW_DATABASE_URL"
       value: "postgresql://vaultwarden:{{ hostvars['console']['postgresql']['password']['vaultwarden'] | urlencode | replace('/', '%2F') }}\
-        @{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}/vaultwarden_db?sslmode=verify-full&\
+        @{{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}/vaultwarden_db?sslmode=verify-full&\
         sslrootcert=/etc/ssl/vaultwarden/{{ root_cert_filename }}"
   notify: "notification_restart_vaultwarden"
   no_log: true
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/vaultwarden/server"
+    tag: "{{ version['containers']['vaultwarden'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/vaultwarden/vaultwarden.container.j2"