bk node and refactor

ansible/roles/infra/tasks/services/set_ca_server.yaml

@@ -24,16 +24,20 @@
   notify: "notification_restart_ca"
   no_log: true
 
-- name: Deploy ca config files
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/smallstep/step-ca"
+    tag: "{{ version['containers']['step'] }}"
+    state: "present"
+    pull: true
+
+- name: Deploy ca config file
   ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/config/{{ item }}.j2"
-    dest: "{{ node['home_path'] }}/containers/ca/config/{{ item }}"
+    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ca/config/ca.json.j2"
+    dest: "{{ node['home_path'] }}/containers/ca/config/ca.json"
     owner: "{{ services['ca']['subuid'] }}"
     group: "{{ node['group'] }}"
     mode: "0400"
-  loop:
-    - "ca.json"
-    - "defaults.json"
   become: true
   notify: "notification_restart_ca"
 

ansible/roles/infra/tasks/services/set_grafana.yaml

@@ -68,6 +68,13 @@
   become: true
   notify: "notification_restart_grafana"
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/grafana/grafana"
+    tag: "{{ version['containers']['grafana'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/grafana/grafana.container.j2"

ansible/roles/infra/tasks/services/set_ldap.yaml

@@ -46,7 +46,8 @@
     # urlencode doesn't fix `/` as `%2F`. It needs replace
     - name: "LLDAP_DATABASE_URL"
       value: "postgres://ldap:{{ hostvars['console']['postgresql']['password']['ldap'] | urlencode | replace('/', '%2F') }}\
-        @{{ services['postgresql']['domain'] }}.{{ domain['internal'] }}/ldap_db?sslmode=verify-full&sslrootcert=/etc/ssl/ldap/{{ root_cert_filename }}"
+        @{{ services['postgresql']['domain']['internal'] }}.{{ domain['internal'] }}/\
+        ldap_db?sslmode=verify-full&sslrootcert=/etc/ssl/ldap/{{ root_cert_filename }}"
     - name: "LLDAP_KEY_SEED"
       value: "{{ hostvars['console']['ldap']['seed_key'] }}"
     - name: "LLDAP_JWT_SECRET"
@@ -93,6 +94,13 @@
         name: "LLDAP_LDAP_USER_PASSWORD"
         state: "absent"
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/lldap/lldap"
+    tag: "{{ version['containers']['ldap'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/ldap/ldap.container.j2"

ansible/roles/infra/tasks/services/set_loki.yaml

@@ -48,6 +48,13 @@
   notify: "notification_restart_loki"
   no_log: true
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/grafana/loki"
+    tag: "{{ version['containers']['loki'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/loki/loki.container.j2"

ansible/roles/infra/tasks/services/set_postgresql.yaml

@@ -1,19 +1,19 @@
 ---
+- name: Initialize connected services list
+  ansible.builtin.set_fact:
+    connected_services: []
+
 - name: Set connected services list
   ansible.builtin.set_fact:
-    connected_services:
-      - "ldap"
-      - "grafana"
-      - "authelia"
-      - "vaultwarden"
-      - "gitea"
-      - "immich"
-      - "paperless"
-      - "nextcloud"
-      - "sure"
-      - "outline"
-      - "memos"
-      - "mealie"
+    connected_services: >-
+      {{
+        services
+        | dict2items
+        | selectattr('value.dependency.db', 'defined')
+        | selectattr('value.dependency.db', 'equalto', 'postgresql')
+        | map(attribute='key')
+        | list
+      }}
 
 - name: Create postgresql directory
   ansible.builtin.file:
@@ -39,6 +39,8 @@
     owner: "{{ ansible_user }}"
     group: "{{ node['group'] }}"
     mode: "0640"
+  register: "is_postgresql_containerfile"
+  notify: "notification_restart_postgresql"
 
 - name: Build postgresql container image
   containers.podman.podman_image:
@@ -47,6 +49,7 @@
     tag: "pg{{ version['containers']['postgresql'] }}-vectorchord{{ version['containers']['vectorchord'] }}"
     state: "build"
     path: "{{ node['home_path'] }}/containers/postgresql/build"
+    force: "{{ is_postgresql_containerfile.changed }}"
 
 - name: Prune postgresql dangling images
   containers.podman.podman_prune:
@@ -96,16 +99,33 @@
   become: true
   register: "is_postgresql_init"
 
+- name: Check init directory empty
+  ansible.builtin.find:
+    path: "{{ node['home_path'] }}/containers/postgresql/init/"
+    file_type: "any"
+    patterns:
+      - "*.sql"
+  become: true
+  register: "is_init_dir_empty"
+
+- name: Check pg_cluster.sql on console
+  delegate_to: "console"
+  ansible.builtin.stat:
+    path: "{{ hostvars['console']['node']['data_path'] }}/sql/postgresql/pg_cluster.sql"
+  register: is_console_pg_cluster_sql
+
 - name: Prepare initiating DB
   when:
     - not is_postgresql_init.stat.exists
+    - is_init_dir_empty.matched == 0
+    - is_console_pg_cluster_sql.stat.exists
     - (connected_services | default([]) | length) > 0
   become: true
   block:
     # `init/pg_cluster.sql` should be fetched from postgresql's backup directory before running initiating
     - name: Deploy init cluster sql file
       ansible.builtin.copy:
-        src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_cluster.sql"
+        src: "{{ hostvars['console']['node']['data_path'] }}/sql/postgresql/pg_cluster.sql"
         dest: "{{ node['home_path'] }}/containers/postgresql/init/00_pg_cluster.sql"
         owner: "{{ services['postgresql']['subuid'] }}"
         group: "{{ node['group'] }}"
@@ -113,7 +133,7 @@
 
     - name: Deploy restoring data sql files
       ansible.builtin.copy:
-        src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/postgresql/init/pg_{{ item }}.sql"
+        src: "{{ hostvars['console']['node']['data_path'] }}/sql/postgresql/pg_{{ item }}.sql"
         dest: "{{ node['home_path'] }}/containers/postgresql/init/{{ '%02d' | format(index_num + 1) }}_pg_{{ item }}.sql"
         owner: "{{ services['postgresql']['subuid'] }}"
         group: "{{ node['group'] }}"
@@ -192,8 +212,8 @@
       {{ domain['internal'] }}_{{ node['name'] }}_postgres_\
       pg{{ version['containers']['postgresql'] }}-vectorchord{{ version['containers']['vectorchord'] }}.tar"
     format: "oci-archive"
-    force: false
-  when: not container_archive_images.stat.exists
+    force: "{{ is_postgresql_containerfile.changed }}"
+  when: not container_archive_images.stat.exists or is_postgresql_containerfile.changed
 
 - name: Fetch container archive images
   ansible.builtin.fetch:

ansible/roles/infra/tasks/services/set_prometheus.yaml

@@ -52,6 +52,13 @@
   notify: "notification_restart_prometheus"
   no_log: true
 
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/prom/prometheus"
+    tag: "{{ version['containers']['prometheus'] }}"
+    state: "present"
+    pull: true
+
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/prometheus/prometheus.container.j2"

ansible/roles/infra/tasks/services/set_x509-exporter.yaml

@@ -1,4 +1,20 @@
 ---
+- name: Initialize self-cert services list
+  ansible.builtin.set_fact:
+    cert_services: []
+
+- name: Set self-cert services list
+  ansible.builtin.set_fact:
+    cert_services: >-
+      {{
+        services
+        | dict2items
+        | selectattr('value.dependency.cert', 'defined')
+        | selectattr('value.dependency.cert', 'equalto', true)
+        | map(attribute='key')
+        | list
+      }}
+
 - name: Create x509-exporter directory
   ansible.builtin.file:
     path: "{{ node['home_path'] }}/containers/{{ item }}"
@@ -22,7 +38,7 @@
   become: true
   notify: "notification_restart_x509-exporter"
 
-- name: Deploy certificates
+- name: Deploy CA certificates
   ansible.builtin.copy:
     content: |
       {{ item.value }}
@@ -35,23 +51,31 @@
       value: "{{ hostvars['console']['ca']['root']['crt'] }}"
     - name: "intermediate.crt"
       value: "{{ hostvars['console']['ca']['intermediate']['crt'] }}"
-    - name: "crowdsec.crt"
-      value: "{{ hostvars['console']['crowdsec']['crt'] }}"
-    - name: "blocky.crt"
-      value: "{{ hostvars['console']['blocky']['crt'] }}"
-    - name: "postgresql.crt"
-      value: "{{ hostvars['console']['postgresql']['crt'] }}"
-    - name: "ldap.crt"
-      value: "{{ hostvars['console']['ldap']['crt'] }}"
-    - name: "prometheus.crt"
-      value: "{{ hostvars['console']['prometheus']['crt'] }}"
-    - name: "loki.crt"
-      value: "{{ hostvars['console']['loki']['crt'] }}"
-    - name: "dsm.crt"
-      value: "{{ hostvars['console']['dsm']['crt'] }}"
   become: true
+  notify: "notification_restart_x509-exporter"
   no_log: true
 
+- name: Deploy leaf certificates
+  ansible.builtin.copy:
+    content: |
+      {{ hostvars['console'][item]['crt'] }}
+    dest: "{{ node['home_path'] }}/containers/x509-exporter/certs/{{ item }}.crt"
+    owner: "{{ services['x509-exporter']['subuid'] }}"
+    group: "{{ node['group'] }}"
+    mode: "0440"
+  loop: "{{ cert_services }}"
+  become: true
+  notify: "notification_restart_x509-exporter"
+  no_log: true
+
+- name: Pull image
+  containers.podman.podman_image:
+    name: "docker.io/enix/x509-certificate-exporter"
+    tag: "{{ version['containers']['x509-exporter'] }}"
+    state: "present"
+    pull: true
+
+
 - name: Deploy container file
   ansible.builtin.template:
     src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/x509-exporter.container.j2"