friessn
6c9cd67a08
Replaces the single shared HTTP Basic service-account credential (which caused a production outage from a username mismatch) with per-user login: Keycloak (already running on this VM for gcnm, now also fronted on auth.friessn.de with its own "homekeeper" realm) authenticates the user once via the landing page, FastAPI verifies the OIDC id_token and mints its own signed session JWT as a cookie, and both Shiny apps forward that per-session token as a Bearer credential instead of a static shared one. Authorization is a simple ALLOWED_USERS allowlist; the old auth.users table and bcrypt seeding are gone entirely. Also carries forward the in-progress rootless Podman/Quadlet migration (gitea, homekeeper, podman roles) and fixes a pre-existing bug where each role's handlers were malformed inside tasks/main.yml instead of their own handlers/main.yml, which broke ansible-playbook entirely. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FbiCdckkTX2HyAkyi1R39d
67 lines
2.0 KiB
YAML
67 lines
2.0 KiB
YAML
---
|
|
- name: Install podman
|
|
apt:
|
|
name:
|
|
- podman
|
|
- podman-compose # for ad-hoc use; production uses quadlets
|
|
- slirp4netns # rootless networking / port publishing
|
|
- uidmap # rootless subuid/subgid mapping
|
|
state: present
|
|
update_cache: true
|
|
|
|
# All app data lives in named Podman volumes (created implicitly on first
|
|
# `podman run`/Quadlet start), not host bind mounts — avoids rootless UID
|
|
# mapping headaches. Nothing to pre-create here.
|
|
|
|
- name: Configure Gitea as additional registry
|
|
template:
|
|
src: registries.conf.j2
|
|
dest: /etc/containers/registries.conf.d/gitea.conf
|
|
mode: "0644"
|
|
notify: Restart podman services
|
|
|
|
- name: Login to Gitea container registry
|
|
become_user: "{{ deploy_user }}"
|
|
environment:
|
|
XDG_RUNTIME_DIR: "/run/user/{{ deploy_uid }}"
|
|
command: >
|
|
podman login {{ registry_host }}
|
|
-u {{ registry_user }} -p {{ registry_token }}
|
|
register: login_result
|
|
changed_when: "'Login Succeeded' in login_result.stdout"
|
|
# Run this after Gitea is up and registry_token is set
|
|
|
|
- name: Enable linger for {{ deploy_user }} (user services survive logout/reboot)
|
|
command: "loginctl enable-linger {{ deploy_user }}"
|
|
changed_when: false
|
|
|
|
- name: Enable podman-auto-update timer (user scope)
|
|
become_user: "{{ deploy_user }}"
|
|
environment:
|
|
XDG_RUNTIME_DIR: "/run/user/{{ deploy_uid }}"
|
|
systemd:
|
|
name: podman-auto-update.timer
|
|
enabled: true
|
|
state: started
|
|
scope: user
|
|
daemon_reload: true
|
|
|
|
- name: Override auto-update timer schedule (user scope)
|
|
become_user: "{{ deploy_user }}"
|
|
file:
|
|
path: "/home/{{ deploy_user }}/.config/systemd/user/podman-auto-update.timer.d"
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Deploy auto-update timer schedule override
|
|
become_user: "{{ deploy_user }}"
|
|
copy:
|
|
dest: "/home/{{ deploy_user }}/.config/systemd/user/podman-auto-update.timer.d/override.conf"
|
|
content: |
|
|
[Timer]
|
|
OnCalendar=
|
|
OnCalendar={{ autoupdate_schedule }}
|
|
AccuracySec=1s
|
|
mode: "0644"
|
|
notify: Reload user systemd
|