Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
108 lines
3.3 KiB
YAML
108 lines
3.3 KiB
YAML
---
|
|
- name: Get home directory for {{ ansible_user }}
|
|
ansible.builtin.getent:
|
|
database: passwd
|
|
key: "{{ ansible_user }}"
|
|
|
|
- name: Set user home directory fact
|
|
ansible.builtin.set_fact:
|
|
user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"
|
|
|
|
- name: Create Radarr project directory
|
|
ansible.builtin.file:
|
|
path: "{{ podman_projects_dir | default('/opt/podman') }}/radarr"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Create Radarr state directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0750"
|
|
loop:
|
|
- "{{ radarr_config_dir }}"
|
|
- "{{ radarr_downloads_dir }}"
|
|
|
|
- name: Get current Radarr image ID
|
|
ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ radarr_image }}:{{ radarr_version }}"
|
|
register: radarr_image_before
|
|
failed_when: false # image may not exist yet on first deploy
|
|
changed_when: false
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
|
|
- name: Pull Radarr container image
|
|
ansible.builtin.command: "podman pull --quiet {{ radarr_image }}:{{ radarr_version }}"
|
|
register: radarr_pull
|
|
changed_when: radarr_pull.stdout != radarr_image_before.stdout
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
notify: Restart Radarr
|
|
|
|
- name: Deploy Kubernetes YAML for Radarr
|
|
ansible.builtin.template:
|
|
src: radarr.yaml.j2
|
|
dest: "{{ podman_projects_dir | default('/opt/podman') }}/radarr/radarr.yaml"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0644"
|
|
notify: Restart Radarr
|
|
|
|
- name: Create systemd user directory for Radarr
|
|
ansible.builtin.file:
|
|
path: "{{ user_home_dir }}/.config/systemd/user"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Create systemd service for Radarr (user scope)
|
|
ansible.builtin.template:
|
|
src: radarr.service.j2
|
|
dest: "{{ user_home_dir }}/.config/systemd/user/radarr.service"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0644"
|
|
notify: Reload systemd user
|
|
|
|
- name: Enable lingering for user {{ ansible_user }}
|
|
ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
|
|
changed_when: false
|
|
when: ansible_user != 'root'
|
|
|
|
- name: Enable and start Radarr service (user scope)
|
|
ansible.builtin.systemd:
|
|
name: radarr.service
|
|
enabled: true
|
|
state: started
|
|
scope: user
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
|
|
- name: Provision TLS certificate for Radarr
|
|
ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
|
|
vars:
|
|
certbot_hostname: "{{ radarr_nginx_hostname }}"
|
|
when: radarr_nginx_enabled and radarr_nginx_letsencrypt
|
|
|
|
- name: Deploy nginx vhost configuration for Radarr
|
|
ansible.builtin.template:
|
|
src: nginx-vhost.conf.j2
|
|
dest: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/radarr.conf"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: radarr_nginx_enabled
|
|
notify: Reload nginx
|
|
|
|
- name: Remove nginx vhost configuration for Radarr
|
|
ansible.builtin.file:
|
|
path: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/radarr.conf"
|
|
state: absent
|
|
when: not radarr_nginx_enabled
|
|
notify: Reload nginx
|