Clément Désiles
5efc0b0d6e
certbot cannot issue for internal hostnames (*.nas.local), which made nginx-enabled services with internal names fail on deploy. Add a <service>_nginx_letsencrypt flag (default false) and computed <service>_nginx_ssl_certificate/_key paths: when off the vhost uses the shared self-signed cert (nginx_default_ssl_cert), when on it uses the Let's Encrypt lineage. Gate the certbot include on the flag and apply the pattern to all service roles (deluge, fdroid, gitea, grafana, immich, metabase, ntfy, prowlarr, radarr, seerr, static_web, uptime_kuma).
105 lines
3.2 KiB
YAML
105 lines
3.2 KiB
YAML
---
|
|
- name: Get home directory for {{ ansible_user }}
|
|
ansible.builtin.getent:
|
|
database: passwd
|
|
key: "{{ ansible_user }}"
|
|
|
|
- name: Set user home directory fact
|
|
ansible.builtin.set_fact:
|
|
user_home_dir: "{{ ansible_facts['getent_passwd'][ansible_user][4] }}"
|
|
|
|
- name: Create Seerr project directory
|
|
ansible.builtin.file:
|
|
path: "{{ podman_projects_dir | default('/opt/podman') }}/seerr"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Create Seerr state directory
|
|
ansible.builtin.file:
|
|
path: "{{ seerr_config_dir }}"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0750"
|
|
|
|
- name: Get current Seerr image ID
|
|
ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ seerr_image }}:{{ seerr_version }}"
|
|
register: seerr_image_before
|
|
failed_when: false # image may not exist yet on first deploy
|
|
changed_when: false
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
|
|
- name: Pull Seerr container image
|
|
ansible.builtin.command: "podman pull --quiet {{ seerr_image }}:{{ seerr_version }}"
|
|
register: seerr_pull
|
|
changed_when: seerr_pull.stdout != seerr_image_before.stdout
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
notify: Restart Seerr
|
|
|
|
- name: Deploy Kubernetes YAML for Seerr
|
|
ansible.builtin.template:
|
|
src: seerr.yaml.j2
|
|
dest: "{{ podman_projects_dir | default('/opt/podman') }}/seerr/seerr.yaml"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0644"
|
|
notify: Restart Seerr
|
|
|
|
- name: Create systemd user directory for Seerr
|
|
ansible.builtin.file:
|
|
path: "{{ user_home_dir }}/.config/systemd/user"
|
|
state: directory
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Create systemd service for Seerr (user scope)
|
|
ansible.builtin.template:
|
|
src: seerr.service.j2
|
|
dest: "{{ user_home_dir }}/.config/systemd/user/seerr.service"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "0644"
|
|
notify: Reload systemd user
|
|
|
|
- name: Enable lingering for user {{ ansible_user }}
|
|
ansible.builtin.command: "loginctl enable-linger {{ ansible_user }}"
|
|
changed_when: false
|
|
when: ansible_user != 'root'
|
|
|
|
- name: Enable and start Seerr service (user scope)
|
|
ansible.builtin.systemd:
|
|
name: seerr.service
|
|
enabled: true
|
|
state: started
|
|
scope: user
|
|
become: false
|
|
become_user: "{{ ansible_user }}"
|
|
|
|
- name: Provision TLS certificate for Seerr
|
|
ansible.builtin.include_tasks: "{{ role_path }}/../nginx/tasks/certbot.yml"
|
|
vars:
|
|
certbot_hostname: "{{ seerr_nginx_hostname }}"
|
|
when: seerr_nginx_enabled and seerr_nginx_letsencrypt
|
|
|
|
- name: Deploy nginx vhost configuration for Seerr
|
|
ansible.builtin.template:
|
|
src: nginx-vhost.conf.j2
|
|
dest: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/seerr.conf"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: seerr_nginx_enabled
|
|
notify: Reload nginx
|
|
|
|
- name: Remove nginx vhost configuration for Seerr
|
|
ansible.builtin.file:
|
|
path: "{{ nginx_conf_dir | default('/etc/nginx/conf.d') }}/seerr.conf"
|
|
state: absent
|
|
when: not seerr_nginx_enabled
|
|
notify: Reload nginx
|