Roles for caddy as well as isso

Signed-off-by: Nis Wechselberg <enbewe@enbewe.de>

roles/caddy/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+caddy_podman_image_name: 'docker.io/library/caddy'
+caddy_podman_image_tag: 'latest'
+
+caddy_conf_path: '/etc/caddy'
+
+caddy_use_local_certs: false

roles/caddy/handlers/main.yml

@@ -0,0 +1,23 @@
+---
+- name: 'Reload caddy services'
+  become: true
+  ansible.builtin.service:
+    daemon-reload: true
+
+- name: 'Restart caddy image'
+  become: true
+  ansible.builtin.service:
+    name: 'caddy-image.service'
+    state: 'restarted'
+
+- name: 'Restart caddy volume'
+  become: true
+  ansible.builtin.service:
+    name: 'caddy-data-volume.service'
+    state: 'restarted'
+
+- name: 'Restart caddy container'
+  become: true
+  ansible.builtin.service:
+    name: 'caddy.service'
+    state: 'restarted'

roles/caddy/tasks/main.yml

@@ -0,0 +1,64 @@
+---
+- name: 'Ensure required software is installed'
+  become: true
+  ansible.builtin.apt:
+    name: 'podman'
+    state: 'present'
+
+- name: 'Define caddy image'
+  become: true
+  containers.podman.podman_image:
+    name: '{{ caddy_podman_image_name }}:{{ caddy_podman_image_tag }}'
+    state: 'quadlet'
+  notify:
+    - 'Reload caddy services'
+    - 'Restart caddy image'
+
+- name: 'Define caddy data volume'
+  become: true
+  containers.podman.podman_volume:
+    name: 'caddy-data'
+    state: 'quadlet'
+  notify:
+    - 'Reload caddy services'
+    - 'Restart caddy volume'
+
+- name: 'Create caddy conf directory'
+  become: true
+  ansible.builtin.file:
+    name: '{{ caddy_conf_path }}'
+    state: 'directory'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rwx,g=rx,o=rx'
+
+- name: 'Generate Caddyfile'
+  become: true
+  ansible.builtin.template:
+    src: 'Caddyfile.j2'
+    dest: '{{ caddy_conf_path }}/Caddyfile'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rw,g=r,o=r'
+  notify:
+    - 'Restart caddy container'
+
+- name: 'Create caddy container'
+  become: true
+  containers.podman.podman_container:
+    name: 'caddy'
+    image: 'caddy.image'
+    network: '{{ caddy_networks }}'
+    state: 'quadlet'
+    volume:
+      - '{{ caddy_conf_path }}:/etc/caddy'
+      - 'caddy-data.volume:/data'
+    publish:
+      - '80:80'
+      - '443:443'
+    quadlet_options: |
+      [Install]
+      WantedBy=default.target
+  notify:
+    - 'Reload caddy services'
+    - 'Restart caddy container'

roles/caddy/templates/Caddyfile.j2

@@ -0,0 +1,17 @@
+{% if caddy_use_local_certs %}
+{
+    local_certs
+}
+{% endif %}
+
+{% for site in caddy_sites %}
+{{ site.name }} {
+{% if site.directives is defined %}
+    {{ site.directives | indent }}
+{% endif %}
+{% if site.proxy_to is defined %}
+    reverse_proxy {{ site.proxy_to }}
+{% endif %}
+}
+
+{% endfor %}

roles/isso/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+isso_image_name: 'ghcr.io/isso-comments/isso'
+isso_image_tag: 'release'
+
+isso_storage_path: '/srv/www/isso'

roles/isso/handlers/main.yml

@@ -0,0 +1,17 @@
+---
+- name: 'Reload isso services'
+  become: true
+  ansible.builtin.service:
+    daemon-reload: true
+
+- name: 'Restart isso image'
+  become: true
+  ansible.builtin.service:
+    name: 'isso-image.service'
+    state: 'restarted'
+
+- name: 'Restart isso container'
+  become: true
+  ansible.builtin.service:
+    name: 'isso.service'
+    state: 'restarted'

roles/isso/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+- name: 'Ensure required software is installed'
+  become: true
+  ansible.builtin.apt:
+    name: 'podman'
+    state: 'present'
+
+- name: 'Create podman network'
+  become: true
+  containers.podman.podman_network:
+    name: '{{ isso_network }}'
+    ipv6: true
+    state: 'quadlet'
+
+- name: 'Define isso image'
+  become: true
+  containers.podman.podman_image:
+    name: '{{ isso_image_name }}:{{ isso_image_tag }}'
+    state: 'quadlet'
+  notify:
+    - 'Reload isso services'
+    - 'Restart isso image'
+
+- name: 'Prepare isso data directories'
+  become: true
+  ansible.builtin.file:
+    name: '{{ item }}'
+    state: 'directory'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rwx,g=rx,o=rx'
+  loop:
+    - '{{ isso_storage_path }}/data'
+    - '{{ isso_storage_path }}/cfg'
+
+- name: 'Write isso configuration'
+  become: true
+  ansible.builtin.template:
+    src: 'isso.cfg.j2'
+    dest: '{{ isso_storage_path }}/cfg/isso.cfg'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rw,g=r,o=r'
+  notify:
+    - 'Restart isso container'
+
+- name: 'Create caddy container'
+  become: true
+  containers.podman.podman_container:
+    name: 'isso'
+    image: 'isso.image'
+    network: '{{ isso_network }}.network'
+    state: 'quadlet'
+    volume:
+      - '{{ isso_storage_path }}/data:/db'
+      - '{{ isso_storage_path }}/cfg:/config'
+    quadlet_options: |
+      [Install]
+      WantedBy=default.target
+  notify:
+    - 'Reload isso services'
+    - 'Restart isso container'

roles/isso/templates/isso.cfg.j2

@@ -0,0 +1,88 @@
+[general]
+; file location to the SQLite3 database
+dbpath = /db/isso.db
+;required to dispatch multiple websites, not used otherwise
+name = isso
+; Your website(s)
+; If Isso is unable to connect to at least on site, you’ll get a warning during startup and comments are most likely non-functional.
+host =
+    {{ isso_cfg_host }}
+; time range that allows users to edit/remove their own comments
+max-age = 15m
+; Select notification backend(s) for new comments, separated by comma. Available backends: stdout, smtp
+notify = smtp
+; Log console messages to file instead of standard out.
+log-file =
+
+[moderation]
+; enable comment moderation queue
+enabled = true
+; remove unprocessed comments in moderation queue after given time
+purge-after = 30d
+
+[server]
+; interface to listen on. Isso supports TCP/IP and unix domain sockets:
+; Does not apply for uWSGI.
+listen = http://localhost:8080
+; reload application, when the source code has changed.
+; Useful for development. Only works with the internal webserver.
+reload = off
+; show 10 most time consuming function in Isso after each request.
+; Do not use in production.
+profile = off
+
+[smtp]
+; self-explanatory, optional
+username = {{ isso_mail_username }}
+; self-explanatory (yes, plain text, create a dedicated account for notifications), optional.
+password = {{ isso_mail_password }}
+; SMTP server
+host = {{ isso_mail_host }}
+; SMTP port
+port = {{ isso_mail_port }}
+; use a secure connection to the server, possible values: none, starttls or ssl
+security = {{ isso_mail_security }}
+; recipient address, e.g. your email address
+to = {{ isso_mail_rcpt }}
+; sender address, e.g. “Foo Bar” <isso@example.tld>
+from = {{ isso_mail_from }}
+; specify a timeout in seconds for blocking operations like the connection attempt.
+timeout = 10
+
+[guard]
+; enable guard, recommended in production. Not useful for debugging purposes.
+enabled = true
+; limit to N new comments per minute.
+ratelimit = 2
+; how many comments directly to the thread
+direct-reply = 3
+; allow commenters to reply to their own comments when they could still edit the comment.
+; After the editing timeframe is gone, commenters can reply to their own comments anyways.
+reply-to-self = true
+; force commenters to enter a value into the author field. No validation is performed on the provided value.
+require-author = true
+; force commenters to enter a value into the email field. No validation is performed on the provided value.
+require-email = true
+
+[markup]
+; Misaka-specific Markdown extensions, all flags starting with EXT_ can be used there, separated by comma.
+options = strikethrough, superscript, autolink
+; Additional HTML tags to allow in the generated output, comma-separated.
+; By default, only a, blockquote, br, code, del, em, h1, h2, h3, h4, h5, h6, hr,
+; ins, li, ol, p, pre, strong, table, tbody, td, th, thead and ul are allowed.
+allowed-elements =
+; Additional HTML attributes (independent from elements) to allow in the generated output,
+; comma-separated. By default, only align and href are allowed.
+allowed-attributes =
+
+[hash]
+; A salt is used to protect against rainbow tables. Isso does not make use of pepper (yet).
+; The default value has been in use since the release of Isso and generates the 
+; same identicons for same addresses across installations.
+salt = Eech7co8Ohloopo9Ol6baimi
+; Hash algorithm to use – either from Python’s hashlib or PBKDF2
+algorithm = pbkdf2
+
+[admin]
+enabled = {{ isso_admin_enabled }}
+password = {{ isso_admin_password }}

roles/static/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+static_caddy_image_name: 'docker.io/library/caddy'
+static_caddy_image_tag: 'latest'

roles/static/handlers/main.yml

@@ -0,0 +1,11 @@
+---
+- name: 'Reload caddy services'
+  become: true
+  ansible.builtin.service:
+    daemon-reload: true
+
+- name: 'Restart caddy image'
+  become: true
+  ansible.builtin.service:
+    name: 'caddy-image.service'
+    state: 'restarted'

roles/static/tasks/deploy_static_site.yml

@@ -0,0 +1,93 @@
+---
+- name: 'Create site network'
+  become: true
+  containers.podman.podman_network:
+    name: '{{ item.network }}'
+    ipv6: true
+    state: 'quadlet'
+
+- name: 'Define caddy image'
+  become: true
+  containers.podman.podman_image:
+    name: '{{ static_caddy_image_name }}:{{ static_caddy_image_tag }}'
+    state: 'quadlet'
+  notify:
+    - 'Reload caddy services'
+    - 'Restart caddy image'
+
+- name: 'Define site data volume'
+  become: true
+  containers.podman.podman_volume:
+    name: '{{ item.volume }}'
+    state: 'quadlet'
+  notify:
+    - 'Reload caddy services'
+  register: 'static_caddy_volume_changed'
+
+- name: 'Clean the handlers'
+  ansible.builtin.meta: 'flush_handlers'
+
+- name: 'Restart caddy static volume'
+  become: true
+  when: 'static_caddy_volume_changed.changed' # noqa: no-handler
+  ansible.builtin.service:
+    name: '{{ item.volume }}-volume.service'
+    state: 'restarted'
+
+- name: 'Create target directory for site data'
+  become: true
+  ansible.builtin.file:
+    name: '/srv/www/{{ item.name }}'
+    state: 'directory'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rwx,g=rx,o=rx'
+
+- name: 'Download site data archive from url'
+  become: true
+  when: 'not ansible_check_mode'
+  ansible.builtin.get_url:
+    dest: '{{ item.tempfile }}'
+    url: '{{ item.archive_url }}'
+    url_username: '{{ item.archive_username }}'
+    url_password: '{{ item.archive_password }}'
+    force_basic_auth: true
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rw,g=,o='
+  register: 'static_caddy_download_data'
+
+- name: 'Unarchive site data'
+  when: 'static_caddy_download_data.changed' # noqa: no-handler
+  become: true
+  ansible.builtin.unarchive:
+    src: '{{ item.tempfile }}'
+    dest: '/srv/www/{{ item.name }}'
+    remote_src: true
+
+- name: 'Create site container'
+  become: true
+  containers.podman.podman_container:
+    name: 'caddy-static-{{ item.name }}'
+    image: 'caddy.image'
+    network: '{{ item.network }}.network'
+    state: 'quadlet'
+    volume:
+      - '/srv/www/{{ item.name }}/:/usr/share/caddy/'
+      - '{{ item.volume }}.volume:/data'
+    quadlet_options: |
+      [Install]
+      WantedBy=default.target
+  notify:
+    - 'Reload caddy services'
+  register: 'static_caddy_container_create'
+
+- name: 'Clean the handlers'
+  ansible.builtin.meta: 'flush_handlers'
+
+- name: 'Restart caddy container'
+  when: 'static_caddy_container_create.changed' # noqa: no-handler
+  become: true
+  ansible.builtin.service:
+    name: 'caddy-static-{{ item.name }}.service'
+    state: 'restarted'

roles/static/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+- name: 'Ensure required software is installed'
+  become: true
+  ansible.builtin.apt:
+    name: '{{ item }}'
+    state: 'present'
+  loop:
+    - 'podman'
+    - 'unzip'
+
+- name: 'Deploy static sites'
+  ansible.builtin.include_tasks: 'deploy_static_site.yml'
+  loop: '{{ static_caddy_sites }}'