Roles for caddy as well as isso

Signed-off-by: Nis Wechselberg <enbewe@enbewe.de>

roles/isso/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+isso_image_name: 'ghcr.io/isso-comments/isso'
+isso_image_tag: 'release'
+
+isso_storage_path: '/srv/www/isso'

roles/isso/handlers/main.yml

@@ -0,0 +1,17 @@
+---
+- name: 'Reload isso services'
+  become: true
+  ansible.builtin.service:
+    daemon-reload: true
+
+- name: 'Restart isso image'
+  become: true
+  ansible.builtin.service:
+    name: 'isso-image.service'
+    state: 'restarted'
+
+- name: 'Restart isso container'
+  become: true
+  ansible.builtin.service:
+    name: 'isso.service'
+    state: 'restarted'

roles/isso/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+- name: 'Ensure required software is installed'
+  become: true
+  ansible.builtin.apt:
+    name: 'podman'
+    state: 'present'
+
+- name: 'Create podman network'
+  become: true
+  containers.podman.podman_network:
+    name: '{{ isso_network }}'
+    ipv6: true
+    state: 'quadlet'
+
+- name: 'Define isso image'
+  become: true
+  containers.podman.podman_image:
+    name: '{{ isso_image_name }}:{{ isso_image_tag }}'
+    state: 'quadlet'
+  notify:
+    - 'Reload isso services'
+    - 'Restart isso image'
+
+- name: 'Prepare isso data directories'
+  become: true
+  ansible.builtin.file:
+    name: '{{ item }}'
+    state: 'directory'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rwx,g=rx,o=rx'
+  loop:
+    - '{{ isso_storage_path }}/data'
+    - '{{ isso_storage_path }}/cfg'
+
+- name: 'Write isso configuration'
+  become: true
+  ansible.builtin.template:
+    src: 'isso.cfg.j2'
+    dest: '{{ isso_storage_path }}/cfg/isso.cfg'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rw,g=r,o=r'
+  notify:
+    - 'Restart isso container'
+
+- name: 'Create caddy container'
+  become: true
+  containers.podman.podman_container:
+    name: 'isso'
+    image: 'isso.image'
+    network: '{{ isso_network }}.network'
+    state: 'quadlet'
+    volume:
+      - '{{ isso_storage_path }}/data:/db'
+      - '{{ isso_storage_path }}/cfg:/config'
+    quadlet_options: |
+      [Install]
+      WantedBy=default.target
+  notify:
+    - 'Reload isso services'
+    - 'Restart isso container'

roles/isso/templates/isso.cfg.j2

@@ -0,0 +1,88 @@
+[general]
+; file location to the SQLite3 database
+dbpath = /db/isso.db
+;required to dispatch multiple websites, not used otherwise
+name = isso
+; Your website(s)
+; If Isso is unable to connect to at least on site, you’ll get a warning during startup and comments are most likely non-functional.
+host =
+    {{ isso_cfg_host }}
+; time range that allows users to edit/remove their own comments
+max-age = 15m
+; Select notification backend(s) for new comments, separated by comma. Available backends: stdout, smtp
+notify = smtp
+; Log console messages to file instead of standard out.
+log-file =
+
+[moderation]
+; enable comment moderation queue
+enabled = true
+; remove unprocessed comments in moderation queue after given time
+purge-after = 30d
+
+[server]
+; interface to listen on. Isso supports TCP/IP and unix domain sockets:
+; Does not apply for uWSGI.
+listen = http://localhost:8080
+; reload application, when the source code has changed.
+; Useful for development. Only works with the internal webserver.
+reload = off
+; show 10 most time consuming function in Isso after each request.
+; Do not use in production.
+profile = off
+
+[smtp]
+; self-explanatory, optional
+username = {{ isso_mail_username }}
+; self-explanatory (yes, plain text, create a dedicated account for notifications), optional.
+password = {{ isso_mail_password }}
+; SMTP server
+host = {{ isso_mail_host }}
+; SMTP port
+port = {{ isso_mail_port }}
+; use a secure connection to the server, possible values: none, starttls or ssl
+security = {{ isso_mail_security }}
+; recipient address, e.g. your email address
+to = {{ isso_mail_rcpt }}
+; sender address, e.g. “Foo Bar” <isso@example.tld>
+from = {{ isso_mail_from }}
+; specify a timeout in seconds for blocking operations like the connection attempt.
+timeout = 10
+
+[guard]
+; enable guard, recommended in production. Not useful for debugging purposes.
+enabled = true
+; limit to N new comments per minute.
+ratelimit = 2
+; how many comments directly to the thread
+direct-reply = 3
+; allow commenters to reply to their own comments when they could still edit the comment.
+; After the editing timeframe is gone, commenters can reply to their own comments anyways.
+reply-to-self = true
+; force commenters to enter a value into the author field. No validation is performed on the provided value.
+require-author = true
+; force commenters to enter a value into the email field. No validation is performed on the provided value.
+require-email = true
+
+[markup]
+; Misaka-specific Markdown extensions, all flags starting with EXT_ can be used there, separated by comma.
+options = strikethrough, superscript, autolink
+; Additional HTML tags to allow in the generated output, comma-separated.
+; By default, only a, blockquote, br, code, del, em, h1, h2, h3, h4, h5, h6, hr,
+; ins, li, ol, p, pre, strong, table, tbody, td, th, thead and ul are allowed.
+allowed-elements =
+; Additional HTML attributes (independent from elements) to allow in the generated output,
+; comma-separated. By default, only align and href are allowed.
+allowed-attributes =
+
+[hash]
+; A salt is used to protect against rainbow tables. Isso does not make use of pepper (yet).
+; The default value has been in use since the release of Isso and generates the 
+; same identicons for same addresses across installations.
+salt = Eech7co8Ohloopo9Ol6baimi
+; Hash algorithm to use – either from Python’s hashlib or PBKDF2
+algorithm = pbkdf2
+
+[admin]
+enabled = {{ isso_admin_enabled }}
+password = {{ isso_admin_password }}