windmill: Run worker outside of pinp

roles/windmill/tasks/main.yaml

@@ -17,26 +17,46 @@
       DATABASE_URL_FILE: /run/secrets/postgres-url
       MODE: server
     service_additional_containers:
-      - name: worker
+      - name: worker-pinp
         image: quay.io/podman/stable:latest
         user: podman
-        entrypoint: /entrypoint.sh
+        command:
+          - podman
+          - system
+          - service
+          - --time
+          - "0"
+        mounts:
+          - type: volume
+            source: worker-pinp-containers
+            destination: /home/podman/.local/share/containers
+          - type: volume
+            source: worker-pinp-tmp
+            destination: /tmp/storage-run-1000
+          - type: volume
+            source: worker-pinp-run
+            destination: /tmp/storage-run-1000/podman
+      - name: worker
         mounts:
           - type: volume
             source: worker-logs
-            destination: /worker-logs
+            destination: /tmp/windmill/logs
           - type: volume
             source: worker-dependency-cache
-            destination: /worker-dependency-cache
+            destination: /tmp/windmill/cache
-          - type: template
-            source: worker_entrypoint.sh.j2
-            destination: /entrypoint.sh
-            mode: "0755"
           - type: volume
-            source: worker-containers
+            source: worker-pinp-run
-            destination: /home/podman/.local/share/containers
+            destination: /run/podman
-        publish_ports: []
+            readonly: true
-        env: {}
+        env:
+          DATABASE_URL_FILE: /run/secrets/postgres-url
+          DOCKER_HOST: unix:///run/podman/podman.sock
+          MODE: worker
+          WORKER_GROUP: default
+          ENABLE_UNSHARE_PID: "true"
+          UNSHARE_ISOLATION_FLAGS: "--user --map-root-user --pid --fork"
+        wants:
+          - windmill-worker-pinp.service
       - name: worker-native
         env:
           DATABASE_URL_FILE: /run/secrets/postgres-url

roles/windmill/templates/worker_entrypoint.sh.j2

@@ -1,27 +0,0 @@
-#!/bin/bash
-# {{ ansible_managed }}
-_term() {
-	echo "Received SIGTERM, stopping all containers"
-	kill "$child"
-}
-
-podman system service -t 0 &
-
-podman run \
-	--rm \
-	-v /run/secrets/postgres-url:/run/secrets/postgres-url:ro \
-	-e DATABASE_URL_FILE=/run/secrets/postgres-url \
-	-e MODE=worker \
-	-e WORKER_GROUP=default \
-	-e ENABLE_UNSHARE_PID="true" \
-	-e UNSHARE_ISOLATION_FLAGS="--user --map-root-user --pid --fork" \
-	-v /tmp/storage-run-1000/podman/podman.sock:/var/run/docker.sock \
-	-v /worker-logs:/tmp/windmill/logs \
-	-v /worker-dependency-cache:/tmp/windmill/cache \
-	--name worker \
-	--network host \
-	ghcr.io/windmill-labs/windmill:main &
-
-child=$!
-trap _term SIGTERM
-wait "$!"