service: Template file improvements

roles/service/vars/main/mounts.yaml

@@ -26,39 +26,54 @@ _service_container_bind_mounts: >-
     ([ _service_container_socket_mount ] if _service_native_socket else [])
   }}
 
-_service_template_mounts_withdefaults: >-
+_service_template_mounts_hostfiles: >-
+  {{
+    _service_template_mounts
+    | map(attribute='destination')
+    | map('dirname')
+    | map('replace', '/', '_')
+    | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
+    | zip(
+      _service_template_mounts
+      | map(attribute='destination')
+      | map('basename')
+    )
+    | map('path_join')
+    | map('community.general.dict_kv', 'hostfile')
+  }}
+_service_template_mounts_full: >-
   {{
     ([{'readonly': true, 'template_directory': false}] * _service_template_mounts | length)
-    | zip(_service_template_mounts)
+    | zip(
+      _service_template_mounts,
+      _service_template_mounts_hostfiles
+    )
     | map('combine')
   }}
-_service_template_mounts_plain: "{{ _service_template_mounts_withdefaults | rejectattr('template_directory') }}"
+_service_template_mounts_plain: "{{ _service_template_mounts_full | rejectattr('template_directory') }}"
 _service_container_template_mounts_plain: >-
   {{
     _service_template_mounts_plain
-    | community.general.remove_keys(['mode', 'template_validate_command', 'template_directory'])
+    | community.general.remove_keys(['mode', 'template_validate_command', 'template_directory', 'hostfile'])
     | zip(
       _service_template_mounts_plain
-      | map(attribute='source')
-      | map('regex_replace', '\.j2$', '')
-      | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
+      | map(attribute='hostfile')
       | map('community.general.dict_kv', 'source'),
-      ([{'type': 'bind'}] * _service_template_mounts | length)
+      ([{'type': 'bind'}] * _service_template_mounts_plain | length)
     ) |
     map('combine')
   }}
-_service_template_mounts_directory: "{{ _service_template_mounts_withdefaults | selectattr('template_directory') }}"
+_service_template_mounts_directory: "{{ _service_template_mounts_full | selectattr('template_directory') }}"
 _service_container_template_mounts_directory: >-
   {{
     _service_template_mounts_directory
-    | community.general.remove_keys(['mode', 'template_validate_command', 'template_directory'])
+    | community.general.remove_keys(['mode', 'template_validate_command', 'template_directory', 'hostfile'])
     | zip(
       _service_template_mounts_directory
-      | map(attribute='destination')
-      | map('replace', '/', '_')
-      | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
+      | map(attribute='hostfile')
+      | map('dirname')
       | map('community.general.dict_kv', 'source'),
-      ([{'type': 'bind'}] * _service_template_mounts | length)
+      ([{'type': 'bind'}] * _service_template_mounts_directory | length)
     )
     | map('combine')
     | unique
@@ -93,57 +108,38 @@ _service_container_mounts: >-
 _service_all_template_mounts: >-
   {{
     (
-      _service_template_mounts +
-      (
-        _service_additional_containers |
-        map(attribute='mounts', default=[]) |
-        flatten
+      _service_template_mounts
+      + (
+        _service_additional_containers
+        | map(attribute='mounts', default=[])
+        | flatten
       )
-    ) |
-      selectattr('type', '==', 'template') |
-      unique
-  }}
-_service_all_template_mounts_withdefaults: >-
-  {{
-    ([{'readonly': true, 'template_directory': false}] * _service_all_template_mounts | length)
-    | zip(_service_all_template_mounts)
-    | map('combine')
-  }}
-_service_all_template_mounts_plain: "{{ _service_all_template_mounts_withdefaults | rejectattr('template_directory') }}"
-_service_all_template_mounts_directory: "{{ _service_all_template_mounts_withdefaults | selectattr('template_directory') }}"
-_service_all_template_mount_directories: >-
-  {{
-    (
-      _service_all_template_mounts_plain
-      | map(attribute='source')
-      | map('dirname')
-      | unique
-      | select('!=', '')
-    ) + (
-      _service_all_template_mounts_directory
-      | map(attribute='destination')
-      | map('replace', '/', '_')
     )
+    | selectattr('type', '==', 'template')
+    | unique
   }}
 _service_all_template_mount_host_files: >-
   {{
-    (
-      _service_all_template_mounts_plain
-      | map(attribute='source')
-      | map('regex_replace', '\.j2$', '')
-      | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
-    ) + (
-      _service_all_template_mounts_directory
+    _service_all_template_mounts
+    | map(attribute='destination')
+    | map('dirname')
+    | map('replace', '/', '_')
+    | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
+    | zip(
+      _service_all_template_mounts
       | map(attribute='destination')
-      | map('replace', '/', '_')
-      | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
-      | zip(
-        _service_all_template_mounts_directory
-        | map(attribute='source')
-        | map('regex_replace', '\.j2$', '')
-      ) | map('path_join')
+      | map('basename')
     )
-
+    | map('path_join')
+  }}
+_service_all_template_mounts_full: >-
+  {{
+    ([{'readonly': true, 'template_directory': false}] * _service_all_template_mounts | length)
+    | zip(
+      _service_all_template_mounts,
+      _service_all_template_mount_host_files | map('community.general.dict_kv', 'hostfile')
+    )
+    | map('combine')
   }}
 
 _service_all_copy_mounts: >-
@@ -161,7 +157,7 @@ _service_all_copy_mounts: >-
   }}
 _service_all_copy_mount_host_files: >-
   {{
-    _service_all_copy_mounts |
-      map(attribute='source') |
-      map('regex_replace', '^', _service_host_directory ~ '/mounts/')
+    _service_all_copy_mounts
+    | map(attribute='source')
+    | map('regex_replace', '^', _service_host_directory ~ '/mounts/')
   }}

roles/service/vars/main/secrets.yaml

@@ -2,34 +2,34 @@
 _service_container_secrets: >-
   {{
     service_container_secrets
+    | map(attribute='name')
+    | map('community.general.dict_kv', 'target')
+    | zip(
+      service_container_secrets,
+      service_container_secrets
       | map(attribute='name')
-      | map('community.general.dict_kv', 'target')
-      | zip(
-        service_container_secrets,
-        service_container_secrets
-          | map(attribute='name')
-          | map('regex_replace', '^', service_name ~ '-')
-          | map('community.general.dict_kv', 'name')
-        )
-      | map('combine')
-      + (
-        [{
-          'name': _service_database_name,
-          'type': service_database_secret_type,
-          'target': service_database_secret_target
-        }] if _service_setup_database else []
-      )
-      + (
-        [{
-          'name': _service_database_name ~ '-url',
-          'value':
-            'postgres://'
-            ~ service_name | replace('-', '_')
-            ~ ':' ~ service_podman_secrets[service_name ~ '-postgres']
-            ~ '@postgres/' ~ service_name | replace('-', '_')
-            ~ '?sslmode=disable',
-          'type': service_database_secret_type,
-          'target': service_database_secret_target ~ '-url'
-        }] if service_podman_secrets[service_name ~ '-postgres'] is defined else []
-      )
+      | map('regex_replace', '^', service_name ~ '-')
+      | map('community.general.dict_kv', 'name')
+    )
+    | map('combine')
+    + (
+      [{
+        'name': _service_database_name,
+        'type': service_database_secret_type,
+        'target': service_database_secret_target
+      }] if _service_setup_database else []
+    )
+    + (
+      [{
+        'name': _service_database_name ~ '-url',
+        'value':
+          'postgres://'
+          ~ service_name | replace('-', '_')
+          ~ ':' ~ service_podman_secrets[service_name ~ '-postgres']
+          ~ '@postgres/' ~ service_name | replace('-', '_')
+          ~ '?sslmode=disable',
+        'type': service_database_secret_type,
+        'target': service_database_secret_target ~ '-url'
+      }] if service_podman_secrets[service_name ~ '-postgres'] is defined else []
+    )
   }}

roles/service/vars/main/template_validate.yaml

@@ -0,0 +1,24 @@
+---
+_service_template_validate_secrets: >-
+  {{
+    _service_container_secrets
+    | map(attribute='name')
+    | zip(
+      _service_container_secrets
+      | community.general.remove_keys(['name', 'value', 'length'])
+      | map('items')
+      | map('map', 'join', '=')
+      | map('join', ',')
+    )
+    | map('join', ',')
+    | map('regex_replace', '^', '--secret ')
+    | join(' ')
+  }}
+
+_service_template_validate_command: >-
+  podman run --rm
+  -v %s:{{ item.destination }}:ro
+  --entrypoint {{ item.template_validate_command.split(' ', 1)[0] }}
+  {{ _service_template_validate_secrets }}
+  {{ service_container_image }}
+  {{ item.template_validate_command.split(' ', 1)[1] }}