service: Validation, set default for mounts in additional containers

roles/container/defaults/main.yaml

@@ -1,5 +1,6 @@
 ---
 container_command: []
+container_entrypoint: ""
 container_user: ""
 container_mounts: []
 container_publish_ports: []
@@ -11,6 +12,3 @@ container_auto_start: true
 container_auto_update: true
 container_requires: []
 container_wants: []
-container_image_creds:
-  username: ""
-  password: ""

roles/container/meta/argument_specs.yaml

@@ -13,6 +13,11 @@ argument_specs:
         required: false
         default: []
         elements: str
+      container_entrypoint:
+        description: Entrypoint to use for the continaer
+        type: str
+        required: false
+        default: ""
       container_user:
         description: The UID to run as inside the container
         type: str
@@ -23,22 +28,6 @@ argument_specs:
         description: "The image to run in the container, in FQIN format (registry/imagename:tag)"
         type: str
         required: true
-      container_image_creds:
-        description: Credentials used to authenticate with the registry
-        type: dict
-        required: false
-        default:
-          username: ""
-          password: ""
-        options:
-          username:
-            description: Username
-            type: str
-            required: true
-          password:
-            description: Password
-            type: str
-            required: true
 
       container_mounts:
         description: List of bind mounts or volumes to be mounted inside the container.

roles/container/tasks/main.yaml

@@ -7,7 +7,6 @@
     name: image
   vars:
     image_name: "{{ container_image }}"
-    image_creds: "{{ container_image_creds }}"
   when: image_created_images is not defined or container_image not in image_created_images
 
 - name: Create networks for container {{ container_name }}
@@ -15,11 +14,8 @@
     name: network
   vars:
     network_name: "{{ network }}"
-    network_subnet: >-
+    network_subnet: "{{ _container_network_subnet if network_index == 0 else '' }}"
-      {{
+    network_range: "{{ _container_network_range if network_index == 0 else '' }}"
-        container_ip | ansible.utils.ipsubnet(24)
-        if (container_ip | length > 0 and network_index == 0) else ''
-      }}
   when: network_created_networks is not defined or network not in network_created_networks
   loop: "{{ container_networks }}"
   loop_control:
@@ -44,17 +40,19 @@
   ansible.builtin.include_tasks: secrets.yaml
   when: container_secrets | length > 0
 
-- name: Create container service {{ container_name }}
+- name: Create container {{ container_name }}
   containers.podman.podman_container:
     image: "{{ _container_image }}"
     name: "{{ container_name }}"
     command: "{{ container_command or omit }}"
+    entrypoint: "{{ container_entrypoint or omit }}"
     user: "{{ container_user or omit }}"
     mount: "{{ _container_mounts | map('items') | map('map', 'join', '=') | map('join', ',') }}"
     network: "{{ _container_networks_with_ip }}"
     publish: "{{ container_publish_ports }}"
     secrets: "{{ _container_secrets }}"
     env: "{{ container_env }}"
+    label: "{{ _container_labels if _container_labels | length > 0 else omit }}"
     state: quadlet
     quadlet_file_mode: "0600"
     quadlet_options: "{{ _container_quadlet_options }}"

roles/container/vars/main.yaml

@@ -11,6 +11,22 @@ _container_networks_with_ip: >-
     ]
     + _container_networks[1:]
   }}
+_container_network_subnet: >-
+  {{ container_ip | ansible.utils.ipsubnet(24) if container_ip | length > 0 else '' }}
+_container_network_subnet_ranges: >-
+  {{
+    [
+      _container_network_subnet | ansible.utils.ipsubnet(25, 0),
+      _container_network_subnet | ansible.utils.ipsubnet(25, 1)
+    ] if container_ip | length > 0 else ''
+  }}
+_container_network_range: >-
+  {{
+    _container_network_subnet_ranges |
+      reject('ansible.utils.supernet_of', container_ip) |
+      first
+    if container_ip | length > 0 else ''
+  }}
 
 _container_volumes: "{{ container_mounts | selectattr('type', '==', 'volume') }}"
 
@@ -52,6 +68,15 @@ _container_secrets: >-
     | map('join', ',')
   }}
 
+_container_labels: >-
+  {{
+    {'io.containers.autoupdate.authfile': '/etc/containers/auth.json'}
+    if container_auto_update and
+    container_image.split('/')[0] in
+    podman_registry_accounts | map(attribute='registry')
+    else {}
+  }}
+
 _container_quadlet_unit_options: |
   [Unit]
   Description=Container {{ container_name }}

roles/image/defaults/main.yaml

@@ -1,4 +0,0 @@
----
-image_creds:
-  username: ""
-  password: ""

roles/image/meta/argument_specs.yaml

@@ -9,19 +9,3 @@ argument_specs:
         description: "The image FQIN (format registry/imagename:tag)"
         type: str
         required: true
-      image_creds:
-        description: Credentials used to authenticate with the registry
-        type: dict
-        required: false
-        default:
-          username: ""
-          password: ""
-        options:
-          username:
-            description: Username
-            type: str
-            required: true
-          password:
-            description: Password
-            type: str
-            required: true

roles/image/tasks/main.yaml

@@ -6,9 +6,14 @@
 - name: Create container image service {{ image_name }}
   containers.podman.podman_image:
     name: "{{ image_name }}"
-    username: "{{ image_creds.username if image_creds.username | length > 0 else omit }}"
-    password: "{{ image_creds.password if image_creds.password | length > 0 else omit }}"
     state: quadlet
     quadlet_filename: "{{ image_name | replace('/', '_') }}"
     quadlet_file_mode: "0600"
+    quadlet_options: >-
+      {{
+        ['AuthFile=/etc/containers/auth.json']
+        if image_name.split('/')[0] in
+        podman_registry_accounts | map(attribute='registry')
+        else []
+      }}
   notify: Reload systemd daemon

roles/network/defaults/main.yaml

@@ -1,3 +1,4 @@
 ---
 network_driver: bridge
 network_subnet: ""
+network_range: ""

roles/network/meta/argument_specs.yaml

@@ -20,3 +20,8 @@ argument_specs:
         type: str
         required: false
         default: ""
+      network_range:
+        description: Range to allocate ip addresses from
+        type: str
+        required: false
+        default: ""

roles/network/tasks/main.yaml

@@ -6,6 +6,7 @@
     quadlet_file_mode: "0644"
     driver: "{{ network_driver }}"
     subnet: "{{ network_subnet if network_subnet | length > 0 else omit }}"
+    ip_range: "{{ network_range if network_range | length > 0 else omit }}"
     quadlet_options: >-
       {{
         ['Options=parent=' ~ ansible_default_ipv4.interface]

roles/podman/defaults/main.yaml

@@ -0,0 +1,2 @@
+---
+podman_registry_accounts: []

roles/podman/meta/argument_specs.yaml

@@ -2,4 +2,23 @@
 argument_specs:
   main:
     description: Installs podman
-    options: {}
+    options:
+      podman_registry_accounts:
+        description: Dict of accounts for container repositories
+        type: list
+        required: false
+        default: []
+        elements: dict
+        options:
+          registry:
+            description: Registry server to login to
+            type: str
+            required: true
+          username:
+            description: Username
+            type: str
+            required: true
+          password:
+            description: Password / token
+            type: str
+            required: true

roles/podman/tasks/main.yaml

@@ -10,3 +10,12 @@
     name: podman-auto-update.timer
     state: started
     enabled: true
+
+- name: Login to registries
+  containers.podman.podman_login:
+    registry: "{{ item.registry }}"
+    username: "{{ item.username }}"
+    password: "{{ item.password }}"
+    authfile: /etc/containers/auth.json
+  loop: "{{ podman_registry_accounts }}"
+  no_log: true

roles/service/defaults/main.yaml

@@ -1,5 +1,6 @@
 ---
 service_container_command: []
+service_container_entrypoint: ""
 
 service_domains: []
 service_container_http_port: 0
@@ -27,7 +28,3 @@ service_additional_containers: []
 service_requires: []
 service_wants: []
 service_auto_update: true
-
-service_container_image_creds:
-  username: ""
-  password: ""

roles/service/meta/argument_specs.yaml

@@ -14,6 +14,11 @@ argument_specs:
         required: false
         default: []
         elements: str
+      service_container_entrypoint:
+        description: Entrypoint to use in the service container
+        type: str
+        required: false
+        default: ""
 
       service_domains:
         description: A list of domains which should be proxied to the main service container
@@ -66,22 +71,6 @@ argument_specs:
         description: "The image to run in the service container(s), in FQIN format (registry/imagename:tag)."
         type: str
         required: true
-      service_container_image_creds:
-        description: Credentials used to authenticate with the registry
-        type: dict
-        required: false
-        default:
-          username: ""
-          password: ""
-        options:
-          username:
-            description: Username
-            type: str
-            required: true
-          password:
-            description: Password
-            type: str
-            required: true
 
       service_container_user:
         description: The UID to run as inside the container
@@ -150,6 +139,11 @@ argument_specs:
             type: str
             required: false
             default: ""
+          mode:
+            description: Templated file permissions
+            type: str
+            required: false
+            default: "0644"
           volume_device:
             description: >-
               The path of a device which is mounted for the volume.
@@ -315,6 +309,11 @@ argument_specs:
             required: false
             default: "[]"
             elements: str
+          entrypoint:
+            description: Entrypoint to use in the container
+            type: str
+            required: false
+            default: ""
           mounts:
             description: List of bind mounts or volumes to be mounted inside the main service container.
             type: list

roles/service/tasks/additional.yaml

@@ -5,12 +5,13 @@
   vars:
     container_name: "{{ _service_additional_container.name }}"
     container_image: "{{ _service_additional_container.image | default(service_container_image) }}"
-    container_image_creds: "{{ service_container_image_creds }}"
     container_command: "{{ _service_additional_container.command | default([]) }}"
+    container_entrypoint: "{{ _service_additional_container.entrypoint | default('') }}"
     container_user: "{{ service_container_user }}"
     container_mounts: "{{ _service_additional_container_mounts }}"
     container_publish_ports: "{{ _service_additional_container.publish_ports | default([]) }}"
     container_networks: "{{ _service_container_networks }}"
+    container_ip: "{{ _service_additional_container_ip }}"
     container_secrets: "{{ _service_additional_container.secrets | default(_service_container_secrets) }}"
     container_env: "{{ _service_additional_container.env | default(service_container_env) }}"
     container_requires: "{{ _service_container_requires }}"
@@ -19,3 +20,4 @@
   loop: "{{ _service_additional_containers }}"
   loop_control:
     loop_var: _service_additional_container
+    index_var: _service_additional_container_index

roles/service/tasks/database.yaml

@@ -10,6 +10,8 @@
         source: "{{ _service_database_name }}"
         destination: /var/lib/postgresql/data
     container_networks: "{{ _service_database_networks }}"
+    container_ip: >-
+      {{ service_container_ip | ansible.utils.ipmath(1) if _service_static_ip else '' }}
     container_secrets:
       - name: "{{ _service_database_name }}"
         target: "{{ service_database_type }}"

roles/service/tasks/main.yaml

@@ -28,8 +28,8 @@
   vars:
     container_name: "{{ service_name }}"
     container_image: "{{ service_container_image }}"
-    container_image_creds: "{{ service_container_image_creds }}"
     container_command: "{{ service_container_command }}"
+    container_entrypoint: "{{ service_container_entrypoint }}"
     container_user: "{{ service_container_user }}"
     container_mounts: "{{ _service_container_mounts }}"
     container_publish_ports: "{{ service_container_publish_ports }}"
@@ -47,6 +47,8 @@
   vars:
     socat_service_name: "{{ service_name }}"
     socat_target_http_port: "{{ service_container_http_port }}"
+    socat_container_ip: >-
+      {{ service_container_ip | ansible.utils.ipmath(3) if _service_static_ip else '' }}
 
 - name: Reverse proxy for {{ service_name }}
   ansible.builtin.include_tasks: proxy.yaml

roles/service/tasks/oauth2_proxy.yaml

@@ -34,3 +34,4 @@
   vars:
     socat_service_name: "{{ service_name }}-oauth2-proxy"
     socat_target_http_port: 4180
+    socat_container_ip: ""

roles/service/tasks/redis.yaml

@@ -7,4 +7,6 @@
     container_image: docker.io/valkey/valkey:alpine
     container_networks:
       - "{{ service_name }}"
+    container_ip: >-
+      {{ service_container_ip | ansible.utils.ipmath(2) if _service_static_ip else '' }}
     container_auto_update: "{{ service_auto_update }}"

roles/service/tasks/socat.yaml

@@ -18,6 +18,7 @@
     container_user: nobody
     container_networks:
       - "{{ socat_service_name }}"
+    container_ip: "{{ socat_container_ip }}"
     container_requires:
       - "{{ socat_service_name }}-socat.socket"
       - "{{ socat_service_name }}.service"

roles/service/tasks/templates.yaml

@@ -22,6 +22,6 @@
   ansible.builtin.template:
     src: "{{ item[0].source }}"
     dest: "{{ item[1] }}"
-    mode: "0644"
+    mode: "{{ item[0].mode | default('0644') }}"
   notify: Restart container service {{ service_name }}
   loop: "{{ _service_all_template_mounts | zip(_service_all_template_mount_host_files) }}"

roles/service/tasks/validation.yaml

@@ -1,4 +1,9 @@
 ---
+- name: Fail if service_name is empty
+  ansible.builtin.fail:
+    msg: service_name must not be empty
+  when: service_name | length == 0
+
 - name: Fail if service_container_user is not string
   ansible.builtin.fail:
     msg: "service_container_user must be a string, not int."

roles/service/vars/main/additional.yaml

@@ -11,6 +11,13 @@ _service_additional_containers: >-
       | map('combine')
   }}
 
+_service_additional_container_ip: >-
+  {{
+    service_container_ip |
+      ansible.utils.ipmath(20 + _service_additional_container_index)
+      if _service_static_ip else ''
+  }}
+
 
 _service_additional_volume_mounts: "{{ _service_additional_container.mounts | selectattr('type', '==', 'volume') }}"
 _service_additional_template_mounts: "{{ _service_additional_container.mounts | selectattr('type', '==', 'template') }}"
@@ -32,12 +39,13 @@ _service_additional_container_template_mounts: >-
   {{
     ([{'readonly': true}] * _service_additional_template_mounts | length) |
     zip(
-      _service_additional_template_mounts,
       _service_additional_template_mounts |
-      map(attribute='source') |
+        community.general.remove_keys(['mode']),
-      map('regex_replace', '\.j2$', '') |
+      _service_additional_template_mounts |
-      map('regex_replace', '^', _service_host_directory ~ '/mounts/') |
+        map(attribute='source') |
-      map('community.general.dict_kv', 'source'),
+        map('regex_replace', '\.j2$', '') |
+        map('regex_replace', '^', _service_host_directory ~ '/mounts/') |
+        map('community.general.dict_kv', 'source'),
       ([{'type': 'bind'}] * _service_additional_template_mounts | length)
     ) |
     map('combine')

roles/service/vars/main/general.yaml

@@ -1,5 +1,6 @@
 ---
 _service_container_networks: "{{ [service_name] + service_container_additional_networks }}"
+_service_static_ip: "{{ service_container_ip | length > 0 }}"
 
 _service_container_requires: >-
   {{
@@ -11,6 +12,7 @@ _service_container_wants: >-
   {{
     service_wants
     + ([service_name + '-socat.socket'] if service_container_http_port > 0 else [])
+    + ([service_name + '-oauth2-proxy-socat.socket'] if _service_oauth2_proxy else [])
     + _service_additional_containers
         | map(attribute='name')
         | map('regex_replace', '$', '.service')

roles/service/vars/main/mounts.yaml

@@ -19,12 +19,13 @@ _service_container_template_mounts: >-
   {{
     ([{'readonly': true}] * _service_template_mounts | length) |
     zip(
-      _service_template_mounts,
       _service_template_mounts |
-      map(attribute='source') |
+        community.general.remove_keys(['mode']),
-      map('regex_replace', '\.j2$', '') |
+      _service_template_mounts |
-      map('regex_replace', '^', _service_host_directory ~ '/mounts/') |
+        map(attribute='source') |
-      map('community.general.dict_kv', 'source'),
+        map('regex_replace', '\.j2$', '') |
+        map('regex_replace', '^', _service_host_directory ~ '/mounts/') |
+        map('community.general.dict_kv', 'source'),
       ([{'type': 'bind'}] * _service_template_mounts | length)
     ) |
     map('combine')
@@ -44,7 +45,7 @@ _service_all_template_mounts: >-
       _service_template_mounts +
       (
         _service_additional_containers |
-        map(attribute='mounts') |
+        map(attribute='mounts', default=[]) |
         flatten
       )
     ) |