Add headscale

roles/caddy_socket_proxy/README.md

@@ -0,0 +1 @@
+Sets up a caddy container and a systemd socket unit, forwarding traffic from it to target container

roles/container/defaults/main.yaml

@@ -14,3 +14,4 @@ container_auto_update: true
 container_requires: []
 container_wants: []
 container_add_capabilities: []
+container_reload_method: none

roles/container/handlers/main.yaml

@@ -4,3 +4,9 @@
     systemd_restart_units: "{{ systemd_restart_units + [container_name ~ '.service'] }}" # noqa: var-naming[no-role-prefix]
   changed_when: true
   notify: Apply systemd unit restarts
+
+- name: Reload container service {{ container_name }}
+  ansible.builtin.systemd_service:
+    name: "{{ container_name }}.service"
+    state: reloaded
+  when: "container_name ~ '.service' not in systemd_restart_units"

roles/container/meta/argument_specs.yaml

@@ -212,3 +212,21 @@ argument_specs:
         type: bool
         required: false
         default: true
+      container_reload_method:
+        description: |
+          How to reload configuration when systemctl reload is called
+          kill: Sends SIGHUP to the container
+          command: Runs the specified command inside the container
+        type: str
+        required: false
+        default: none
+        choices:
+          - kill
+          - command
+          - none
+      container_reload_command:
+        description: >-
+          Command to run inside container when systemctl reload is called.
+          Required if container_reload_method is command, ignored otherwise.
+        type: str
+        required: false

roles/container/vars/main/general.yaml

@@ -69,6 +69,10 @@ _container_labels: >-
     else {}
   }}
 
+_container_reload_commands:
+  kill: podman kill --signal HUP {{ container_name }}
+  command: podman exec {{ container_name }} {{ container_reload_command }}
+
 _container_quadlet_unit_options: |
   [Unit]
   Description=Container {{ container_name }}
@@ -90,8 +94,12 @@ _container_quadlet_auto_start_options: |
 
   [Install]
   WantedBy=multi-user.target
+_container_quadlet_reload_options: |
+  [Service]
+  ExecReload={{ _container_reload_commands[container_reload_method] }}
 _container_quadlet_options_incl_empty:
   - "{{ 'AutoUpdate=registry' if container_auto_update else '' }}"
   - "{{ _container_quadlet_unit_options }}"
   - "{{ _container_quadlet_auto_start_options if container_auto_start else '' }}"
+  - "{{ _container_quadlet_reload_options if container_reload_method != 'none' else '' }}"
 _container_quadlet_options: "{{ _container_quadlet_options_incl_empty | select('!=', '') }}"

roles/headscale/README.md

@@ -0,0 +1 @@
+Sets up a headscale container

roles/headscale/defaults/main.yaml

@@ -0,0 +1,4 @@
+---
+headscale_oidc_issuer_url: ""
+headscale_oidc_client_id: ""
+headscale_oidc_client_secret: ""

roles/headscale/meta/argument_specs.yaml

@@ -0,0 +1,85 @@
+---
+argument_specs:
+  main:
+    description: "Sets up a headscale container"
+    options:
+      headscale_domain:
+        description: Domain headscale should be available at
+        type: str
+        required: true
+      headscale_magicdns_base_domain:
+        description: Base domain for magic dns hostnames
+        type: str
+        required: true
+      headscale_policy:
+        description:
+          - Headscale policy configuration.
+          - See https://headscale.net/stable/ref/acls/
+          - This role's support for acls is currently quite limited. Waiting for headscale to release grants support.
+        type: dict
+        required: true
+        options:
+          groups:
+            description: >-
+              Groups of users. Formatted as dict where dict key is group name and
+              value is a list of users in the group.
+            type: dict
+            required: false
+          hosts:
+            description: Mapping of host names to ip addresses
+            type: dict
+            required: false
+          tagOwners:
+            description: Mapping of tags to lists of their owners
+            type: dict
+            required: false
+          acls:
+            description: List of acls
+            type: list
+            required: true
+            elements: dict
+            options:
+              action:
+                description: ACL action
+                type: str
+                required: true
+                choices:
+                  - accept
+                  - check
+              src:
+                description: >-
+                  A list of sources, formatted as prefix:name:ports,
+                  where prefix is the type of object, like tag: or group:,
+                  name is the object name and ports is a comma separated list of ports or *
+                type: list
+                required: true
+                elements: str
+              dst:
+                description: A list of destinations. Same format as sources.
+                type: list
+                required: true
+                elements: str
+              proto:
+                description: Protocol
+                type: str
+                required: false
+                choices:
+                  - tcp
+                  - udp
+                  - icmp
+
+      headscale_oidc_issuer_url:
+        description: OIDC issuer url. Leave unset to not use OIDC.
+        type: str
+        required: false
+        default: ""
+      headscale_oidc_client_id:
+        description: OIDC client id. Required if OIDC issuer is set.
+        type: str
+        required: false
+        default: ""
+      headscale_oidc_client_secret:
+        description: OIDC client secret. Required if OIDC issuer is set.
+        type: str
+        required: false
+        default: ""

roles/headscale/tasks/main.yaml

@@ -0,0 +1,36 @@
+---
+- name: Headscale service
+  ansible.builtin.import_role:
+    name: service
+  vars:
+    service_name: headscale
+    service_container_image: docker.io/headscale/headscale:stable
+    service_container_command: serve
+    service_container_mounts:
+      - type: volume
+        source: data
+        destination: /var/lib/headscale
+      - type: template
+        source: config.yaml.j2
+        destination: /etc/headscale/config.yaml
+      - type: template
+        source: policy.hujson.j2
+        destination: /etc/headscale/policy.hujson
+        template_validate_command: headscale policy check --file /etc/headscale/policy.hujson
+    service_container_http_port: 8080
+    service_domains:
+      - "{{ headscale_domain }}"
+    service_container_publish_ports:
+      - name: stun
+        container_port: 3478
+        protocol: udp
+        host_port: 3478
+    service_container_secrets: "{{ _headscale_secrets }}"
+    service_container_reload_method: kill
+
+- name: Open port for stun
+  ansible.posix.firewalld:
+    service: stun
+    state: enabled
+    permanent: true
+    immediate: true

roles/headscale/templates/config.yaml.j2

@@ -0,0 +1,56 @@
+---
+# vim:ft=yaml
+# {{ ansible_managed }}
+
+listen_addr: 0.0.0.0:8080
+server_url: https://{{ headscale_domain }}
+
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+
+  allocation: sequential
+
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale embedded DERP"
+    verify_clients: true
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+
+  urls: []
+
+database:
+  type: sqlite
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+
+policy:
+  mode: file
+  path: /etc/headscale/policy.hujson
+
+dns:
+  magic_dns: true
+  base_domain: {{ headscale_magicdns_base_domain }}
+  nameservers:
+    global:
+      - https://dns.quad9.net/dns-query
+
+logtail:
+  enabled: false
+
+{% if headscale_oidc_issuer_url | length > 0 %}
+oidc:
+  only_start_if_oidc_is_available: false
+  issuer: {{ headscale_oidc_issuer_url }}
+  client_id: "{{ headscale_oidc_client_id }}"
+  client_secret_path: /run/secrets/oidc-client-secret
+  pkce:
+    enabled: true
+{% endif %}

roles/headscale/templates/policy.hujson.j2

@@ -0,0 +1,3 @@
+// {{ ansible_managed }}
+
+{{ headscale_policy | to_nice_json }}

roles/headscale/vars/main.yaml

@@ -0,0 +1,6 @@
+---
+_headscale_oidc_secret:
+  name: oidc-client-secret
+  value: "{{ headscale_oidc_client_secret }}"
+
+_headscale_secrets: "{{ [_headscale_oidc_secret] if headscale_oidc_issuer_url | length > 0 else [] }}"

roles/nextcloud/defaults/main.yaml

@@ -1,3 +1,4 @@
 ---
 nextcloud_tag: stable
 nextcloud_install_harp: false
+nextcloud_additional_networks: []

roles/nextcloud/meta/argument_specs.yaml

@@ -22,3 +22,9 @@ argument_specs:
         type: bool
         required: false
         default: false
+      nextcloud_additional_networks:
+        description: Additional docker networks to add nextcloud container to
+        type: list
+        elements: str
+        required: false
+        default: []

roles/nextcloud/tasks/main.yaml

@@ -29,3 +29,4 @@
       NEXTCLOUD_ADMIN_PASSWORD_FILE: /run/secrets/admin-password
     service_additional_containers: "{{ _nextcloud_additional_containers }}"
     service_vhost_locations: "{{ _nextcloud_vhost_locations }}"
+    service_container_additional_networks: "{{ nextcloud_additional_networks }}"

roles/service/defaults/main.yaml

@@ -9,6 +9,7 @@ service_proxy_pass_host_header: true
 service_proxy_auth_type: none
 
 service_container_ip: ""
+service_container_hostname: ""
 service_container_additional_networks: []
 service_container_user: ""
 service_container_publish_ports: []
@@ -17,6 +18,8 @@ service_container_devices: []
 service_container_secrets: []
 service_container_env: {}
 service_container_add_capabilities: []
+service_container_reload_method: none
+service_container_reload_command: ""
 
 service_database_type: none
 service_database_additional_networks: []

roles/service/meta/argument_specs.yaml

@@ -29,7 +29,7 @@ argument_specs:
       service_container_http_port:
         description:
           - Port inside the container where http requests are proxied to.
-          - If set to 0, http requests are proxied to /run/<service name>.sock inside the container
+          - If set to 0, http requests are proxied to fd:3 inside the container
         type: int
         required: false
         default: 0
@@ -82,6 +82,11 @@ argument_specs:
         type: str
         required: false
         default: ""
+      service_container_hostname:
+        description: Hostname to set inside the container.
+        type: str
+        required: false
+        default: ""
       service_container_additional_networks:
         description: >-
           A list of additional podman networks for the service container (in
@@ -108,6 +113,14 @@ argument_specs:
             description: Container port to publish
             type: int
             required: true
+          protocol:
+            description: Protocol of the port
+            type: str
+            required: false
+            default: tcp
+            choices:
+              - tcp
+              - udp
           type:
             description: Whether to publish as a port or socket
             type: str
@@ -202,6 +215,14 @@ argument_specs:
             elements: str
             required: false
             default: []
+          template_validate_command:
+            description: >-
+              Command used to verify templated file validity.
+              Will be run in a temporary container using the same container image as the main service.
+              File will be available in the same place as in the service container (destination).
+              Only applicable if mount type is template
+            type: str
+            required: false
       service_container_devices:
         description: List of devices to be added inside the service main container.
         type: list
@@ -277,6 +298,26 @@ argument_specs:
         default: []
         elements: str
 
+      service_container_reload_method:
+        description: |
+          How to reload configuration when systemctl reload is called
+          kill: Sends SIGHUP to the container
+          command: Runs the specified command inside the container
+        type: str
+        required: false
+        default: none
+        choices:
+          - kill
+          - command
+          - none
+      service_container_reload_command:
+        description: >-
+          Command to run inside container when systemctl reload is called.
+          Required if container_reload_method is command, ignored otherwise.
+        type: str
+        required: false
+        default: ""
+
       service_database_type:
         description:
           - Database type to set up.
@@ -482,7 +523,7 @@ argument_specs:
                   - Name of the port.
                   - >-
                     If type is socket, the socket will be created at
-                    /run/<service name>-<additional container name>-<port name>.sock on the host.
+                    /run/<service name>-<port name>-socat.sock on the host.
                   - If type is not socket, this is just informative.
                 type: str
                 required: true
@@ -490,6 +531,14 @@ argument_specs:
                 description: Container port to publish
                 type: int
                 required: true
+              protocol:
+                description: Protocol of the port
+                type: str
+                required: false
+                default: tcp
+                choices:
+                  - tcp
+                  - udp
               type:
                 description: Whether to publish as a port or socket
                 type: str
@@ -524,6 +573,25 @@ argument_specs:
             type: list
             required: false
             elements: str
+          reload_method:
+            description: |
+              How to reload configuration when systemctl reload is called
+              kill: Sends SIGHUP to the container
+              command: Runs the specified command inside the container
+            type: str
+            required: false
+            default: none
+            choices:
+              - kill
+              - command
+              - none
+          reload_command:
+            description: >-
+              Command to run inside container when systemctl reload is called.
+              Required if container_reload_method is command, ignored otherwise.
+            type: str
+            required: false
+            default: ""
           secrets:
             description:
               - >
@@ -571,6 +639,23 @@ argument_specs:
                   the name of the environment variable. Defaults to secret name.
                 type: str
                 required: false
+          requires:
+            description: >-
+              List of systemd units this container depends on, in addition to
+              service-wide requires.
+            type: list
+            required: false
+            default: []
+            elements: str
+          wants:
+            description: >-
+              List of systemd units this container weakly depends on, in addition to
+              service-wide wants.
+            type: list
+            required: false
+            default: []
+            elements: str
+
 
       service_requires:
         description: List of systemd units this service container depends on.

roles/service/tasks/additional.yaml

@@ -16,7 +16,9 @@
     container_secrets: "{{ _service_additional_container_secrets }}"
     container_env: "{{ _service_additional_container.env }}"
     container_add_capabilities: "{{ _service_additional_container.add_capabilities }}"
-    container_requires: "{{ _service_container_requires }}"
+    container_reload_method: "{{ _service_additional_container.reload_method }}"
+    container_reload_command: "{{ _service_additional_container.reload_command }}"
+    container_requires: "{{ _service_additional_container_requires }}"
     container_wants: "{{ _service_additional_container_wants }}"
     container_auto_update: "{{ service_auto_update }}"
   loop: "{{ _service_additional_containers }}"

roles/service/tasks/host_mounts.yaml

@@ -23,8 +23,18 @@
     src: "{{ item[0].source }}"
     dest: "{{ item[1] }}"
     mode: "{{ item[0].mode | default('0644') }}"
-  notify: Restart container service {{ service_name }}
+    validate: "{{ validate if item[0].template_validate_command is defined else omit }}"
+  notify: >-
+    {{ 'Reload' if service_container_reload_method != 'none' else 'Restart' }}
+    container service {{ service_name }}
   loop: "{{ _service_all_template_mounts | zip(_service_all_template_mount_host_files) }}"
+  vars:
+    validate: >-
+      podman run --rm
+      -v %s:{{ item[0].destination }}:ro
+      --entrypoint {{ item[0].template_validate_command.split(' ', 1)[0] }}
+      {{ service_container_image }}
+      {{ item[0].template_validate_command.split(' ', 1)[1] }}
 
 - name: Copy files for copy mounts
   ansible.builtin.copy:

roles/service/tasks/main.yaml

@@ -44,9 +44,12 @@
     container_devices: "{{ service_container_devices }}"
     container_publish_ports: "{{ _service_container_publish_ports }}"
     container_networks: "{{ _service_container_networks }}"
+    container_hostname: "{{ service_container_hostname }}"
     container_secrets: "{{ _service_container_secrets }}"
     container_env: "{{ service_container_env }}"
     container_add_capabilities: "{{ service_container_add_capabilities }}"
+    container_reload_method: "{{ service_container_reload_method }}"
+    container_reload_command: "{{ service_container_reload_command }}"
     container_requires: "{{ _service_container_requires }}"
     container_wants: "{{ _service_container_wants }}"
     container_auto_update: "{{ service_auto_update }}"

roles/service/tasks/redis.yaml

@@ -8,5 +8,9 @@
     container_networks:
       - name: "{{ service_name }}"
         ip: "{{ service_container_ip | ansible.utils.ipmath(2) if _service_static_ip else '' }}"
+    container_mounts:
+      - type: volume
+        source: "{{ service_name }}-redis"
+        destination: /data
     container_hostname: redis
     container_auto_update: "{{ service_auto_update }}"

roles/service/vars/main/additional.yaml

@@ -1,7 +1,12 @@
 ---
+_service_additional_container_defaults:
+  image: "{{ service_container_image }}"
+  requires: []
+  wants: []
+
 _service_additional_containers_with_default_image: >-
   {{
-    ([{ 'image': service_container_image }] * service_additional_containers | length)
+    ([_service_additional_container_defaults] * service_additional_containers | length)
     | zip(service_additional_containers)
     | map('combine')
   }}
@@ -13,6 +18,8 @@ _service_additional_container_same_image_defaults:
   devices: "{{ service_container_devices }}"
   env: "{{ service_container_env }}"
   add_capabilities: "{{ service_container_add_capabilities }}"
+  reload_method: "{{ service_container_reload_method }}"
+  reload_command: "{{ service_container_reload_command }}"
 
 _service_additional_container_different_image_defaults:
   user: ""
@@ -23,6 +30,8 @@ _service_additional_container_different_image_defaults:
   publish_ports: []
   env: {}
   add_capabilities: []
+  reload_method: none
+  reload_command: ""
   secrets: []
 
 _service_additional_same_image_containers: >-
@@ -72,13 +81,16 @@ _service_additional_containers: >-
 
 _service_additional_container_wants: >-
   {{
-    service_wants
+    service_wants + _service_additional_container.wants +
-    + _service_additional_container_publish_socket_ports
+    _service_additional_container_publish_socket_ports
         | map(attribute='name')
         | map('regex_replace', '^', service_name ~ '-')
         | map('regex_replace', '$', '-socat.socket')
   }}
 
+_service_additional_container_requires: >-
+  {{ _service_container_requires + _service_additional_container.requires }}
+
 _service_additional_container_networks: >-
   {{
     [{
@@ -144,6 +156,7 @@ _service_additional_container_publish_ports: >-
       _service_additional_container_publish_port_ports | map(attribute='host_port'),
       _service_additional_container_publish_port_ports | map(attribute='container_port')
     ) | map('join', ':')
+    | zip(_service_additional_container_publish_port_ports | map(attribute='protocol')) | map('join', '/')
   }}
 
 _service_additional_volume_mounts: "{{ _service_additional_container.mounts | selectattr('type', '==', 'volume') }}"
@@ -168,7 +181,7 @@ _service_additional_container_template_mounts: >-
     ([{'readonly': true}] * _service_additional_template_mounts | length) |
     zip(
       _service_additional_template_mounts |
-        community.general.remove_keys(['mode']),
+        community.general.remove_keys(['mode', 'template_validate_command']),
       _service_additional_template_mounts |
         map(attribute='source') |
         map('regex_replace', '\.j2$', '') |

roles/service/vars/main/mounts.yaml

@@ -30,7 +30,7 @@ _service_container_template_mounts: >-
     ([{'readonly': true}] * _service_template_mounts | length) |
     zip(
       _service_template_mounts |
-        community.general.remove_keys(['mode']),
+        community.general.remove_keys(['mode', 'template_validate_command']),
       _service_template_mounts |
         map(attribute='source') |
         map('regex_replace', '\.j2$', '') |

roles/service/vars/main/publish_ports.yaml

@@ -1,7 +1,7 @@
 ---
 _service_container_publish_ports_with_defaults: >-
   {{
-    ([{ 'type': 'port', 'host_address': '0.0.0.0' }] * service_container_publish_ports | length)
+    ([{ 'type': 'port', 'host_address': '0.0.0.0', 'protocol': 'tcp' }] * service_container_publish_ports | length)
     | zip(service_container_publish_ports)
     | map('combine')
   }}
@@ -13,9 +13,10 @@ _service_container_publish_port_ports: >-
 
 _service_container_publish_ports: >-
   {{
-    _service_container_publish_port_ports | map(attribute='host_address') |
+    _service_container_publish_port_ports | map(attribute='host_address')
-    zip(
+    | zip(
       _service_container_publish_port_ports | map(attribute='host_port'),
       _service_container_publish_port_ports | map(attribute='container_port')
     ) | map('join', ':')
+    | zip(_service_container_publish_port_ports | map(attribute='protocol')) | map('join', '/')
   }}

roles/synapse/tasks/main.yaml

@@ -44,7 +44,7 @@
     service_domains: "{{ [synapse_external_domain] }}"
     service_vhost_locations:
       - path: ^/_matrix/client/.*/(login|logout|refresh).*$
-        proxy_target_socket: /run/matrix-authentication-service-socat.sock
+        proxy_target_socket: /run/matrix-authentication-service-caddy-socket-proxy.sock
     service_wants:
       - matrix-authentication-service.service
 

roles/windmill/README.md

@@ -0,0 +1 @@
+Installs windmill with worker in podman in podman

roles/windmill/tasks/main.yaml

@@ -17,34 +17,56 @@
       DATABASE_URL_FILE: /run/secrets/postgres-url
       MODE: server
     service_additional_containers:
-      - name: worker
+      - name: worker-pinp
         image: quay.io/podman/stable:latest
         user: podman
-        entrypoint: /entrypoint.sh
+        command:
+          - podman
+          - system
+          - service
+          - --time
+          - "0"
+        mounts:
+          - type: volume
+            source: worker-pinp-containers
+            destination: /home/podman/.local/share/containers
+          - type: volume
+            source: worker-pinp-tmp
+            destination: /tmp/storage-run-1000
+          - type: volume
+            source: worker-pinp-run
+            destination: /tmp/storage-run-1000/podman
+      - name: worker
         mounts:
           - type: volume
             source: worker-logs
-            destination: /worker-logs
+            destination: /tmp/windmill/logs
           - type: volume
             source: worker-dependency-cache
-            destination: /worker-dependency-cache
+            destination: /tmp/windmill/cache
-          - type: template
-            source: worker_entrypoint.sh.j2
-            destination: /entrypoint.sh
-            mode: "0755"
           - type: volume
-            source: worker-containers
+            source: worker-pinp-run
-            destination: /home/podman/.local/share/containers
+            destination: /run/podman
-        publish_ports: []
+            readonly: true
-        env: {}
+        env:
+          DATABASE_URL_FILE: /run/secrets/postgres-url
+          DOCKER_HOST: unix:///run/podman/podman.sock
+          MODE: worker
+          WORKER_GROUP: default
+          ENABLE_UNSHARE_PID: "true"
+          UNSHARE_ISOLATION_FLAGS: "--user --map-root-user --pid --fork"
+        wants:
+          - windmill-worker-pinp.service
       - name: worker-native
         env:
           DATABASE_URL_FILE: /run/secrets/postgres-url
           MODE: worker
-          WORKER_TYPE: native
+          WORKER_GROUP: native
           NATIVE_MODE: "true"
           NUM_WORKERS: "8"
           SLEEP_QUEUE: "200"
+          ENABLE_UNSHARE_PID: "true"
+          UNSHARE_ISOLATION_FLAGS: "--user --map-root-user --pid --fork"
       - name: lsp
         image: ghcr.io/windmill-labs/windmill-extra:latest
         secrets: []

roles/windmill/templates/worker_entrypoint.sh.j2

@@ -1,27 +0,0 @@
-#!/bin/bash
-# {{ ansible_managed }}
-_term() {
-	echo "Received SIGTERM, stopping all containers"
-	kill "$child"
-}
-
-podman system service -t 0 &
-
-podman run \
-	--rm \
-	-v /run/secrets/postgres-url:/run/secrets/postgres-url:ro \
-	-e DATABASE_URL_FILE=/run/secrets/postgres-url \
-	-e MODE=worker \
-	-e WORKER_GROUP=default \
-	-e ENABLE_UNSHARE_PID="true" \
-	-e UNSHARE_ISOLATION_FLAGS="--user --map-root-user --pid --fork" \
-	-v /tmp/storage-run-1000/podman/podman.sock:/var/run/docker.sock \
-	-v /worker-logs:/tmp/windmill/logs \
-	-v /worker-dependency-cache:/tmp/windmill/cache \
-	--name worker \
-	--network host \
-	ghcr.io/windmill-labs/windmill:main &
-
-child=$!
-trap _term SIGTERM
-wait "$!"