windmill: fix native workers

roles/nextcloud/defaults/main.yaml

@@ -1,3 +1,4 @@
 ---
 nextcloud_tag: stable
 nextcloud_install_harp: false
+nextcloud_additional_networks: []

roles/nextcloud/meta/argument_specs.yaml

@@ -22,3 +22,9 @@ argument_specs:
         type: bool
         required: false
         default: false
+      nextcloud_additional_networks:
+        description: Additional docker networks to add nextcloud container to
+        type: list
+        elements: str
+        required: false
+        default: []

roles/nextcloud/tasks/main.yaml

@@ -29,3 +29,4 @@
       NEXTCLOUD_ADMIN_PASSWORD_FILE: /run/secrets/admin-password
     service_additional_containers: "{{ _nextcloud_additional_containers }}"
     service_vhost_locations: "{{ _nextcloud_vhost_locations }}"
+    service_container_additional_networks: "{{ nextcloud_additional_networks }}"

roles/service/defaults/main.yaml

@@ -9,6 +9,7 @@ service_proxy_pass_host_header: true
 service_proxy_auth_type: none
 
 service_container_ip: ""
+service_container_hostname: ""
 service_container_additional_networks: []
 service_container_user: ""
 service_container_publish_ports: []

roles/service/meta/argument_specs.yaml

@@ -29,7 +29,7 @@ argument_specs:
       service_container_http_port:
         description:
           - Port inside the container where http requests are proxied to.
-          - If set to 0, http requests are proxied to /run/<service name>.sock inside the container
+          - If set to 0, http requests are proxied to fd:3 inside the container
         type: int
         required: false
         default: 0
@@ -82,6 +82,11 @@ argument_specs:
         type: str
         required: false
         default: ""
+      service_container_hostname:
+        description: Hostname to set inside the container.
+        type: str
+        required: false
+        default: ""
       service_container_additional_networks:
         description: >-
           A list of additional podman networks for the service container (in
@@ -482,7 +487,7 @@ argument_specs:
                   - Name of the port.
                   - >-
                     If type is socket, the socket will be created at
-                    /run/<service name>-<additional container name>-<port name>.sock on the host.
+                    /run/<service name>-<port name>-socat.sock on the host.
                   - If type is not socket, this is just informative.
                 type: str
                 required: true
@@ -571,6 +576,23 @@ argument_specs:
                   the name of the environment variable. Defaults to secret name.
                 type: str
                 required: false
+          requires:
+            description: >-
+              List of systemd units this container depends on, in addition to
+              service-wide requires.
+            type: list
+            required: false
+            default: []
+            elements: str
+          wants:
+            description: >-
+              List of systemd units this container weakly depends on, in addition to
+              service-wide wants.
+            type: list
+            required: false
+            default: []
+            elements: str
+
 
       service_requires:
         description: List of systemd units this service container depends on.

roles/service/tasks/additional.yaml

@@ -16,7 +16,7 @@
     container_secrets: "{{ _service_additional_container_secrets }}"
     container_env: "{{ _service_additional_container.env }}"
     container_add_capabilities: "{{ _service_additional_container.add_capabilities }}"
-    container_requires: "{{ _service_container_requires }}"
+    container_requires: "{{ _service_additional_container_requires }}"
     container_wants: "{{ _service_additional_container_wants }}"
     container_auto_update: "{{ service_auto_update }}"
   loop: "{{ _service_additional_containers }}"

roles/service/tasks/main.yaml

@@ -44,6 +44,7 @@
     container_devices: "{{ service_container_devices }}"
     container_publish_ports: "{{ _service_container_publish_ports }}"
     container_networks: "{{ _service_container_networks }}"
+    container_hostname: "{{ service_container_hostname }}"
     container_secrets: "{{ _service_container_secrets }}"
     container_env: "{{ service_container_env }}"
     container_add_capabilities: "{{ service_container_add_capabilities }}"

roles/service/tasks/redis.yaml

@@ -8,5 +8,9 @@
     container_networks:
       - name: "{{ service_name }}"
         ip: "{{ service_container_ip | ansible.utils.ipmath(2) if _service_static_ip else '' }}"
+    container_mounts:
+      - type: volume
+        source: redis
+        destination: /data
     container_hostname: redis
     container_auto_update: "{{ service_auto_update }}"

roles/service/vars/main/additional.yaml

@@ -1,7 +1,12 @@
 ---
+_service_additional_container_defaults:
+  image: "{{ service_container_image }}"
+  requires: []
+  wants: []
+
 _service_additional_containers_with_default_image: >-
   {{
-    ([{ 'image': service_container_image }] * service_additional_containers | length)
+    ([_service_additional_container_defaults] * service_additional_containers | length)
     | zip(service_additional_containers)
     | map('combine')
   }}
@@ -72,13 +77,16 @@ _service_additional_containers: >-
 
 _service_additional_container_wants: >-
   {{
-    service_wants
+    service_wants + _service_additional_container.wants +
-    + _service_additional_container_publish_socket_ports
+    _service_additional_container_publish_socket_ports
         | map(attribute='name')
         | map('regex_replace', '^', service_name ~ '-')
         | map('regex_replace', '$', '-socat.socket')
   }}
 
+_service_additional_container_requires: >-
+  {{ _service_container_requires + _service_additional_container.requires }}
+
 _service_additional_container_networks: >-
   {{
     [{

roles/synapse/tasks/main.yaml

@@ -44,7 +44,7 @@
     service_domains: "{{ [synapse_external_domain] }}"
     service_vhost_locations:
       - path: ^/_matrix/client/.*/(login|logout|refresh).*$
-        proxy_target_socket: /run/matrix-authentication-service-socat.sock
+        proxy_target_socket: /run/matrix-authentication-service-caddy-socket-proxy.sock
     service_wants:
       - matrix-authentication-service.service
 

roles/windmill/tasks/main.yaml

@@ -17,34 +17,56 @@
       DATABASE_URL_FILE: /run/secrets/postgres-url
       MODE: server
     service_additional_containers:
-      - name: worker
+      - name: worker-pinp
         image: quay.io/podman/stable:latest
         user: podman
-        entrypoint: /entrypoint.sh
+        command:
+          - podman
+          - system
+          - service
+          - --time
+          - "0"
+        mounts:
+          - type: volume
+            source: worker-pinp-containers
+            destination: /home/podman/.local/share/containers
+          - type: volume
+            source: worker-pinp-tmp
+            destination: /tmp/storage-run-1000
+          - type: volume
+            source: worker-pinp-run
+            destination: /tmp/storage-run-1000/podman
+      - name: worker
         mounts:
           - type: volume
             source: worker-logs
-            destination: /worker-logs
+            destination: /tmp/windmill/logs
           - type: volume
             source: worker-dependency-cache
-            destination: /worker-dependency-cache
+            destination: /tmp/windmill/cache
-          - type: template
-            source: worker_entrypoint.sh.j2
-            destination: /entrypoint.sh
-            mode: "0755"
           - type: volume
-            source: worker-containers
+            source: worker-pinp-run
-            destination: /home/podman/.local/share/containers
+            destination: /run/podman
-        publish_ports: []
+            readonly: true
-        env: {}
+        env:
+          DATABASE_URL_FILE: /run/secrets/postgres-url
+          DOCKER_HOST: unix:///run/podman/podman.sock
+          MODE: worker
+          WORKER_GROUP: default
+          ENABLE_UNSHARE_PID: "true"
+          UNSHARE_ISOLATION_FLAGS: "--user --map-root-user --pid --fork"
+        wants:
+          - windmill-worker-pinp.service
       - name: worker-native
         env:
           DATABASE_URL_FILE: /run/secrets/postgres-url
           MODE: worker
-          WORKER_TYPE: native
+          WORKER_GROUP: native
           NATIVE_MODE: "true"
           NUM_WORKERS: "8"
           SLEEP_QUEUE: "200"
+          ENABLE_UNSHARE_PID: "true"
+          UNSHARE_ISOLATION_FLAGS: "--user --map-root-user --pid --fork"
       - name: lsp
         image: ghcr.io/windmill-labs/windmill-extra:latest
         secrets: []

roles/windmill/templates/worker_entrypoint.sh.j2

@@ -1,27 +0,0 @@
-#!/bin/bash
-# {{ ansible_managed }}
-_term() {
-	echo "Received SIGTERM, stopping all containers"
-	kill "$child"
-}
-
-podman system service -t 0 &
-
-podman run \
-	--rm \
-	-v /run/secrets/postgres-url:/run/secrets/postgres-url:ro \
-	-e DATABASE_URL_FILE=/run/secrets/postgres-url \
-	-e MODE=worker \
-	-e WORKER_GROUP=default \
-	-e ENABLE_UNSHARE_PID="true" \
-	-e UNSHARE_ISOLATION_FLAGS="--user --map-root-user --pid --fork" \
-	-v /tmp/storage-run-1000/podman/podman.sock:/var/run/docker.sock \
-	-v /worker-logs:/tmp/windmill/logs \
-	-v /worker-dependency-cache:/tmp/windmill/cache \
-	--name worker \
-	--network host \
-	ghcr.io/windmill-labs/windmill:main &
-
-child=$!
-trap _term SIGTERM
-wait "$!"