service: samll improvements

roles/nextcloud/defaults/main.yaml

@@ -1,3 +1,4 @@
 ---
 nextcloud_tag: stable
 nextcloud_install_harp: false
+nextcloud_additional_networks: []

roles/nextcloud/meta/argument_specs.yaml

@@ -22,3 +22,9 @@ argument_specs:
         type: bool
         required: false
         default: false
+      nextcloud_additional_networks:
+        description: Additional docker networks to add nextcloud container to
+        type: list
+        elements: str
+        required: false
+        default: []

roles/nextcloud/tasks/main.yaml

@@ -29,3 +29,4 @@
       NEXTCLOUD_ADMIN_PASSWORD_FILE: /run/secrets/admin-password
     service_additional_containers: "{{ _nextcloud_additional_containers }}"
     service_vhost_locations: "{{ _nextcloud_vhost_locations }}"
+    service_container_additional_networks: "{{ nextcloud_additional_networks }}"

roles/service/defaults/main.yaml

@@ -17,7 +17,6 @@ service_container_devices: []
 service_container_secrets: []
 service_container_env: {}
 service_container_add_capabilities: []
-service_container_pinp: false
 
 service_database_type: none
 service_database_additional_networks: []

roles/service/meta/argument_specs.yaml

@@ -29,7 +29,7 @@ argument_specs:
       service_container_http_port:
         description:
           - Port inside the container where http requests are proxied to.
-          - If set to 0, http requests are proxied to /run/<service name>.sock inside the container
+          - If set to 0, http requests are proxied to fd:3 inside the container
         type: int
         required: false
         default: 0
@@ -277,22 +277,6 @@ argument_specs:
         default: []
         elements: str
 
-      service_container_pinp:
-        description:
-          - If true, runs the container with podman in podman
-          - This starts a podman service inside the outer container
-          - The podman socket is exposed to the inner container at /var/run/docker.sock
-          - >-
-            This allows the container to manage other containers, which are run inside the
-            same outer container
-          - >-
-            The inner containers use host networking, so they share the network namespace
-            with the outer container and each other.
-          - This support is experimental and may not work with all images or configurations.
-        type: bool
-        required: false
-        default: false
-
       service_database_type:
         description:
           - Database type to set up.
@@ -498,7 +482,7 @@ argument_specs:
                   - Name of the port.
                   - >-
                     If type is socket, the socket will be created at
-                    /run/<service name>-<additional container name>-<port name>.sock on the host.
+                    /run/<service name>-<port name>-socat.sock on the host.
                   - If type is not socket, this is just informative.
                 type: str
                 required: true
@@ -587,21 +571,23 @@ argument_specs:
                   the name of the environment variable. Defaults to secret name.
                 type: str
                 required: false
-          pinp:
+          requires:
-            description:
+            description: >-
-              - If true, runs the container with podman in podman
+              List of systemd units this container depends on, in addition to
-              - This starts a podman service inside the outer container
+              service-wide requires.
-              - The podman socket is exposed to the inner container at /var/run/docker.sock
+            type: list
-              - >-
-                This allows the container to manage other containers, which are run inside the
-                same outer container
-              - >-
-                The inner containers use host networking, so they share the network namespace
-                with the outer container and each other.
-              - This support is experimental and may not work with all images or configurations.
-            type: bool
             required: false
-            default: false
+            default: []
+            elements: str
+          wants:
+            description: >-
+              List of systemd units this container weakly depends on, in addition to
+              service-wide wants.
+            type: list
+            required: false
+            default: []
+            elements: str
+
 
       service_requires:
         description: List of systemd units this service container depends on.

roles/service/tasks/additional.yaml

@@ -4,19 +4,19 @@
     name: container
   vars:
     container_name: "{{ _service_additional_container.name }}"
-    container_image: "{{ _service_additional_container_final.image }}"
+    container_image: "{{ _service_additional_container.image }}"
-    container_entrypoint: "{{ _service_additional_container_final.entrypoint }}"
+    container_command: "{{ _service_additional_container.command }}"
-    container_command: "{{ _service_additional_container_final.command }}"
+    container_entrypoint: "{{ _service_additional_container.entrypoint }}"
-    container_user: "{{ _service_additional_container_final.user }}"
+    container_user: "{{ _service_additional_container.user }}"
-    container_mounts: "{{ _service_additional_container_final.mounts }}"
+    container_mounts: "{{ _service_additional_container_mounts }}"
     container_devices: "{{ _service_additional_container.devices }}"
     container_publish_ports: "{{ _service_additional_container_publish_ports }}"
     container_networks: "{{ _service_additional_container_networks }}"
     container_hostname: "{{ _service_additional_container.name | regex_replace('^' ~ service_name ~ '-', '') }}"
     container_secrets: "{{ _service_additional_container_secrets }}"
-    container_env: "{{ _service_additional_container_final.env }}"
+    container_env: "{{ _service_additional_container.env }}"
     container_add_capabilities: "{{ _service_additional_container.add_capabilities }}"
-    container_requires: "{{ _service_container_requires }}"
+    container_requires: "{{ _service_additional_container_requires }}"
     container_wants: "{{ _service_additional_container_wants }}"
     container_auto_update: "{{ service_auto_update }}"
   loop: "{{ _service_additional_containers }}"

roles/service/tasks/host_mounts.yaml

@@ -34,28 +34,3 @@
     directory_mode: "0755"
   notify: Restart container service {{ service_name }}
   loop: "{{ _service_all_copy_mounts | zip(_service_all_copy_mount_host_files) }}"
-
-- name: Template entrypoint for pinp
-  ansible.builtin.template:
-    src: "pinp-entrypoint.sh.j2"
-    dest: "{{ _service_host_directory }}/mounts/pinp-entrypoint.sh"
-    mode: "0755"
-  vars:
-    pinp_inner_name: "{{ service_name }}"
-    pinp_inner_image: "{{ service_container_image }}"
-    pinp_inner_mounts: "{{ _service_container_pinp_inner_mounts }}"
-    pinp_inner_env: "{{ service_container_env }}"
-  when: service_container_pinp
-- name: Template entrypoint for pinp of additional containers
-  ansible.builtin.template:
-    src: "pinp-entrypoint.sh.j2"
-    dest: "{{ _service_host_directory }}/mounts/{{ _service_additional_container.name }}-pinp-entrypoint.sh"
-    mode: "0755"
-  loop: "{{ _service_additional_containers | selectattr('pinp') }}"
-  loop_control:
-    loop_var: _service_additional_container
-  vars:
-    pinp_inner_name: "{{ _service_additional_container.name }}"
-    pinp_inner_image: "{{ _service_additional_container.image }}"
-    pinp_inner_mounts: "{{ _service_additional_container_pinp_inner_mounts }}"
-    pinp_inner_env: "{{ _service_additional_container.env }}"

roles/service/tasks/main.yaml

@@ -14,12 +14,9 @@
   ansible.builtin.include_tasks: secrets.yaml
   when: _service_container_secrets | length > 0
 
-- name: Host mounts for {{ service_name }}
+- name: Template mounts for {{ service_name }}
   ansible.builtin.include_tasks: host_mounts.yaml
-  when: >-
+  when: (_service_all_template_mounts + _service_all_copy_mounts) | length > 0
-    (_service_all_template_mounts + _service_all_copy_mounts) | length > 0
-    or service_container_pinp
-    or (_service_additional_containers | selectattr('pinp') | length > 0)
 
 - name: Additional containers for {{ service_name }}
   ansible.builtin.include_tasks: additional.yaml
@@ -39,16 +36,16 @@
     name: container
   vars:
     container_name: "{{ service_name }}"
-    container_image: "{{ _service_container.image }}"
+    container_image: "{{ service_container_image }}"
-    container_entrypoint: "{{ _service_container.entrypoint }}"
+    container_command: "{{ service_container_command }}"
-    container_command: "{{ _service_container.command }}"
+    container_entrypoint: "{{ service_container_entrypoint }}"
-    container_user: "{{ _service_container.user }}"
+    container_user: "{{ service_container_user }}"
-    container_mounts: "{{ _service_container.mounts }}"
+    container_mounts: "{{ _service_container_mounts }}"
     container_devices: "{{ service_container_devices }}"
     container_publish_ports: "{{ _service_container_publish_ports }}"
     container_networks: "{{ _service_container_networks }}"
     container_secrets: "{{ _service_container_secrets }}"
-    container_env: "{{ _service_container.env }}"
+    container_env: "{{ service_container_env }}"
     container_add_capabilities: "{{ service_container_add_capabilities }}"
     container_requires: "{{ _service_container_requires }}"
     container_wants: "{{ _service_container_wants }}"

roles/service/tasks/redis.yaml

@@ -8,5 +8,9 @@
     container_networks:
       - name: "{{ service_name }}"
         ip: "{{ service_container_ip | ansible.utils.ipmath(2) if _service_static_ip else '' }}"
+    container_mounts:
+      - type: volume
+        source: redis
+        destination: /data
     container_hostname: redis
     container_auto_update: "{{ service_auto_update }}"

roles/service/templates/pinp-entrypoint.sh.j2

@@ -1,26 +0,0 @@
-#!/bin/bash
-# {{ ansible_managed }}
-_term() {
-	echo "Received SIGTERM, stopping all containers"
-	kill "$child"
-}
-
-podman system service -t 0 &
-
-podman run \
-	--rm \
-	-v /run/secrets:/run/secrets:ro \
-{% for key, value in pinp_inner_env.items() %}
-	-e {{ key }}={{ value }} \
-{% endfor %}
-	-v /tmp/storage-run-1000/podman/podman.sock:/var/run/docker.sock \
-{% for mount in pinp_inner_mounts %}
-	--mount type={{ mount.type }},source={{ mount.source }},destination={{ mount.destination }}{% if mount.readonly | default(false) %},readonly{% endif %} \
-{% endfor %}
-	--name {{ pinp_inner_name }} \
-	--network host \
-	{{ pinp_inner_image }} &
-
-child=$!
-trap _term SIGTERM
-wait "$!"

roles/service/vars/main/additional.yaml

@@ -1,7 +1,12 @@
 ---
+_service_additional_container_defaults:
+  image: "{{ service_container_image }}"
+  requires: []
+  wants: []
+
 _service_additional_containers_with_default_image: >-
   {{
-    ([{ 'image': service_container_image }] * service_additional_containers | length)
+    ([_service_additional_container_defaults] * service_additional_containers | length)
     | zip(service_additional_containers)
     | map('combine')
   }}
@@ -13,7 +18,6 @@ _service_additional_container_same_image_defaults:
   devices: "{{ service_container_devices }}"
   env: "{{ service_container_env }}"
   add_capabilities: "{{ service_container_add_capabilities }}"
-  pinp: false
 
 _service_additional_container_different_image_defaults:
   user: ""
@@ -25,7 +29,6 @@ _service_additional_container_different_image_defaults:
   env: {}
   add_capabilities: []
   secrets: []
-  pinp: false
 
 _service_additional_same_image_containers: >-
   {{
@@ -74,13 +77,16 @@ _service_additional_containers: >-
 
 _service_additional_container_wants: >-
   {{
-    service_wants
+    service_wants + _service_additional_container.wants +
-    + _service_additional_container_publish_socket_ports
+    _service_additional_container_publish_socket_ports
         | map(attribute='name')
         | map('regex_replace', '^', service_name ~ '-')
         | map('regex_replace', '$', '-socat.socket')
   }}
 
+_service_additional_container_requires: >-
+  {{ _service_container_requires + _service_additional_container.requires }}
+
 _service_additional_container_networks: >-
   {{
     [{
@@ -206,59 +212,3 @@ _service_additional_container_mounts: >-
     else
     _service_container_mounts
   }}
-
-
-_service_additional_plain_container:
-  image: "{{ _service_additional_container.image }}"
-  entrypoint: "{{ _service_additional_container.entrypoint }}"
-  command: "{{ _service_additional_container.command }}"
-  user: "{{ _service_additional_container.user }}"
-  env: "{{ _service_additional_container.env }}"
-  mounts: "{{ _service_additional_container_mounts }}"
-
-_service_additional_pinp_container_mounts:
-  - type: bind
-    source: "{{ _service_host_directory }}/mounts/{{ _service_additional_container.name }}-entrypoint.sh"
-    destination: /entrypoint.sh
-    readonly: true
-  - type: volume
-    source: "{{ _service_additional_container.name }}-containers"
-    destination: /home/podman/.local/share/containers
-
-_service_additional_pinp_container:
-  image: quay.io/podman/stable:latest
-  entrypoint: /entrypoint.sh
-  command: []
-  user: podman
-  env: {}
-  mounts: >-
-    {{
-      _service_additional_pinp_container_mounts
-      + (
-        _service_additional_container_mounts
-        | zip(
-          _service_additional_container_mounts
-          | map(attribute='source')
-          | map('replace', '/', '_')
-          | map('regex_replace', '^', '/mounts/')
-          | map('community.general.dict_kv', 'destination')
-        )
-        | map('combine')
-      )
-    }}
-
-_service_additional_container_final: >-
-  {{ _service_additional_pinp_container if _service_additional_container.pinp else _service_additional_plain_container }}
-
-_service_additional_container_pinp_inner_mounts: >-
-  {{
-    _service_additional_container_mounts
-    | zip(
-      _service_additional_container_mounts
-      | map(attribute='source')
-      | map('replace', '/', '_')
-      | map('regex_replace', '^', '/mounts/')
-      | map('community.general.dict_kv', 'source')
-    )
-    | map('combine')
-  }}

roles/service/vars/main/pinp.yaml

@@ -1,55 +0,0 @@
----
-_service_plain_container:
-  image: "{{ service_container_image }}"
-  entrypoint: "{{ service_container_entrypoint }}"
-  command: "{{ service_container_command }}"
-  user: "{{ service_container_user }}"
-  env: "{{ service_container_env }}"
-  mounts: "{{ _service_container_mounts }}"
-
-_service_pinp_container_mounts:
-  - type: bind
-    source: "{{ _service_host_directory }}/mounts/entrypoint.sh"
-    destination: /entrypoint.sh
-    readonly: true
-  - type: volume
-    source: "containers"
-    destination: /home/podman/.local/share/containers
-
-_service_pinp_container:
-  image: quay.io/podman/stable:latest
-  entrypoint: /entrypoint.sh
-  command: []
-  user: podman
-  env: {}
-  mounts: >-
-    {{
-      _service_pinp_container_mounts
-      + (
-        _service_container_mounts
-        | zip(
-          _service_container_mounts
-          | map(attribute='source')
-          | map('replace', '/', '_')
-          | map('regex_replace', '^', '/mounts/')
-          | map('community.general.dict_kv', 'destination')
-        )
-        | map('combine')
-      )
-    }}
-
-_service_container: >-
-  {{ _service_pinp_container if service_container_pinp else _service_plain_container }}
-
-_service_container_pinp_inner_mounts: >-
-  {{
-    _service_container_mounts
-    | zip(
-      _service_container_mounts
-      | map(attribute='source')
-      | map('replace', '/', '_')
-      | map('regex_replace', '^', '/mounts/')
-      | map('community.general.dict_kv', 'source')
-    )
-    | map('combine')
-  }}

roles/windmill/tasks/main.yaml

@@ -17,8 +17,26 @@
       DATABASE_URL_FILE: /run/secrets/postgres-url
       MODE: server
     service_additional_containers:
+      - name: worker-pinp
+        image: quay.io/podman/stable:latest
+        user: podman
+        command:
+          - podman
+          - system
+          - service
+          - --time
+          - "0"
+        mounts:
+          - type: volume
+            source: worker-pinp-containers
+            destination: /home/podman/.local/share/containers
+          - type: volume
+            source: worker-pinp-tmp
+            destination: /tmp/storage-run-1000
+          - type: volume
+            source: worker-pinp-run
+            destination: /tmp/storage-run-1000/podman
       - name: worker
-        pinp: true
         mounts:
           - type: volume
             source: worker-logs
@@ -26,13 +44,19 @@
           - type: volume
             source: worker-dependency-cache
             destination: /tmp/windmill/cache
+          - type: volume
+            source: worker-pinp-run
+            destination: /run/podman
+            readonly: true
         env:
           DATABASE_URL_FILE: /run/secrets/postgres-url
+          DOCKER_HOST: unix:///run/podman/podman.sock
           MODE: worker
           WORKER_GROUP: default
           ENABLE_UNSHARE_PID: "true"
           UNSHARE_ISOLATION_FLAGS: "--user --map-root-user --pid --fork"
-
+        wants:
+          - windmill-worker-pinp.service
       - name: worker-native
         env:
           DATABASE_URL_FILE: /run/secrets/postgres-url