638 lines
23 KiB
YAML
638 lines
23 KiB
YAML
---
|
|
argument_specs:
|
|
main:
|
|
description: Sets up a service in podman container(s)
|
|
options:
|
|
service_name:
|
|
description: Name of the service.
|
|
type: str
|
|
required: true
|
|
|
|
service_container_command:
|
|
description: Command to start the service container with.
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: str
|
|
service_container_entrypoint:
|
|
description: Entrypoint to use in the service container
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
|
|
service_domains:
|
|
description: A list of domains which should be proxied to the main service container
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: str
|
|
service_container_http_port:
|
|
description:
|
|
- Port inside the container where http requests are proxied to.
|
|
- If set to 0, http requests are proxied to fd:3 inside the container
|
|
type: int
|
|
required: false
|
|
default: 0
|
|
service_proxy_pass_host_header:
|
|
description: Passed to vhost role as vhost_proxy_pass_header
|
|
type: bool
|
|
required: false
|
|
default: true
|
|
service_proxy_auth_type:
|
|
description: >-
|
|
Set to oauth2-proxy to use OAuth2 Proxy for vhost authentication.
|
|
type: str
|
|
required: false
|
|
default: none
|
|
choices:
|
|
- none
|
|
- oauth2-proxy
|
|
service_vhost_locations:
|
|
description: Passed to vhost role as vhost_locations
|
|
type: list
|
|
required: false
|
|
default: []
|
|
|
|
service_oauth2_proxy_issuer_url:
|
|
description: >-
|
|
OpenID Connect issuer URL. Required if service_proxy_auth_type is oauth2-proxy.
|
|
type: str
|
|
required: false
|
|
oauth2_proxy_client_id:
|
|
description: OAuth client ID. Required if service_proxy_auth_type is oauth2-proxy.
|
|
type: str
|
|
required: false
|
|
oauth2_proxy_client_secret:
|
|
description: OAuth client secret. Required if service_proxy_auth_type is oauth2-proxy.
|
|
type: str
|
|
required: false
|
|
|
|
service_container_image:
|
|
description: "The image to run in the service container(s), in FQIN format (registry/image_name:tag)."
|
|
type: str
|
|
required: true
|
|
|
|
service_container_user:
|
|
description: The UID to run as inside the container
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
service_container_ip:
|
|
description: Static ip for the container in it's network
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
service_container_hostname:
|
|
description: Hostname to set inside the container.
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
service_container_additional_networks:
|
|
description: >-
|
|
A list of additional podman networks for the service container (in
|
|
addition to service name network).
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: str
|
|
service_container_publish_ports:
|
|
description: A list of ports to publish outside the container
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: dict
|
|
options:
|
|
name:
|
|
description:
|
|
- Name of the port.
|
|
- If type is socket, the socket will be created at /run/<service name>-<port name>.sock on the host.
|
|
- If type is not socket, this is just informative.
|
|
type: str
|
|
required: true
|
|
container_port:
|
|
description: Container port to publish
|
|
type: int
|
|
required: true
|
|
protocol:
|
|
description: Protocol of the port
|
|
type: str
|
|
required: false
|
|
default: tcp
|
|
choices:
|
|
- tcp
|
|
- udp
|
|
type:
|
|
description: Whether to publish as a port or socket
|
|
type: str
|
|
required: false
|
|
default: port
|
|
choices:
|
|
- socket
|
|
- port
|
|
host_address:
|
|
description:
|
|
- IP or hostname to listen on on the host
|
|
- Ignored if type is socket
|
|
type: str
|
|
required: false
|
|
default: 0.0.0.0
|
|
host_port:
|
|
description:
|
|
- Port to listen on on the host
|
|
- Required if type is port, ignored otherwise
|
|
type: int
|
|
required: false
|
|
service_container_mounts:
|
|
description: List of bind mounts or volumes to be mounted inside the service container(s).
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: dict
|
|
options:
|
|
type:
|
|
description: Type of mount
|
|
type: str
|
|
required: true
|
|
choices:
|
|
- volume
|
|
- bind
|
|
- template
|
|
- copy
|
|
source:
|
|
description:
|
|
- Mount source.
|
|
- If mount type is volume, name of the volume.
|
|
- If mount type is bind, host path to bind mount inside the container.
|
|
- If mount type is template, the name of the template file, must end in .j2
|
|
- If mount type is copy, name of the file or directory to copy. Directory name must end in /.
|
|
type: str
|
|
required: true
|
|
destination:
|
|
description: Path inside the container to mount at
|
|
type: str
|
|
required: true
|
|
readonly:
|
|
description:
|
|
- If true, volume will be mounted as read only inside the container.
|
|
- Defaults to false for volume and bind, true for template and copy
|
|
type: bool
|
|
required: false
|
|
user:
|
|
description: Volume owner uid. Only applicable if mount type is volume.
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
group:
|
|
description: Volume owner gid. Only applicable if mount type is volume.
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
mode:
|
|
description:
|
|
- Templated file or copied directory/file permissions.
|
|
- Defaults to 0644 for files, 0755 for directories
|
|
type: str
|
|
required: false
|
|
volume_device:
|
|
description: >-
|
|
The path of a device which is mounted for the volume.
|
|
Only applicable if mount type is volume.
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
volume_type:
|
|
description: >-
|
|
The filesystem type of device as used by the mount commands -t option
|
|
Only applicable if mount type is volume.
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
volume_mount_options:
|
|
description: >-
|
|
The mount options to use for a filesystem as used by the mount command -o option
|
|
Only applicable if mount type is volume.
|
|
type: list
|
|
elements: str
|
|
required: false
|
|
default: []
|
|
template_validate_command:
|
|
description: >-
|
|
Command used to verify templated file validity.
|
|
Will be run in a temporary container using the same container image as the main service.
|
|
File will be available in the same place as in the service container (destination).
|
|
Only applicable if mount type is template
|
|
type: str
|
|
required: false
|
|
service_container_devices:
|
|
description: List of devices to be added inside the service main container.
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: dict
|
|
options:
|
|
source:
|
|
description: Device path on host
|
|
type: str
|
|
required: true
|
|
destination:
|
|
description: Device path inside the container. Defaults to same as host.
|
|
type: str
|
|
required: false
|
|
service_container_secrets:
|
|
description:
|
|
- >
|
|
A list of secrets available to the service container as file or environment variable
|
|
- >
|
|
A dict of secrets and their values (including autogenerated values) is available as
|
|
`service_podman_secrets` for use in templates. This should only be used if the
|
|
container doesn't support reading the secret from file or environment variable.
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: dict
|
|
options:
|
|
name:
|
|
description: Name of the secret
|
|
type: str
|
|
required: true
|
|
value:
|
|
description:
|
|
- >
|
|
Value of the secret. Defaults to a 128-character random string containing
|
|
alphanumeric characters.
|
|
- >
|
|
If the value is not explicitly set, it will not be changed if the secret
|
|
already exists.
|
|
type: str
|
|
required: false
|
|
length:
|
|
description: Length of randomly generated string
|
|
type: int
|
|
required: false
|
|
default: 128
|
|
type:
|
|
description: How the secret will be exposed to the container
|
|
type: str
|
|
choices:
|
|
- mount
|
|
- env
|
|
default: mount
|
|
target:
|
|
description: >
|
|
Where the secret will be available inside the container. If type is mount, this is
|
|
either a full file path or a filename under /run/secrets. If type is env, this is
|
|
the name of the environment variable. Defaults to secret name.
|
|
type: str
|
|
required: false
|
|
|
|
service_container_env:
|
|
description: A dict of environment variables for the service container(s)
|
|
type: dict
|
|
required: false
|
|
default: {}
|
|
|
|
service_container_add_capabilities:
|
|
description: List of capabilities to add to the service container
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: str
|
|
|
|
service_database_type:
|
|
description:
|
|
- Database type to set up.
|
|
- >
|
|
It will be run in a container accessible to the service at
|
|
host <service database type> on the default port.
|
|
- The database user will be <service name>
|
|
- The password will be accessible as secret at /run/secrets/<service database type>
|
|
- >
|
|
The password will also be available as the
|
|
service_podman_secrets['<service name>-<service database type>'] variable.
|
|
type: str
|
|
choices:
|
|
- postgres
|
|
- mariadb
|
|
- mongo
|
|
- none
|
|
required: false
|
|
default: none
|
|
service_database_additional_networks:
|
|
description: >-
|
|
A list of additional podman networks for the database container (in
|
|
addition to service name network).
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: str
|
|
service_database_secret_type:
|
|
description: Secret type for database secret for service container
|
|
type: str
|
|
choices:
|
|
- mount
|
|
- env
|
|
required: false
|
|
default: mount
|
|
service_database_secret_target:
|
|
description: Secret target for database secret for service container.
|
|
type: str
|
|
required: false
|
|
default: "{{ service_database_type }}"
|
|
service_postgres_image:
|
|
description: Postgresql image to use.
|
|
type: str
|
|
required: false
|
|
default: docker.io/library/postgres
|
|
service_postgres_tag:
|
|
description:
|
|
- Postgresql version to use.
|
|
- Can be debian (n) or alpine-based (n-alpine), where n can be major version like 14 or minor like 14.13.
|
|
- Ignored if database type is not postgres.
|
|
- If a custom postgres image is specified, see that image documentation for supported tags.
|
|
type: str
|
|
required: false
|
|
service_redis:
|
|
description: >-
|
|
Whether to install redis in a container accessible to the service at host redis.
|
|
type: bool
|
|
required: false
|
|
default: false
|
|
|
|
service_additional_containers:
|
|
description:
|
|
- List of additional containers for the service.
|
|
- >-
|
|
If image is not specified, will use service container image and
|
|
inherit most options from main service container.
|
|
- All options can be overridden per-container.
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: dict
|
|
options:
|
|
name:
|
|
description:
|
|
- Name of the container.
|
|
- >
|
|
This will be appended to the service name, so if for example service name is
|
|
nextcloud and this variable is cron, the resulting container will be called
|
|
nextcloud-cron
|
|
type: str
|
|
required: true
|
|
image:
|
|
description: "The image to run in the container, in FQIN format (registry/image:tag)"
|
|
type: str
|
|
required: false
|
|
default: "{{ service_container_image }}"
|
|
user:
|
|
description:
|
|
- The UID to run as inside the container.
|
|
- Defaults to <service_container_user> if same image, "" otherwise.
|
|
type: str
|
|
required: false
|
|
command:
|
|
description:
|
|
- Command to start the container with.
|
|
- Defaults to <service_container_command> if same image, [] otherwise.
|
|
type: list
|
|
required: false
|
|
elements: str
|
|
entrypoint:
|
|
description:
|
|
- Entrypoint to use in the container
|
|
- Defaults to <service_container_entrypoint> if same image, "" otherwise.
|
|
type: str
|
|
required: false
|
|
mounts:
|
|
description:
|
|
- List of bind mounts or volumes to be mounted inside the container.
|
|
- Defaults to <service_container_mounts> if same image, [] otherwise.
|
|
type: list
|
|
required: false
|
|
elements: dict
|
|
options:
|
|
type:
|
|
description: Type of mount
|
|
type: str
|
|
required: true
|
|
choices:
|
|
- volume
|
|
- bind
|
|
- template
|
|
source:
|
|
description:
|
|
- Mount source.
|
|
- If mount type is volume, name of the volume.
|
|
- If mount type is bind, host path to bind mount inside the container.
|
|
- If mount type is template, the name of the template file, must end in .j2
|
|
type: str
|
|
required: true
|
|
destination:
|
|
description: Path inside the container to mount at
|
|
type: str
|
|
required: true
|
|
readonly:
|
|
description:
|
|
- If true, volume will be mounted as read only inside the container
|
|
- Defaults to false for volume and bind, true for template
|
|
type: bool
|
|
required: false
|
|
user:
|
|
description: Volume owner uid. Only applicable if mount type is volume.
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
group:
|
|
description: Volume owner gid. Only applicable if mount type is volume.
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
mode:
|
|
description:
|
|
- Templated file or copied directory/file permissions.
|
|
- Defaults to 0644 for files, 0755 for directories
|
|
type: str
|
|
required: false
|
|
volume_device:
|
|
description: >-
|
|
The path of a device which is mounted for the volume.
|
|
Only applicable if mount type is volume.
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
volume_type:
|
|
description: >-
|
|
The filesystem type of device as used by the mount commands -t option
|
|
Only applicable if mount type is volume.
|
|
type: str
|
|
required: false
|
|
default: ""
|
|
volume_mount_options:
|
|
description: >-
|
|
The mount options to use for a filesystem as used by the mount command -o option
|
|
Only applicable if mount type is volume.
|
|
type: list
|
|
elements: str
|
|
required: false
|
|
default: []
|
|
devices:
|
|
description:
|
|
- List of devices to be added inside the container.
|
|
- Defaults to <service_container_devices> if same image, [] otherwise.
|
|
type: list
|
|
required: false
|
|
elements: dict
|
|
options:
|
|
source:
|
|
description: Device path on host
|
|
type: str
|
|
required: true
|
|
destination:
|
|
description: Device path inside the container. Defaults to same as host.
|
|
type: str
|
|
required: false
|
|
publish_ports:
|
|
description: A list of ports to publish outside the container
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: dict
|
|
options:
|
|
name:
|
|
description:
|
|
- Name of the port.
|
|
- >-
|
|
If type is socket, the socket will be created at
|
|
/run/<service name>-<port name>-socat.sock on the host.
|
|
- If type is not socket, this is just informative.
|
|
type: str
|
|
required: true
|
|
container_port:
|
|
description: Container port to publish
|
|
type: int
|
|
required: true
|
|
protocol:
|
|
description: Protocol of the port
|
|
type: str
|
|
required: false
|
|
default: tcp
|
|
choices:
|
|
- tcp
|
|
- udp
|
|
type:
|
|
description: Whether to publish as a port or socket
|
|
type: str
|
|
required: false
|
|
default: port
|
|
choices:
|
|
- socket
|
|
- port
|
|
host_address:
|
|
description:
|
|
- IP or hostname to listen on on the host
|
|
- Ignored if type is socket
|
|
type: str
|
|
required: false
|
|
default: 0.0.0.0
|
|
host_port:
|
|
description:
|
|
- Port to listen on on the host
|
|
- Required if type is port, ignored otherwise
|
|
type: int
|
|
required: false
|
|
env:
|
|
description:
|
|
- A dict of environment variables for the container
|
|
- Defaults to <service_container_env> if same image, {} otherwise.
|
|
type: dict
|
|
required: false
|
|
add_capabilities:
|
|
description:
|
|
- List of capabilities to add to the container
|
|
- Defaults to <service_container_add_capabilities> if same image, [] otherwise.
|
|
type: list
|
|
required: false
|
|
elements: str
|
|
secrets:
|
|
description:
|
|
- >
|
|
A list of secrets available to the service container as file or environment
|
|
variable
|
|
- >
|
|
A dict of secrets and their values (including autogenerated values) is available as
|
|
`service_podman_secrets` for use in templates. This should only be used if the
|
|
container doesn't support reading the secret from file or environment variable.
|
|
- Defaults to <service_container_secrets> if same image, [] otherwise.
|
|
type: list
|
|
required: false
|
|
elements: dict
|
|
options:
|
|
name:
|
|
description: Name of the secret
|
|
type: str
|
|
required: true
|
|
value:
|
|
description:
|
|
- >
|
|
Value of the secret. Defaults to a 128-character random string containing
|
|
alphanumeric characters.
|
|
- >
|
|
If the value is not explicitly set, it will not be changed if the secret
|
|
already exists.
|
|
type: str
|
|
required: false
|
|
length:
|
|
description: Length of randomly generated string
|
|
type: int
|
|
required: false
|
|
default: 128
|
|
type:
|
|
description: How the secret will be exposed to the container
|
|
type: str
|
|
choices:
|
|
- mount
|
|
- env
|
|
default: mount
|
|
target:
|
|
description: >
|
|
Where the secret will be available inside the container. If type is mount, this is
|
|
either a full file path or a filename under /run/secrets. If type is env, this is
|
|
the name of the environment variable. Defaults to secret name.
|
|
type: str
|
|
required: false
|
|
requires:
|
|
description: >-
|
|
List of systemd units this container depends on, in addition to
|
|
service-wide requires.
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: str
|
|
wants:
|
|
description: >-
|
|
List of systemd units this container weakly depends on, in addition to
|
|
service-wide wants.
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: str
|
|
|
|
|
|
service_requires:
|
|
description: List of systemd units this service container depends on.
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: str
|
|
service_wants:
|
|
description: List of systemd units this service container weakly depends on.
|
|
type: list
|
|
required: false
|
|
default: []
|
|
elements: str
|
|
service_auto_update:
|
|
description: Whether to let podman automatically update the service containers whenever the specified image gets updated
|
|
type: bool
|
|
required: false
|
|
default: true
|