Joakim
b42ee2a22b
Resolves authentik deployment issues by implementing proper Podman Quadlet configuration and fixing networking for external access through Caddy. Core Fixes: • Add missing [Install] sections to container Quadlet files for systemd service generation • Fix pod references from 'systemd-authentik' to 'authentik.pod' for proper Quadlet linking • Remove problematic --userns=host to use proper rootless user namespaces • Configure subuid/subgid ranges for authentik user (200000:65536) • Update networking to bind 0.0.0.0:9000 only (remove unnecessary HTTPS port 9443) • Add AUTHENTIK_LISTEN__HTTP=0.0.0.0:9000 environment configuration • Fix Caddy reverse proxy to use HTTP backend instead of HTTPS Infrastructure Updates: • Enhance PostgreSQL role with Unix socket configuration and user management • Improve Valkey role with proper systemd integration and socket permissions • Add comprehensive service integration documentation • Update deployment playbooks with backup and restore capabilities Security Improvements: • Secure network isolation with Caddy SSL termination • Reduced attack surface by removing direct HTTPS container exposure • Proper rootless container configuration with user namespace mapping Result: authentik now fully operational with external HTTPS access via auth.jnss.me All systemd services (authentik-pod, authentik-server, authentik-worker) running correctly.
126 lines
3.9 KiB
YAML
126 lines
3.9 KiB
YAML
---
|
||
# Sigvild Gallery Data Restoration Tasks
|
||
|
||
- name: Check for existing data backup files
|
||
local_action:
|
||
module: find
|
||
paths: "{{ sigvild_gallery_backup_local_path }}"
|
||
patterns: "sigvild-gallery-backup-*.tar.gz"
|
||
register: backup_files
|
||
become: false
|
||
|
||
- name: Display backup search results
|
||
debug:
|
||
msg:
|
||
- "Searching for backups in: {{ sigvild_gallery_backup_local_path }}"
|
||
- "Found {{ backup_files.files | length }} backup file(s)"
|
||
|
||
- name: Display found backup files
|
||
debug:
|
||
msg: "Found backup: {{ item.path }} ({{ (item.size / 1024 / 1024) | round(2) }}MB, {{ item.mtime | to_datetime }})"
|
||
loop: "{{ backup_files.files | sort(attribute='mtime') }}"
|
||
when: backup_files.files | length > 0
|
||
|
||
- name: Check if data directory already exists with data
|
||
stat:
|
||
path: "{{ sigvild_gallery_data_dir }}/data.db"
|
||
register: existing_data
|
||
|
||
- name: Warn about existing data
|
||
debug:
|
||
msg: "⚠️ WARNING: Existing data found at {{ sigvild_gallery_data_dir }}/data.db - restoration will overwrite it!"
|
||
when:
|
||
- existing_data.stat.exists
|
||
- backup_files.files | length > 0
|
||
|
||
- name: Restore from latest backup
|
||
block:
|
||
- name: Get latest backup file
|
||
set_fact:
|
||
latest_backup: "{{ (backup_files.files | sort(attribute='mtime') | last).path }}"
|
||
|
||
- name: Display restoration info
|
||
debug:
|
||
msg:
|
||
- "Restoring from latest backup: {{ latest_backup | basename }}"
|
||
- "Target directory: {{ sigvild_gallery_data_dir }}"
|
||
|
||
- name: Stop sigvild-gallery service before restoration
|
||
systemd:
|
||
name: sigvild-gallery
|
||
state: stopped
|
||
register: service_stopped_for_restore
|
||
ignore_errors: true # Service might not exist on fresh deployment
|
||
|
||
- name: Upload backup to remote server
|
||
copy:
|
||
src: "{{ latest_backup }}"
|
||
dest: "/tmp/restore-backup.tar.gz"
|
||
owner: root
|
||
group: root
|
||
mode: '0644'
|
||
|
||
- name: Verify uploaded backup integrity
|
||
command: tar -tzf /tmp/restore-backup.tar.gz
|
||
register: restore_contents
|
||
changed_when: false
|
||
failed_when: "'data.db' not in restore_contents.stdout"
|
||
|
||
- name: Remove existing data directory if it exists
|
||
file:
|
||
path: "{{ sigvild_gallery_data_dir }}"
|
||
state: absent
|
||
when: existing_data.stat.exists
|
||
|
||
- name: Ensure parent directory exists
|
||
file:
|
||
path: "{{ sigvild_gallery_home }}"
|
||
state: directory
|
||
owner: "{{ sigvild_gallery_user }}"
|
||
group: "{{ sigvild_gallery_user }}"
|
||
mode: '0755'
|
||
|
||
- name: Extract backup to target location
|
||
unarchive:
|
||
src: "/tmp/restore-backup.tar.gz"
|
||
dest: "{{ sigvild_gallery_home }}"
|
||
remote_src: true
|
||
owner: "{{ sigvild_gallery_user }}"
|
||
group: "{{ sigvild_gallery_user }}"
|
||
|
||
- name: Verify restoration
|
||
stat:
|
||
path: "{{ sigvild_gallery_data_dir }}/data.db"
|
||
register: restored_data
|
||
|
||
- name: Fail if restoration unsuccessful
|
||
fail:
|
||
msg: "Restoration failed - data.db not found after extraction"
|
||
when: not restored_data.stat.exists
|
||
|
||
- name: Get restored data size
|
||
command: du -sh {{ sigvild_gallery_data_dir }}
|
||
register: restored_size
|
||
changed_when: false
|
||
|
||
- name: Clean up uploaded backup file
|
||
file:
|
||
path: "/tmp/restore-backup.tar.gz"
|
||
state: absent
|
||
|
||
- name: Display restoration success
|
||
debug:
|
||
msg:
|
||
- "✅ Data restoration completed successfully!"
|
||
- "Restored from: {{ latest_backup | basename }}"
|
||
- "Restored data size: {{ restored_size.stdout }}"
|
||
- "Location: {{ sigvild_gallery_data_dir }}"
|
||
|
||
when: backup_files.files | length > 0
|
||
|
||
- name: No backup available message
|
||
debug:
|
||
msg:
|
||
- "ℹ️ No backup files found - starting with fresh installation"
|
||
- "Data directory will be created empty: {{ sigvild_gallery_data_dir }}"
|
||
when: backup_files.files | length == 0 |