Joakim
b42ee2a22b
Resolves authentik deployment issues by implementing proper Podman Quadlet configuration and fixing networking for external access through Caddy. Core Fixes: • Add missing [Install] sections to container Quadlet files for systemd service generation • Fix pod references from 'systemd-authentik' to 'authentik.pod' for proper Quadlet linking • Remove problematic --userns=host to use proper rootless user namespaces • Configure subuid/subgid ranges for authentik user (200000:65536) • Update networking to bind 0.0.0.0:9000 only (remove unnecessary HTTPS port 9443) • Add AUTHENTIK_LISTEN__HTTP=0.0.0.0:9000 environment configuration • Fix Caddy reverse proxy to use HTTP backend instead of HTTPS Infrastructure Updates: • Enhance PostgreSQL role with Unix socket configuration and user management • Improve Valkey role with proper systemd integration and socket permissions • Add comprehensive service integration documentation • Update deployment playbooks with backup and restore capabilities Security Improvements: • Secure network isolation with Caddy SSL termination • Reduced attack surface by removing direct HTTPS container exposure • Proper rootless container configuration with user namespace mapping Result: authentik now fully operational with external HTTPS access via auth.jnss.me All systemd services (authentik-pod, authentik-server, authentik-worker) running correctly.
100 lines
3.0 KiB
YAML
100 lines
3.0 KiB
YAML
---
|
|
# Sigvild Gallery Data Backup Tasks
|
|
|
|
- name: Create local backup directory
|
|
local_action:
|
|
module: file
|
|
path: "{{ sigvild_gallery_backup_local_path }}/{{ ansible_date_time.iso8601_basic_short }}"
|
|
state: directory
|
|
mode: '0755'
|
|
become: false
|
|
run_once: true
|
|
|
|
- name: Display backup information
|
|
debug:
|
|
msg:
|
|
- "Creating backup of Sigvild Gallery data..."
|
|
- "Data directory: {{ sigvild_gallery_data_dir }}"
|
|
- "Backup will be saved to: {{ sigvild_gallery_backup_local_path }}"
|
|
- "Timestamp: {{ ansible_date_time.iso8601_basic_short }}"
|
|
|
|
- name: Check if data directory exists
|
|
stat:
|
|
path: "{{ sigvild_gallery_data_dir }}"
|
|
register: data_dir_stat
|
|
|
|
- name: Fail if no data directory found
|
|
fail:
|
|
msg: "No data directory found at {{ sigvild_gallery_data_dir }}. Nothing to backup."
|
|
when: not data_dir_stat.stat.exists
|
|
|
|
- name: Display data directory size
|
|
command: du -sh {{ sigvild_gallery_data_dir }}
|
|
register: data_size
|
|
changed_when: false
|
|
|
|
- name: Show data size
|
|
debug:
|
|
msg: "Data directory size: {{ data_size.stdout }}"
|
|
|
|
- name: Stop sigvild-gallery service for consistent backup
|
|
systemd:
|
|
name: sigvild-gallery
|
|
state: stopped
|
|
register: service_stopped
|
|
|
|
- name: Create compressed backup of pb_data
|
|
archive:
|
|
path: "{{ sigvild_gallery_data_dir }}"
|
|
dest: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
|
|
format: gz
|
|
owner: "{{ sigvild_gallery_user }}"
|
|
group: "{{ sigvild_gallery_user }}"
|
|
mode: '0644'
|
|
register: backup_created
|
|
|
|
- name: Verify backup contains critical files
|
|
command: tar -tzf /tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz
|
|
register: backup_contents
|
|
changed_when: false
|
|
failed_when:
|
|
- "'data.db' not in backup_contents.stdout"
|
|
|
|
- name: Display backup verification
|
|
debug:
|
|
msg: "Backup verified - contains required database files"
|
|
|
|
- name: Get backup file size
|
|
stat:
|
|
path: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
|
|
register: backup_file_stat
|
|
|
|
- name: Display backup file info
|
|
debug:
|
|
msg: "Backup file created: {{ (backup_file_stat.stat.size / 1024 / 1024) | round(2) }}MB"
|
|
when: backup_file_stat.stat.exists
|
|
|
|
- name: Download backup to local machine
|
|
fetch:
|
|
src: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
|
|
dest: "{{ sigvild_gallery_backup_local_path }}/"
|
|
flat: yes
|
|
register: backup_downloaded
|
|
|
|
- name: Clean up remote backup file
|
|
file:
|
|
path: "/tmp/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
|
|
state: absent
|
|
|
|
- name: Restart sigvild-gallery service
|
|
systemd:
|
|
name: sigvild-gallery
|
|
state: started
|
|
when: service_stopped.changed
|
|
|
|
- name: Display backup completion
|
|
debug:
|
|
msg:
|
|
- "✅ Backup completed successfully!"
|
|
- "Local backup location: {{ sigvild_gallery_backup_local_path }}/sigvild-gallery-backup-{{ ansible_date_time.iso8601_basic_short }}.tar.gz"
|
|
- "Service has been restarted." |