Joakim
3506e55016
Major architectural change from rootless user services to system-level (rootful) containers to enable group-based Unix socket access for containerized applications. Infrastructure Changes: - PostgreSQL: Export postgres-clients group GID as Ansible fact - Valkey: Export valkey-clients group GID as Ansible fact - Valkey: Add socket-fix service to maintain correct socket group ownership - Both: Set socket directories to 770 with client group ownership Authentik Role Refactoring: - Remove rootless container configuration (subuid/subgid, lingering, user systemd) - Deploy Quadlet files to /etc/containers/systemd/ (system-level) - Use dynamic GID facts in container PodmanArgs (--group-add) - Simplify user creation to system user with infrastructure group membership - Update handlers for system scope service management - Remove unnecessary container security options (no user namespace isolation) Container Template Changes: - Pod: Remove --userns args, change WantedBy to multi-user.target - Containers: Replace Annotation with PodmanArgs using dynamic GIDs - Remove /dev/shm mounts and SecurityLabelDisable (not needed for rootful) - Change WantedBy to multi-user.target for system services Documentation Updates: - Add ADR-005: Rootful Containers with Infrastructure Fact Pattern - Update ADR-003: Podman + systemd for system-level deployment - Update authentik-deployment-guide.md for system scope commands - Update service-integration-guide.md with rootful pattern examples - Document discarded rootless approach and rationale Why Rootful Succeeds: - Direct UID/GID mapping preserves supplementary groups - Container process groups match host socket group ownership - No user namespace remapping breaking permissions Why Rootless Failed (Discarded): - User namespace UID/GID remapping broke group-based socket access - Supplementary groups remapped into subgid range didn't match socket ownership - Even with --userns=host and keep_original_groups, permissions failed Pattern Established: - Infrastructure roles create client groups and export GID facts - Application roles validate facts and consume in container templates - Rootful containers run as dedicated users with --group-add for socket access - System-level deployment provides standard systemd service management Deployment Validated: - Services in /system.slice/ ✓ - Process groups: 961 (valkey-clients), 962 (postgres-clients), 966 (authentik) ✓ - Socket permissions: 770 with client groups ✓ - HTTP endpoint responding ✓
63 lines
1.7 KiB
YAML
63 lines
1.7 KiB
YAML
---
|
|
# Cache setup for Authentik - Self-contained socket permissions
|
|
|
|
- name: Add authentik user to Valkey client group for socket access
|
|
user:
|
|
name: "{{ authentik_user }}"
|
|
groups: "{{ valkey_client_group }}"
|
|
append: true
|
|
|
|
- name: Test Valkey socket connectivity
|
|
command: >
|
|
redis-cli -s {{ valkey_unix_socket_path }}
|
|
-a {{ valkey_password }}
|
|
-n {{ authentik_valkey_db }}
|
|
ping
|
|
become: true
|
|
become_user: "{{ authentik_user }}"
|
|
register: valkey_socket_test
|
|
failed_when: valkey_socket_test.stdout != "PONG"
|
|
changed_when: false
|
|
|
|
- name: Configure Authentik Valkey database
|
|
command: >
|
|
redis-cli -s {{ valkey_unix_socket_path }}
|
|
-a {{ valkey_password }}
|
|
-n {{ authentik_valkey_db }}
|
|
CONFIG SET save ""
|
|
become: true
|
|
become_user: "{{ authentik_user }}"
|
|
register: valkey_config_result
|
|
changed_when: true
|
|
|
|
- name: Verify Authentik can write to Valkey database
|
|
command: >
|
|
redis-cli -s {{ valkey_unix_socket_path }}
|
|
-a {{ valkey_password }}
|
|
-n {{ authentik_valkey_db }}
|
|
SET authentik:healthcheck "deployed"
|
|
become: true
|
|
become_user: "{{ authentik_user }}"
|
|
register: valkey_write_test
|
|
changed_when: false
|
|
|
|
- name: Clean up Valkey test key
|
|
command: >
|
|
redis-cli -s {{ valkey_unix_socket_path }}
|
|
-a {{ valkey_password }}
|
|
-n {{ authentik_valkey_db }}
|
|
DEL authentik:healthcheck
|
|
become: true
|
|
become_user: "{{ authentik_user }}"
|
|
changed_when: false
|
|
|
|
- name: Display cache setup status
|
|
debug:
|
|
msg: |
|
|
✅ Authentik cache setup complete!
|
|
|
|
🗄️ Cache DB: {{ authentik_valkey_db }}
|
|
🔌 Connection: Unix socket ({{ valkey_unix_socket_path }})
|
|
📊 Test: {{ valkey_socket_test.stdout }}
|
|
|
|
🏗️ Ready for Authentik container deployment |