Joakim
b42ee2a22b
Resolves authentik deployment issues by implementing proper Podman Quadlet configuration and fixing networking for external access through Caddy. Core Fixes: • Add missing [Install] sections to container Quadlet files for systemd service generation • Fix pod references from 'systemd-authentik' to 'authentik.pod' for proper Quadlet linking • Remove problematic --userns=host to use proper rootless user namespaces • Configure subuid/subgid ranges for authentik user (200000:65536) • Update networking to bind 0.0.0.0:9000 only (remove unnecessary HTTPS port 9443) • Add AUTHENTIK_LISTEN__HTTP=0.0.0.0:9000 environment configuration • Fix Caddy reverse proxy to use HTTP backend instead of HTTPS Infrastructure Updates: • Enhance PostgreSQL role with Unix socket configuration and user management • Improve Valkey role with proper systemd integration and socket permissions • Add comprehensive service integration documentation • Update deployment playbooks with backup and restore capabilities Security Improvements: • Secure network isolation with Caddy SSL termination • Reduced attack surface by removing direct HTTPS container exposure • Proper rootless container configuration with user namespace mapping Result: authentik now fully operational with external HTTPS access via auth.jnss.me All systemd services (authentik-pod, authentik-server, authentik-worker) running correctly.
48 lines
1.2 KiB
YAML
48 lines
1.2 KiB
YAML
---
|
|
# Backend Deployment Tasks
|
|
|
|
- name: Build Go binary locally
|
|
local_action:
|
|
module: shell
|
|
cmd: GOOS=linux GOARCH=amd64 go build -o sigvild-gallery .
|
|
chdir: "{{ sigvild_gallery_local_project_path }}"
|
|
become: no
|
|
tags: [backend, build]
|
|
|
|
- name: Check if binary was built successfully
|
|
local_action:
|
|
module: stat
|
|
path: "{{ sigvild_gallery_local_project_path }}/sigvild-gallery"
|
|
register: binary_stat
|
|
become: no
|
|
tags: [backend, build]
|
|
|
|
- name: Fail if binary doesn't exist
|
|
fail:
|
|
msg: "Failed to build sigvild-gallery binary"
|
|
when: not binary_stat.stat.exists
|
|
tags: [backend, build]
|
|
|
|
- name: Transfer Go binary
|
|
copy:
|
|
src: "{{ sigvild_gallery_local_project_path }}/sigvild-gallery"
|
|
dest: "{{ sigvild_gallery_binary }}"
|
|
owner: "{{ sigvild_gallery_user }}"
|
|
group: "{{ sigvild_gallery_user }}"
|
|
mode: '0755'
|
|
notify: restart sigvild-gallery
|
|
tags: [backend]
|
|
|
|
- name: Restore data from backup if available
|
|
include_tasks: restore.yml
|
|
tags: [backend, restore]
|
|
|
|
- name: Create data directory for PocketBase
|
|
file:
|
|
path: "{{ sigvild_gallery_data_dir }}"
|
|
state: directory
|
|
owner: "{{ sigvild_gallery_user }}"
|
|
group: "{{ sigvild_gallery_user }}"
|
|
mode: '0755'
|
|
tags: [backend]
|