Joakim
4f8da38ca6
## New Features - **Nextcloud Role**: Complete cloud storage deployment using Podman Quadlet - FPM variant with Caddy reverse proxy and FastCGI - PostgreSQL database via Unix socket - Valkey/Redis for app-level caching and file locking - Automatic HTTPS with Let's Encrypt via Caddy - Dual-root pattern: Caddy serves static assets, FPM handles PHP - **Split Caching Strategy**: Redis caching WITHOUT Redis sessions - Custom redis.config.php template for app-level caching only - File-based PHP sessions for stability (avoids session lock issues) - Prevents cascading failures from session lock contention - Documented in role README with detailed rationale ## Infrastructure Updates - **Socket Permissions**: Update PostgreSQL and Valkey to mode 777 - Required for containers that switch users (root → www-data) - Nextcloud container loses supplementary groups on user switch - Security maintained via password authentication (scram-sha-256, requirepass) - Documented socket permission architecture in docs/ - **PostgreSQL**: Export client group GID as fact for dependent roles - **Valkey**: Export client group GID as fact, update socket fix service ## Documentation - New: docs/socket-permissions-architecture.md - Explains 777 vs 770 socket permission trade-offs - Documents why group-based access doesn't work for user-switching containers - Provides TCP alternative for stricter security requirements - Updated: All role READMEs with socket permission notes - New: Nextcloud README with comprehensive deployment, troubleshooting, and Redis architecture documentation ## Configuration - host_vars: Add Nextcloud vault variables and configuration - site.yml: Include Nextcloud role in main playbook ## Technical Details **Why disable Redis sessions?** The official Nextcloud container enables Redis session handling via REDIS_HOST env var, which causes severe performance issues: 1. Session lock contention under high concurrency (browser parallel asset requests) 2. Infinite lock retries (default lock_retries=-1) blocking FPM workers 3. Timeout orphaning: reverse proxy kills connection, worker keeps lock 4. Worker pool exhaustion: all 5 default workers blocked on same session lock 5. Cascading failure: new requests queue, more timeouts, more orphaned locks Solution: Use file-based sessions (reliable, fast for single-server) while keeping Redis for distributed cache and transactional file locking via custom config file. This provides optimal performance without the complexity of Redis session debugging. Tested: Fresh deployment on arch-vps (69.62.119.31) Domain: https://cloud.jnss.me/
99 lines
3.3 KiB
YAML
99 lines
3.3 KiB
YAML
---
|
|
# =================================================================
|
|
# Production Configuration for arch-vps (jnss.me)
|
|
# =================================================================
|
|
|
|
# =================================================================
|
|
# TLS Configuration - Production Setup
|
|
# =================================================================
|
|
caddy_tls_enabled: true
|
|
caddy_domain: "jnss.me"
|
|
caddy_tls_email: "{{ vault_caddy_tls_email }}"
|
|
|
|
# DNS Challenge Configuration (Cloudflare)
|
|
caddy_dns_provider: "cloudflare"
|
|
cloudflare_api_token: "{{ vault_cloudflare_api_token }}"
|
|
|
|
# Production Let's Encrypt CA
|
|
caddy_acme_ca: "https://acme-v02.api.letsencrypt.org/directory"
|
|
|
|
# =================================================================
|
|
# API Service Registration Configuration
|
|
# =================================================================
|
|
# Services now self-register using Caddy's admin API
|
|
caddy_api_enabled: true
|
|
caddy_server_name: "main"
|
|
|
|
# =================================================================
|
|
# Sigvild Gallery Configuration
|
|
# =================================================================
|
|
sigvild_gallery_frontend_domain: "sigvild.no"
|
|
sigvild_gallery_api_domain: "api.sigvild.no"
|
|
|
|
sigvild_gallery_local_project_path: "~/sigvild-gallery/"
|
|
|
|
# Backup configuration
|
|
sigvild_gallery_backup_enabled: true
|
|
sigvild_gallery_backup_local_path: "~/sigvild-gallery-backup/"
|
|
|
|
# Vault-encrypted passwords (create with ansible-vault)
|
|
sigvild_gallery_pb_su_email: "{{ vault_pb_su_email}}"
|
|
sigvild_gallery_pb_su_password: "{{ vault_pb_su_password}}"
|
|
sigvild_gallery_host_password: "{{ vault_sigvild_host_password }}"
|
|
sigvild_gallery_guest_password: "{{ vault_sigvild_guest_password }}"
|
|
|
|
# =================================================================
|
|
# Authentik Configuration
|
|
# =================================================================
|
|
authentik_domain: "auth.jnss.me"
|
|
|
|
# Database configuration
|
|
authentik_db_name: "authentik"
|
|
authentik_db_user: "authentik"
|
|
authentik_db_password: "{{ vault_authentik_db_password }}"
|
|
|
|
# Cache configuration
|
|
authentik_valkey_db: 1
|
|
|
|
# Core configuration
|
|
authentik_secret_key: "{{ vault_authentik_secret_key }}"
|
|
authentik_default_admin_email: "admin@jnss.me"
|
|
authentik_default_admin_password: "{{ vault_authentik_admin_password }}"
|
|
|
|
# Service configuration
|
|
authentik_service_enabled: true
|
|
authentik_service_state: "started"
|
|
|
|
# Infrastructure socket configuration
|
|
postgresql_unix_socket_enabled: true
|
|
postgresql_listen_addresses: "" # Socket-only mode (no TCP)
|
|
valkey_unix_socket_enabled: true
|
|
|
|
# =================================================================
|
|
# Nextcloud Configuration
|
|
# =================================================================
|
|
nextcloud_domain: "cloud.jnss.me"
|
|
|
|
# Database configuration
|
|
nextcloud_db_name: "nextcloud"
|
|
nextcloud_db_user: "nextcloud"
|
|
nextcloud_db_password: "{{ vault_nextcloud_db_password }}"
|
|
|
|
# Cache configuration
|
|
nextcloud_valkey_db: 2 # Authentik uses 1
|
|
|
|
# Admin configuration
|
|
nextcloud_admin_user: "admin"
|
|
nextcloud_admin_password: "{{ vault_nextcloud_admin_password }}"
|
|
|
|
# Service configuration
|
|
nextcloud_service_enabled: true
|
|
nextcloud_service_state: "started"
|
|
|
|
# =================================================================
|
|
# Security & Logging
|
|
# =================================================================
|
|
caddy_log_level: "INFO"
|
|
caddy_log_format: "json"
|
|
caddy_systemd_security: true
|