Feat: add link role

roles/podman_link/defaults/main.yml

@@ -0,0 +1,25 @@
+podman_link_podman_rootless_user: link
+podman_link_web_hostname: "{{ inventory_hostname }}"
+podman_link_postgres_zammad_user: postgres
+podman_link_postgres_zammad_database: zammad_production
+podman_link_postgres_link_user: link
+podman_link_postgres_link_database: link
+# podman_link_postgres_zammad_password:
+# podman_link_postgres_link_password:
+# podman_link_postgres_root_password:
+# podman_link_zammad_redis_password:
+# podman_link_opensearch_password:
+podman_link_opensearch_memory_limit: 2048
+podman_link_setup_mode: false
+podman_link_leafcutter_enabled: false
+podman_link_dashboard_url: ""
+podman_link_zammad_api_token: ""
+# podman_link_nextauth_secret:
+# podman_link_google_client_id:
+# podman_link_google_client_secret:
+#
+# the following may seem useless, but unless they are included as variables in the environment file template,
+# they automatically get wrapped in quotes by systemd causing zammad to not connect
+podman_link_postgres_zammad_postgresql_host: zammad-postgresql
+podman_link_postgres_zammad_es_host: opensearch
+podman_link_postgres_zammad_memcached_server: zammad-memcached:11211

roles/podman_link/handlers/main.yml

@@ -0,0 +1,26 @@
+- name: restart zammad-init
+  ansible.builtin.systemd_service:
+    name: zammad-init
+    state: restarted
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_link_podman_rootless_user }}"
+
+- name: restart zammad-postgresql
+  ansible.builtin.systemd_service:
+    name: zammad-postgresql
+    state: restarted
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_link_podman_rootless_user }}"
+
+- name: restart link.slice
+  ansible.builtin.systemd_service:
+    name: link.slice
+    state: restarted
+    scope: user
+    daemon_reload: true
+  become: true
+  become_user: "{{ podman_link_podman_rootless_user }}"

roles/podman_link/tasks/main.yml

@@ -0,0 +1,229 @@
+---
+- name: create service configuration directories
+  ansible.builtin.file:
+    path: "/home/{{ podman_link_podman_rootless_user }}/{{ item }}"
+    state: directory
+    owner: "{{ podman_link_podman_rootless_user }}"
+    group: "{{ podman_link_podman_rootless_user }}"
+    mode: "0755"
+  become: true
+  with_items:
+    - zammad-storage
+    - zammad-var
+    - zammad-backup
+    - zammad-data
+    - signal-cli-rest-api-data
+    - bridge-postgresql-data
+    - bridge-whatsapp-data
+    - redis-data
+    - postgresql-data
+
+- name: create configuration directories where containers need to execute scripts
+  ansible.builtin.file:
+    path: "/home/{{ podman_link_podman_rootless_user }}/{{ item }}"
+    state: directory
+    owner: "{{ podman_link_podman_rootless_user }}"
+    group: "{{ podman_link_podman_rootless_user }}"
+    mode: "0777"
+  become: true
+  with_items:
+    - zammad-config-nginx
+    - opensearch-data
+
+- name: install zammad railsserver database configuration file
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/home/{{ podman_link_podman_rootless_user }}/{{ item }}"
+    owner: "{{ podman_link_podman_rootless_user }}"
+    group: "{{ podman_link_podman_rootless_user }}"
+    mode: "0444"
+  become: true
+  with_items:
+    - zammad-database.yml
+
+- name: install env configuration files
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/home/{{ podman_link_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_link_podman_rootless_user }}"
+    mode: "0600"
+  become: true
+  with_items:
+    - common-zammad.env
+    - common-bridge.env
+
+- name: Set sysctl settings for elasticsearch
+  sysctl:
+    name: vm.max_map_count
+    value: '262144'
+    state: present
+  become: true
+
+- name: Set vm.overcommit_memory for Memcached
+  sysctl:
+    name: vm.overcommit_memory
+    value: '1'
+    state: present
+  become: true
+
+- name: install opensearch config
+  ansible.builtin.copy:
+    src: templates/opensearch-config.yml
+    dest: "/home/{{ podman_link_podman_rootless_user }}/opensearch-config.yml"
+    mode: "0444"
+    owner: "{{ podman_link_podman_rootless_user }}"
+    group: "{{ podman_link_podman_rootless_user }}"
+  become: true
+
+- name: install podman quadlet for rootless podman user
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/home/{{ podman_link_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_link_podman_rootless_user }}"
+    mode: "0400"
+  with_items:
+    - link.container
+    - zammad-opensearch.container
+    - opensearch-dashboards.container
+    - bridge-worker.container
+    - bridge-postgresql.container
+    - bridge-whatsapp.container
+    - signal-cli-rest-api.container
+    - zammad-init.container
+    - zammad-nginx.container
+    - zammad-railsserver.container
+    - zammad-scheduler.container
+    - zammad-postgresql.container
+    - zammad-websocket.container
+    - zammad-redis.container
+    - zammad-memcached.container
+  become: true
+
+
+- name: install network quadlets for rootless podman user
+  ansible.builtin.template:
+    src: "{{ item }}"
+    dest: "/home/{{ podman_link_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_link_podman_rootless_user }}"
+    mode: "0400"
+  with_items:
+    - frontend.network
+    - link.network
+  become: true
+
+- name: verify quadlets are correctly defined
+  ansible.builtin.command: /usr/libexec/podman/quadlet -dryrun -user
+  register: podman_link_quadlet_result
+  ignore_errors: true
+  changed_when: false
+  become: true
+  become_user: "{{ podman_link_podman_rootless_user }}"
+
+- name: assert that the quadlet verification succeeded
+  ansible.builtin.assert:
+    that:
+      - podman_link_quadlet_result.rc == 0
+    fail_msg: "'/usr/libexec/podman/quadlet -dryrun -user' failed! Output withheld to prevent leaking secrets."
+
+#- name: set up nginx
+#  ansible.builtin.include_role:
+#    name: irl.wip.podman_nginx
+#  vars:
+#    podman_nginx_frontend_network: frontend
+#    podman_nginx_podman_rootless_user: "{{ podman_link_podman_rootless_user }}"
+#    podman_nginx_primary_hostname: "{{ podman_link_web_hostname }}"
+#    podman_nginx_systemd_service_slice: "link.slice"
+#    podman_nginx_systemd_service_requires: ["zammad-nginx"]
+#
+#
+#- name: create nginx configuration file
+#  ansible.builtin.template:
+#    src: nginx.conf
+#    dest: "/home/{{ podman_link_podman_rootless_user }}/nginx/nginx.conf"
+#    owner: "{{ podman_link_podman_rootless_user }}"
+#    group: "{{ podman_link_podman_rootless_user }}"
+#    mode: "0644"
+#  become: true
+
+- name: install services slice for rootless podman user
+  ansible.builtin.template:
+    src: "link.slice"
+    dest: "/home/{{ podman_link_podman_rootless_user }}/.config/systemd/user/link.slice"
+    owner: "{{ podman_link_podman_rootless_user }}"
+    group:  "{{ podman_link_podman_rootless_user }}"
+    mode: "0655"
+  become: true
+
+- name: make sure services are started on boot
+  ansible.builtin.systemd_service:
+    name: "link.slice"
+    enabled: true
+    state: started
+    daemon_reload: true
+    scope: user
+  become: true
+  become_user: "{{ podman_link_podman_rootless_user }}"
+  notify:
+    - "restart link.slice"
+
+
+- name: set es verify false
+  ansible.builtin.shell: >
+    podman exec zammad-railsserver rails r "Setting.set('es_ssl_verify', false)"
+  become: true
+  become_user: "{{ podman_link_podman_rootless_user }}"
+  notify:
+    - "restart link.slice"
+  register: es_ssl_result
+  retries: 20
+  delay: 5
+  until: es_ssl_result.rc == 0
+
+- name: Run OpenSearch setup script
+  ansible.builtin.shell: |
+    podman exec zammad-opensearch /bin/sh -c '
+      if [ ! -f /tmp/.securityadmin_done ]; then
+        chmod +x /usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh && \
+        /usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh \
+          -cd /usr/share/opensearch/config/opensearch-security/ \
+          -icl \
+          -key /usr/share/opensearch/config/kirk-key.pem \
+          -cert /usr/share/opensearch/config/kirk.pem \
+          -cacert /usr/share/opensearch/config/root-ca.pem \
+          -nhnv && \
+        touch /tmp/.securityadmin_done
+      fi
+    '
+  become: true
+  become_user: "{{ podman_link_podman_rootless_user }}"
+  register: securityadmin_scipt_result
+  retries: 20
+  delay: 5
+  until: securityadmin_scipt_result.rc == 0
+  notify:
+    - "restart link.slice"
+
+- name: set up nginx
+  ansible.builtin.include_role:
+    name: irl.wip.podman_nginx
+  vars:
+    podman_nginx_frontend_network: frontend
+    podman_nginx_podman_rootless_user: "{{ podman_link_podman_rootless_user }}"
+    podman_nginx_primary_hostname: "{{ podman_link_web_hostname }}"
+    podman_nginx_systemd_service_slice: link.slice
+    podman_nginx_systemd_service_requires: ["zammad-nginx"]
+#    podman_nginx_additional_volumes:
+#      - src: "/home/{{ podman_cleaninsights_podman_rootless_user }}/matomo"
+#        dest: "/var/www/html"
+#        options: "ro"
+
+- name: create nginx configuration file
+  ansible.builtin.template:
+    src: nginx.conf
+    dest: "/home/{{ podman_link_podman_rootless_user }}/nginx/nginx.conf"
+    owner: "{{ podman_link_podman_rootless_user }}"
+    group: "{{ podman_link_podman_rootless_user }}"
+    mode: "0644"
+  become: true
+  notify:
+    - "restart link.slice"

roles/podman_link/templates/bridge-postgresql.container

@@ -0,0 +1,11 @@
+[Container]
+ContainerName=bridge-postgresql
+EnvironmentFile=common-bridge.env
+Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-postgresql-data:/var/lib/postgresql/data
+Network=link.network
+
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/bridge-whatsapp.container

@@ -0,0 +1,17 @@
+[Unit]
+Requires=bridge-postgresql.service link.service
+After=bridge-postgresql.service link.service
+
+[Container]
+ContainerName=bridge-whatsapp
+Environment=BRIDGE_FRONTEND_URL=http://systemd-link:3000/link
+EnvironmentFile=common-bridge.env
+ExposeHostPort=5000
+Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-whatsapp:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/bridge-whatsapp-data:/home/node/baileys
+Network=link.network
+
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/bridge-worker.container

@@ -0,0 +1,13 @@
+[Unit]
+Requires=bridge-postgresql.service link.service
+After=bridge-postgresql.service link.service
+
+[Container]
+ContainerName=bridge-worker
+EnvironmentFile=common-bridge.env
+Image=registry.gitlab.com/digiresilience/link/link-stack/bridge-worker:3.1.0b2
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/common-bridge.env

@@ -0,0 +1,18 @@
+POSTGRES_USER={{ podman_link_postgres_link_user }}
+POSTGRES_PASSWORD={{ podman_link_postgres_link_password }}
+POSTGRES_DB={{ podman_link_postgres_link_database }}
+NEXTAUTH_URL=https://{{ podman_link_web_hostname }}/link/api/auth
+NEXTAUTH_SECRET={{ podman_link_nextauth_secret }}
+GOOGLE_CLIENT_ID={{ podman_link_google_client_id }}
+GOOGLE_CLIENT_SECRET={{ podman_link_google_client_secret }}
+BRIDGE_FRONTEND_URL=http://link:3000
+BRIDGE_SIGNAL_URL=http://signal-cli-rest-api:8081
+BRIDGE_WHATSAPP_URL=http://bridge-whatsapp:5000
+DATABASE_NAME={{ podman_link_postgres_link_database }}
+DATABASE_HOST=bridge-postgresql
+DATABASE_USER={{ podman_link_postgres_link_user }}
+DATABASE_PASSWORD={{ podman_link_postgres_link_password }}
+DATABASE_PORT=5432
+DATABASE_URL=postgresql://{{ podman_link_postgres_link_user }}:{{ podman_link_postgres_link_password }}@bridge-postgresql/{{ podman_link_postgres_link_database}}
+TZ=Etc/UTC
+

roles/podman_link/templates/common-zammad.env

@@ -0,0 +1,13 @@
+POSTGRESQL_HOST=zammad-postgresql
+POSTGRESQL_PASS={{ podman_link_postgres_zammad_password }}
+POSTGRESQL_USER={{ podman_link_postgres_zammad_user }}
+POSTGRESQL_DB={{ podman_link_postgres_zammad_database }}
+POSTGRESQL_OPTIONS=?pool=50
+REDIS_URL=redis://default:{{ podman_link_zammad_redis_password }}@zammad-redis:6379
+MEMCACHE_SERVERS=zammad-memcached:11211
+ELASTICSEARCH_HOST=zammad-opensearch
+ELASTICSEARCH_USER=admin
+ELASTICSEARCH_PASS={{ podman_link_opensearch_password }}
+ELASTICSEARCH_SCHEMA=https
+ELASTICSEARCH_REINDEX=true
+ELASTICSEARCH_SSL_VERIFY=false

roles/podman_link/templates/frontend.network

@@ -0,0 +1,2 @@
+[Network]
+NetworkName=frontend

roles/podman_link/templates/link.container

@@ -0,0 +1,21 @@
+[Unit]
+Requires=bridge-postgresql.service
+After=bridge-postgresql.service
+
+[Container]
+ContainerName=link
+Environment=ZAMMAD_VIRTUAL_HOST={{ podman_link_web_hostname }}
+Environment=SETUP_MODE={{ podman_link_setup_mode }}
+Environment=LEAFCUTTER_ENABLED={{ podman_link_leafcutter_enabled }}
+Environment=LEAFCUTTER_DEFAULT_DASHBOARD_URL={{ podman_link_dashboard_url }}
+Environment=ZAMMAD_API_TOKEN={{ podman_link_zammad_api_token }}
+Environment=LINK_URL=https://localhost:3000/link
+Environment=ZAMMAD_URL=http://zammad-nginx:8080
+EnvironmentFile=common-bridge.env
+ExposeHostPort=3000
+Image=registry.gitlab.com/digiresilience/link/link-stack/link:3.1.0b2
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/link.network

@@ -0,0 +1,2 @@
+[Network]
+NetworkName=link

roles/podman_link/templates/link.slice

@@ -0,0 +1,22 @@
+[Unit]
+Description=Link Slice
+Before=slices.target
+Requires=zammad-init.service
+Requires=zammad-memcached.service
+Requires=zammad-postgresql.service
+Requires=zammad-redis.service
+Requires=zammad-railsserver.service
+Requires=zammad-scheduler.service
+Requires=zammad-websocket.service
+Requires=zammad-opensearch.service
+Requires=link.service
+Requires=bridge-postgresql.service
+Requires=zammad-nginx.service
+Requires=signal-cli-rest-api.service
+Requires=bridge-whatsapp.service
+Requires=bridge-worker.service
+Requires=opensearch-dashboards.service
+Requires=nginx.service
+
+[Install]
+WantedBy=default.target

roles/podman_link/templates/nginx.conf

@@ -0,0 +1,91 @@
+# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
+# scheme used to connect to this server
+map $http_x_forwarded_proto $proxy_x_forwarded_proto {
+  default $http_x_forwarded_proto;
+  ''      $scheme;
+}
+# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
+# server port the client connected to
+map $http_x_forwarded_port $proxy_x_forwarded_port {
+  default $http_x_forwarded_port;
+  ''      $server_port;
+}
+# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
+# Connection header that may have been passed to this server
+map $http_upgrade $proxy_connection {
+  default upgrade;
+  '' close;
+}
+# Apply fix for very long server names
+server_names_hash_bucket_size 128;
+# Default dhparam
+# Set appropriate X-Forwarded-Ssl header
+map $scheme $proxy_x_forwarded_ssl {
+  default off;
+  https on;
+}
+gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+log_format vhost '$host $remote_addr - $remote_user [$time_local] '
+                 '"$request" $status $body_bytes_sent '
+                 '"$http_referer" "$http_user_agent"';
+access_log off;
+# HTTP 1.1 support
+proxy_http_version 1.1;
+proxy_buffering off;
+proxy_set_header Host $http_host;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $proxy_connection;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
+proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+# Mitigate httpoxy attack (see README for details)
+proxy_set_header Proxy "";
+
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name {{ podman_link_web_hostname }};
+    server_tokens off;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://{{ podman_link_web_hostname }}$request_uri;
+    }
+}
+
+upstream zammad {
+			server zammad-nginx:8080;
+}
+
+server {
+	server_name {{ podman_link_web_hostname }};
+	listen 80 ;
+	access_log /var/log/nginx/access.log vhost;
+	return 301 https://$host$request_uri;
+}
+
+server {
+	server_name {{ podman_link_web_hostname }};
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_tokens off;
+
+    ssl_certificate /etc/letsencrypt/live/{{ podman_link_web_hostname }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ podman_link_web_hostname }}/privkey.pem;
+
+
+	add_header Strict-Transport-Security "max-age=31536000" always;
+	add_header Referrer-Policy origin always; # make sure outgoing links don't show the URL to the Matomo instance
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+	location / {
+		proxy_pass http://zammad;
+	}
+}

roles/podman_link/templates/opensearch-config.yml

@@ -0,0 +1,36 @@
+_meta:
+  type: "config"
+  config_version: 2
+
+config:
+  dynamic:
+    http:
+      anonymous_auth_enabled: false
+      xff:
+        enabled: true
+        remoteIpHeader: "x-forwarded-for"
+        internalProxies: ".*"
+    authc:
+      basic_internal_auth_domain:
+        description: "Authenticate via HTTP Basic against internal users database"
+        http_enabled: true
+        transport_enabled: true
+        order: 0
+        http_authenticator:
+          type: basic
+          challenge: false
+        authentication_backend:
+          type: intern
+      proxy_auth_domain:
+        description: "Authenticate via proxy"
+        http_enabled: true
+        transport_enabled: true
+        order: 1
+        http_authenticator:
+          type: proxy
+          challenge: false
+          config:
+            user_header: "x-forwarded-user"
+            roles_header: "x-forwarded-roles"
+        authentication_backend:
+          type: noop

roles/podman_link/templates/opensearch-dashboards.container

@@ -0,0 +1,16 @@
+[Unit]
+Requires=zammad-opensearch.service
+After=zammad-opensearch.service
+
+[Container]
+ContainerName=opensearch-dashboards
+Environment=OPENSEARCH_USERNAME="kibanaserver"
+Environment=OPENSEARCH_PASSWORD="kibanaserver"
+Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch-dashboards:3.1.0b2
+PublishPort=127.0.0.1:5601:5601
+#Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-dashboards-config.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/signal-cli-rest-api.container

@@ -0,0 +1,16 @@
+[Unit]
+Requires=link.service
+After=link.service
+
+[Container]
+ContainerName=signal-cli-rest-api
+Environment=MODE=native
+Environment=PORT=8081
+ExposeHostPort=8081
+Image=registry.gitlab.com/digiresilience/link/link-stack/signal-cli-rest-api:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/signal-cli-rest-api-data:/home/.local/share/signal-cli
+Network=link.network
+
+[Service]
+Restart=always
+slice=link.slice

roles/podman_link/templates/zammad-database.yml

@@ -0,0 +1,9 @@
+production:
+  adapter: postgresql
+  database: {{ podman_link_postgres_zammad_database }}
+  pool: 50
+  timeout: 5000
+  encoding: utf8
+  username: {{ podman_link_postgres_zammad_user }}
+  password: {{ podman_link_postgres_zammad_password }}
+  host: zammad-postgresql

roles/podman_link/templates/zammad-init.container

@@ -0,0 +1,21 @@
+[Unit]
+Requires=zammad-postgresql.service
+After=zammad-postgresql.service
+Requires=zammad-redis.service
+After=zammad-redis.service
+Requires=zammad-memcached.service
+After=zammad-memcached.service
+
+[Container]
+ContainerName=zammad-init
+EnvironmentFile=common-zammad.env
+Exec=zammad-init
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage:ro
+Network=link.network
+
+[Service]
+Restart=on-failure
+Slice=link.slice

roles/podman_link/templates/zammad-memcached.container

@@ -0,0 +1,10 @@
+[Container]
+ContainerName=zammad-memcached
+Exec=memcached -m 256M
+Image=registry.gitlab.com/digiresilience/link/link-stack/memcached:3.1.0b2
+Network=link.network
+ExposeHostPort=11211
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-nginx.container

@@ -0,0 +1,18 @@
+[Unit]
+Requires=zammad-railsserver.service
+After=zammad-railsserver.service
+
+[Container]
+ContainerName=zammad-nginx
+EnvironmentFile=common-zammad.env
+Exec=zammad-nginx
+ExposeHostPort=8080
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-config-nginx:/etc/nginx/sites-enabled
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var:ro
+Network=link.network
+Network=frontend.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-opensearch.container

@@ -0,0 +1,24 @@
+[Container]
+ContainerName=zammad-opensearch
+Environment=discovery.type=single-node
+Environment=plugins.security.ssl.transport.enforce_hostname_verification=false
+Environment=plugins.security.ssl.transport.resolve_hostname=false
+Environment=cluster.routing.allocation.disk.watermark.low=3gb
+Environment=cluster.routing.allocation.disk.watermark.high=2gb
+Environment=cluster.routing.allocation.disk.watermark.flood_stage=500mb
+Environment=cluster.info.update.interval=1m
+Environment=node.name=opensearch-node1
+Environment=bootstrap.memory_lock=true
+Environment=OPENSEARCH_JAVA_OPTS="-Xms{{ podman_link_opensearch_memory_limit }}m -Xmx{{podman_link_opensearch_memory_limit }}m -XX:-HeapDumpOnOutOfMemoryError"
+Environment=OPENSEARCH_INITIAL_ADMIN_PASSWORD={{ podman_link_opensearch_password }}
+Environment=compatibility.override_main_response_version=true
+Image=registry.gitlab.com/digiresilience/link/link-stack/opensearch:3.1.0b2
+PublishPort=127.0.0.1:9200:9200
+PublishPort=127.0.0.1:9600:9600
+Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-data:/usr/share/opensearch/data
+Volume=/home/{{ podman_link_podman_rootless_user }}/opensearch-config.yml:/usr/share/opensearch/config/opensearch-security/config.yml
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-postgresql.container

@@ -0,0 +1,17 @@
+[Container]
+ContainerName=zammad-postgresql
+Environment=POSTGRES_PASSWORD={{ podman_link_postgres_zammad_password }}
+Environment=POSTGRES_USER={{ podman_link_postgres_zammad_user }}
+Environment=POSTGRES_DB={{ podman_link_postgres_zammad_database }}
+Environment=POSTGRES_HOST_AUTH_METHOD=scram-sha-256
+Environment=POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256
+Image=registry.gitlab.com/digiresilience/link/link-stack/postgresql:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/postgresql-data:/var/lib/postgresql/data
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-data:/opt/zammad
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-backup:/var/tmp/zammad:ro
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice
+

roles/podman_link/templates/zammad-railsserver.container

@@ -0,0 +1,17 @@
+[Unit]
+Requires=zammad-memcached.service zammad-redis.service zammad-postgresql.service
+After=zammad-memcached.service zammad-redis.service zammad-postgresql.service
+
+[Container]
+ContainerName=zammad-railsserver
+EnvironmentFile=common-zammad.env
+Exec=zammad-railsserver
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-database.yml:/opt/zammad/config/database.yml:ro
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-redis.container

@@ -0,0 +1,10 @@
+[Container]
+ContainerName=zammad-redis
+Environment=REDIS_PASSWORD={{ podman_link_zammad_redis_password }}
+Image=registry.gitlab.com/digiresilience/link/link-stack/redis:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/redis-data:/data
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-scheduler.container

@@ -0,0 +1,16 @@
+[Unit]
+Requires=zammad-memcached.service zammad-railsserver.service zammad-redis.service
+After=zammad-memcached.service zammad-railsserver.service zammad-redis.service
+
+[Container]
+ContainerName=zammad-scheduler
+EnvironmentFile=common-zammad.env
+Exec=zammad-scheduler
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice

roles/podman_link/templates/zammad-websocket.container

@@ -0,0 +1,16 @@
+[Unit]
+Requires=zammad-memcached.service zammad-railsserver.service zammad-redis.service
+After=zammad-memcached.service zammad-railsserver.service zammad-redis.service
+
+[Container]
+ContainerName=zammad-websocket
+EnvironmentFile=common-zammad.env
+Exec=zammad-websocket
+Image=registry.gitlab.com/digiresilience/link/link-stack/zammad:3.1.0b2
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-var:/opt/zammad/var
+Volume=/home/{{ podman_link_podman_rootless_user }}/zammad-storage:/opt/zammad/storage
+Network=link.network
+
+[Service]
+Restart=always
+Slice=link.slice