feat(podman_seafile): initial import

roles/podman_seafile/tasks/main.yml

@@ -0,0 +1,122 @@
+---
+- name: Podman Seafile | PATCH | Install data plate
+  ansible.builtin.template:
+    src: etc/motd.d/10-data-plate.txt
+    dest: /etc/motd.d/10-data-plate.txt
+    owner: root
+    group: root
+    mode: "0444"
+  become: true
+
+- name: Podman Seafile | PATCH | Install podman and verify rootless podman user
+  ansible.builtin.include_role:
+    role: sr2c.core.podman_host
+  vars:
+    podman_host_minimum_unpriv_port: 80
+    podman_host_rootless_users: ["{{ podman_seafile_podman_rootless_user }}"]
+
+- name: Podman Seafile | AUDIT | Get subuid range for user
+  ansible.builtin.command:
+    cmd: "getsubids {{ podman_seafile_podman_rootless_user }}"
+  register: _podman_seafile_user_subuid
+  changed_when: false
+
+- name: Podman Seafile | AUDIT | Get subgid range for user
+  ansible.builtin.command:
+    cmd: "getsubids -g {{ podman_seafile_podman_rootless_user }}"
+  register: _podman_seafile_user_subgid
+  changed_when: false
+
+- name: Podman Seafile | AUDIT | Parse outputs of getsubids and store results
+  ansible.builtin.set_fact:
+    _podman_seafile_user_subuid_start: "{{ (_podman_seafile_user_subuid.stdout_lines[0].split()[2] | int) }}"
+    _podman_seafile_user_subgid_start: "{{ (_podman_seafile_user_subgid.stdout_lines[0].split()[2] | int) }}"
+
+# MySQL runs with UID/GID 999 inside the container
+- name: Podman Seafile | PATCH | Create data directory for MySQL
+  ansible.builtin.file:
+    path: "/home/{{ podman_seafile_podman_rootless_user }}/mysql_data"
+    owner: "{{ _podman_seafile_user_subuid_start + 998 }}"
+    group: "{{ _podman_seafile_user_subgid_start + 998 }}"
+    mode: "0750"
+    state: "directory"
+  become: true
+
+# Seafile runs as root inside the container
+- name: Podman Seafile | PATCH | Create data directories for Seafile
+  ansible.builtin.file:
+    path: "/home/{{ podman_seafile_podman_rootless_user }}/{{ item }}"
+    owner: "{{ podman_seafile_podman_rootless_user }}"
+    group: "{{ podman_seafile_podman_rootless_user }}"
+    mode: "0755"
+    state: "directory"
+  become: true
+  with_items:
+    - seafile_data
+    - seadoc_data
+    - onlyoffice/logs
+    - onlyoffice/data
+    - onlyoffice/lib
+
+- name: Podman CDR Link | PATCH | Install container quadlets
+  ansible.builtin.template:
+    src: "home/podman/config/containers/systemd/{{ item }}"
+    dest: "/home/{{ podman_seafile_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_seafile_podman_rootless_user }}"
+    mode: "0400"
+  with_items:
+    - mysql.container
+    - redis.container
+    - seafile.container
+    - seadoc.container
+    - onlyoffice.container
+    - frontend.network
+    - seafile.network
+  become: true
+  notify:
+    - Restart Seafile
+
+- name: Podman Seafile | PATCH | Set up nginx and Let's Encrypt certificate
+  ansible.builtin.include_role:
+    name: sr2c.core.podman_nginx
+  vars:
+    podman_nginx_frontend_network: frontend
+    podman_nginx_podman_rootless_user: "{{ podman_seafile_podman_rootless_user }}"
+    podman_nginx_primary_hostname: "{{ podman_seafile_hostname }}"
+
+- name: Podman Seafile | PATCH | Install production nginx configuration file
+  ansible.builtin.template:
+    src: home/podman/nginx/nginx.conf
+    dest: "/home/{{ podman_seafile_podman_rootless_user }}/nginx/nginx.conf"
+    owner: "{{ podman_seafile_podman_rootless_user }}"
+    group: "{{ podman_seafile_podman_rootless_user }}"
+    mode: "0644"
+  become: true
+  notify:
+    - Restart nginx
+
+- name: Podman Seafile | PATCH | Ensure services are running and enabled
+  ansible.builtin.systemd_service:
+    name: seafile.service
+    scope: user
+    masked: false
+    state: started
+    enabled: true
+  become: true
+  become_user: "{{ podman_seafile_podman_rootless_user }}"
+
+- name: Podman Seafile | AUDIT | Wait until the seahub config file is created
+  ansible.builtin.wait_for:
+    path: "/home/{{ podman_seafile_podman_rootless_user }}/seafile_data/seafile/conf/seahub_settings.py"
+    state: present
+  become: true
+
+- name: Podman Seafile | PATCH | Append Seafile config block from template for proxy and OAuth
+  ansible.builtin.blockinfile:
+    path: "/home/{{ podman_seafile_podman_rootless_user }}/seafile_data/seafile/conf/seahub_settings.py"
+    block: "{{ lookup('ansible.builtin.template', 'home/podman/seafile_data/seahub_settings.py') }}"
+    insertafter: EOF
+    marker: "# {mark} ANSIBLE MANAGED BLOCK (Keycloak OAuth login)"
+  become: true
+  notify:
+    - Restart Seafile