From b206f477adcaa70cbd6cc964d8afe12eaaedc259 Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 1 Sep 2026 04:14:08 -0700 Subject: [PATCH] dankserver: quadlet units + deploy handlers for romm trio, jellyfin, calibre-web, copyparty Cutover of the six surviving dankserver services from compose-era bare containers to boot-persistent Quadlet units (WantedBy=default.target; podman 5.x v1 generator honors it at user-manager start). Units are faithful to live inspect ground truth (image pins = running tags, not compose inventory): - romm trio shares one data root: /home/dank/Containers/romm mounted whole at /romm; mariadb datadir and redis data dir live inside it. Aliases mariadb/ redis preserved on dankserver_appnet via Network=...:alias=. Secrets stay in the host-local env file (EnvironmentFile + ${VAR} expansion in the generated ExecStart, gitea precedent). copyparty passes its admin account via Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} (Exec= not Command=: the v1 generator hard-fails on Command=); entropy stays rw only there. - jellyfin keeps every creation-time env as Environment= lines (zero drift); Device=/dev/dri + GroupAdd=keep-groups preserve hardware transcoding. - calibre-web pins the exact running image tag (id 986277563e76 = 0.6.27-ls397), pasta network preserved. Deployer: first-cutover handlers retire the old container, rescue unshadowed anonymous-volume content (podman volume export + tar --skip-old-files), mv data roots on the same fs, then start units in dependency order with health gates. Re-deploys restart only the selected unit. deploy-plan.py maps compose keys mariadb/redis to the new unit names; allowlists updated. New seam test tests/dankserver_quadlet.bats pins boot-persistence + v1-generator contract; test-changed.sh maps the new dirs to it. Full suite green (209 tests). --- .../calibre-web/quadlet/calibre-web.container | 43 +++++++ .../copyparty/quadlet/copyparty.container | 37 ++++++ .../jellyfin/quadlet/jellyfin.container | 58 ++++++++++ .../romm/quadlet/romm-mariadb.container | 34 ++++++ dankserver/romm/quadlet/romm-redis.container | 28 +++++ dankserver/romm/quadlet/romm.container | 42 +++++++ scripts/deploy-plan.py | 29 +++-- scripts/deploy-remote.sh | 108 +++++++++++++++++- scripts/deploy.sh | 4 +- scripts/test-changed.sh | 8 ++ tests/dankserver_quadlet.bats | 45 ++++++++ 11 files changed, 425 insertions(+), 11 deletions(-) create mode 100644 dankserver/calibre-web/quadlet/calibre-web.container create mode 100644 dankserver/copyparty/quadlet/copyparty.container create mode 100644 dankserver/jellyfin/quadlet/jellyfin.container create mode 100644 dankserver/romm/quadlet/romm-mariadb.container create mode 100644 dankserver/romm/quadlet/romm-redis.container create mode 100644 dankserver/romm/quadlet/romm.container create mode 100755 tests/dankserver_quadlet.bats diff --git a/dankserver/calibre-web/quadlet/calibre-web.container b/dankserver/calibre-web/quadlet/calibre-web.container new file mode 100644 index 0000000..94c18aa --- /dev/null +++ b/dankserver/calibre-web/quadlet/calibre-web.container @@ -0,0 +1,43 @@ +# Quadlet unit: Calibre-Web library server (rootless, boot-persistent). +# +# Install path on dankserver: +# ~/.config/containers/systemd/calibre-web.container +# Unit name: calibre-web.service (podman 5.x drops the container- prefix) +# +# The data roots already lived under /home/dank/Containers/calibre-web in the +# compose era; this unit keeps those exact paths. The image pin is the exact +# tag of the image the live container runs (image id 986277563e76), so the +# cutover recreation changes zero bits of application code. No secrets: this +# unit takes no EnvironmentFile. + +[Unit] +Description=Calibre-Web library server container +After=network.target + +[Container] +ContainerName=calibre-web +Image=lscr.io/linuxserver/calibre-web:0.6.27-ls397 +Network=pasta +Environment=DOCKER_MODS=linuxserver/mods:universal-calibre +Environment=LANG=en_US.UTF-8 +Environment=LANGUAGE=en_US.UTF-8 +Environment=LSIO_FIRST_PARTY=true +Environment=OAUTHLIB_RELAX_TOKEN_SCOPE=1 +Environment=PGID=1000 +Environment=PUID=1000 +Environment=QTWEBENGINE_CHROMIUM_FLAGS=--no-sandbox +Environment=S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 +Environment=S6_STAGE2_HOOK=/docker-mods +Environment=TERM=xterm +Environment=TZ=America/Vancouver +Environment=VIRTUAL_ENV=/lsiopy +PublishPort=8083:8083 +Volume=/home/dank/Containers/calibre-web/config:/config +Volume=/home/dank/Containers/calibre-web/books:/books + +[Service] +Restart=always +RestartSec=5 + +[Install] +WantedBy=default.target diff --git a/dankserver/copyparty/quadlet/copyparty.container b/dankserver/copyparty/quadlet/copyparty.container new file mode 100644 index 0000000..bdceca9 --- /dev/null +++ b/dankserver/copyparty/quadlet/copyparty.container @@ -0,0 +1,37 @@ +# Quadlet unit: Copyparty file server (rootless, boot-persistent). +# +# Install path on dankserver: ~/.config/containers/systemd/copyparty.container +# Unit name: copyparty.service (podman 5.x drops the container- prefix) +# +# The image's default entrypoint is /bin/ash /z/cpp.sh -c /z/initcfg; the +# Command= line below reproduces the compose-era argv exactly: the admin +# account is passed as -a :. ${COPAY_ACCOUNT} and +# ${COPAY_PASSWORD} are expanded by systemd at ExecStart time from the +# host-local env file /home/dank/Containers/copyparty/env (mode 0600). +# This file holds no secrets. The deployer refuses to start this unit before +# that env file exists, so a missing env file fails the unit instead of +# creating an admin account with a garbage password. +# +# /w is the entropy volume: copyparty's dank admin account is the only write +# path into it; every other service mounts the share read-only or not at all. + +[Unit] +Description=Copyparty file server container +After=network.target + +[Container] +ContainerName=copyparty +Image=ghcr.io/9001/copyparty-ac:latest +Network=dankserver_appnet +EnvironmentFile=/home/dank/Containers/copyparty/env +Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank +Volume=/mnt/entropy:/w +Volume=/home/dank/Containers/copyparty/cfg:/cfg + +[Service] +EnvironmentFile=/home/dank/Containers/copyparty/env +Restart=always +RestartSec=5 + +[Install] +WantedBy=default.target diff --git a/dankserver/jellyfin/quadlet/jellyfin.container b/dankserver/jellyfin/quadlet/jellyfin.container new file mode 100644 index 0000000..b0bb6da --- /dev/null +++ b/dankserver/jellyfin/quadlet/jellyfin.container @@ -0,0 +1,58 @@ +# Quadlet unit: Jellyfin media server (rootless, boot-persistent). +# +# Install path on dankserver: ~/.config/containers/systemd/jellyfin.container +# Unit name: jellyfin.service (podman 5.x drops the container- prefix) +# +# Data roots migrated from /opt/jellyfin to /home/dank/Containers/jellyfin at +# cutover. The entropy volume is mounted read-only: nothing automated ever +# writes there; copyparty is the only write path for /mnt/entropy. Every +# creation-time environment variable of the compose-era container is kept as +# an Environment= line (zero drift); none of them are secrets, so this unit +# needs no EnvironmentFile. + +[Unit] +Description=Jellyfin media server container +After=network.target + +[Container] +ContainerName=jellyfin +Image=ghcr.io/jellyfin/jellyfin:latest +Network=dankserver_appnet +Environment=DEBIAN_FRONTEND=noninteractive +Environment=DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true +Environment=JELLYFIN_CACHE_DIR=/cache +Environment=JELLYFIN_CONFIG_DIR=/config/config +Environment=JELLYFIN_DATA_DIR=/config +Environment=JELLYFIN_FFMPEG=/usr/lib/jellyfin-ffmpeg/ffmpeg +Environment=JELLYFIN_LOG_DIR=/config/log +Environment=JELLYFIN_PublishedServerUrl=http://192.168.0.235:8096 +Environment=JELLYFIN_WEB_DIR=/jellyfin/jellyfin-web +Environment=LANG=en_US.UTF-8 +Environment=LANGUAGE=en_US:en +Environment=LC_ALL=en_US.UTF-8 +Environment=LD_PRELOAD=/usr/lib/jellyfin/libjemalloc.so.2 +Environment=MALLOC_TRIM_THRESHOLD_=131072 +Environment=NVIDIA_DRIVER_CAPABILITIES=compute,video,utility +Environment=NVIDIA_VISIBLE_DEVICES=all +Environment=XDG_CACHE_HOME=/cache +PublishPort=8096:8096 +PublishPort=8920:8920 +PublishPort=7359:7359/udp +PublishPort=1900:1900/udp +Volume=/home/dank/Containers/jellyfin/config:/config +Volume=/home/dank/Containers/jellyfin/cache:/cache +Volume=/mnt/entropy/Movies:/data/movies:ro +Volume=/mnt/entropy/TVShows:/data/shows:ro +Device=/dev/dri +GroupAdd=keep-groups +HealthCmd=curl -f http://localhost:8096/health +HealthInterval=30s +HealthTimeout=10s +HealthRetries=3 + +[Service] +Restart=always +RestartSec=5 + +[Install] +WantedBy=default.target diff --git a/dankserver/romm/quadlet/romm-mariadb.container b/dankserver/romm/quadlet/romm-mariadb.container new file mode 100644 index 0000000..9a546ec --- /dev/null +++ b/dankserver/romm/quadlet/romm-mariadb.container @@ -0,0 +1,34 @@ +# Quadlet unit: MariaDB backing store for RomM (rootless, boot-persistent). +# +# Install path on dankserver: ~/.config/containers/systemd/romm-mariadb.container +# Unit name: romm-mariadb.service (podman 5.x drops the container- prefix) +# +# The alias `mariadb` on dankserver_appnet is what makes DB_HOST=mariadb in +# the RomM unit resolve. Secrets (MARIADB_ROOT_PASSWORD, MARIADB_PASSWORD) +# live in the shared host-local env file /home/dank/Containers/romm/env +# (mode 0600); this file holds no secrets. + +[Unit] +Description=RomM MariaDB database container +After=network.target + +[Container] +ContainerName=romm-mariadb +Image=docker.io/library/mariadb:11 +Network=dankserver_appnet:alias=mariadb +EnvironmentFile=/home/dank/Containers/romm/env +Environment=MARIADB_DATABASE=romm +Environment=MARIADB_USER=romm +Volume=/home/dank/Containers/romm/mariadb:/var/lib/mysql +HealthCmd=mariadb-admin ping -h localhost +HealthInterval=10s +HealthTimeout=5s +HealthRetries=3 + +[Service] +EnvironmentFile=/home/dank/Containers/romm/env +Restart=always +RestartSec=5 + +[Install] +WantedBy=default.target diff --git a/dankserver/romm/quadlet/romm-redis.container b/dankserver/romm/quadlet/romm-redis.container new file mode 100644 index 0000000..0a6db6f --- /dev/null +++ b/dankserver/romm/quadlet/romm-redis.container @@ -0,0 +1,28 @@ +# Quadlet unit: Redis cache for RomM (rootless, boot-persistent). +# +# Install path on dankserver: ~/.config/containers/systemd/romm-redis.container +# Unit name: romm-redis.service (podman 5.x drops the container- prefix) +# +# The alias `redis` on dankserver_appnet is what makes REDIS_HOST=redis in +# the RomM unit resolve. No secrets: this unit takes no EnvironmentFile. + +[Unit] +Description=RomM Redis cache container +After=network.target + +[Container] +ContainerName=romm-redis +Image=docker.io/library/redis:7-alpine +Network=dankserver_appnet:alias=redis +Volume=/home/dank/Containers/romm/redis:/data +HealthCmd=redis-cli ping +HealthInterval=10s +HealthTimeout=5s +HealthRetries=3 + +[Service] +Restart=always +RestartSec=5 + +[Install] +WantedBy=default.target diff --git a/dankserver/romm/quadlet/romm.container b/dankserver/romm/quadlet/romm.container new file mode 100644 index 0000000..347340c --- /dev/null +++ b/dankserver/romm/quadlet/romm.container @@ -0,0 +1,42 @@ +# Quadlet unit: RomM library manager (rootless, boot-persistent). +# +# Install path on dankserver: ~/.config/containers/systemd/romm.container +# Unit name: romm.service (podman 5.x drops the container- prefix) +# +# The whole data root lives at /home/dank/Containers/romm and is mounted at +# /romm, so config/, library/, resources/ and assets/ sit inside it exactly as +# the compose-era bind mounts + anonymous volume did. Secrets (DB_PASSWD, +# ROMM_AUTH_SECRET_KEY, ROMM_PASSWORD, SCREENSCRAPER_DEV_*) live in the +# host-local env file /home/dank/Containers/romm/env (mode 0600); this file +# holds no secrets. The network dankserver_appnet must exist before first +# start (it is the compose-era network; on a fresh host create it first). + +[Unit] +Description=RomM library manager container +Wants=romm-mariadb.service +After=romm-mariadb.service romm-redis.service network.target + +[Container] +ContainerName=romm +Image=ghcr.io/rommapp/romm:latest +Network=dankserver_appnet +EnvironmentFile=/home/dank/Containers/romm/env +Environment=DB_HOST=mariadb +Environment=DB_NAME=romm +Environment=DB_USER=romm +Environment=REDIS_HOST=redis +Environment=HASHEOUS_API_ENABLED=true +PublishPort=8085:8080 +Volume=/home/dank/Containers/romm:/romm +HealthCmd=curl -f http://localhost:8080/health +HealthInterval=30s +HealthTimeout=10s +HealthRetries=3 + +[Service] +EnvironmentFile=/home/dank/Containers/romm/env +Restart=always +RestartSec=5 + +[Install] +WantedBy=default.target diff --git a/scripts/deploy-plan.py b/scripts/deploy-plan.py index cbf9e0b..8761f32 100755 --- a/scripts/deploy-plan.py +++ b/scripts/deploy-plan.py @@ -42,8 +42,8 @@ SERVICE_ORDER = ( "authentik-outpost", "caddy", "homepage", - "mariadb", - "redis", + "romm-mariadb", + "romm-redis", "romm", "copyparty", "jellyfin", @@ -89,8 +89,8 @@ DANKCLAW_SERVICES = { } DANKSERVER_SERVICES = { - "mariadb", - "redis", + "romm-mariadb", + "romm-redis", "romm", "copyparty", "jellyfin", @@ -134,6 +134,8 @@ DANKSERVER_COMPOSE_SERVICES = { "lidarr", "readarr", } +COMPOSE_NAME_MAP = {"mariadb": "romm-mariadb", "redis": "romm-redis"} + def _add(services: set[str], *names: str) -> None: @@ -191,7 +193,7 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]: # An unavailable or malformed revision is safer as a broad compose plan # than as a silent no-op. It still cannot include LLM units. if (old_doc and not new_doc) or (new_doc and not old_doc and names): - return allowed + return {COMPOSE_NAME_MAP.get(n, n) for n in allowed} # Top-level networks/configuration can affect every compose service even # when no individual service mapping changed. Ignore the services key while @@ -199,9 +201,10 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]: old_globals = {key: value for key, value in old_doc.items() if key != "services"} new_globals = {key: value for key, value in new_doc.items() if key != "services"} if old_globals != new_globals: - return allowed + return {COMPOSE_NAME_MAP.get(n, n) for n in allowed} - return {name for name in names if name in allowed and old.get(name) != new.get(name)} + changed = {name for name in names if name in allowed and old.get(name) != new.get(name)} + return {COMPOSE_NAME_MAP.get(n, n) for n in changed} def services_for_path(path: str, target: str) -> set[str]: @@ -297,7 +300,17 @@ def services_for_path(path: str, target: str) -> set[str]: if parts[0] == "dankserver": if len(parts) >= 2 and parts[1] == "compose.yaml": - _add(services, *DANKSERVER_COMPOSE_SERVICES) + # Compose service keys map onto the deployed unit names. + _add(services, *(COMPOSE_NAME_MAP.get(n, n) for n in DANKSERVER_COMPOSE_SERVICES)) + return services + if len(parts) >= 3 and parts[2] == "quadlet": + quadlet_services = { + "romm": {"romm", "romm-mariadb", "romm-redis"}, + "jellyfin": {"jellyfin"}, + "calibre-web": {"calibre-web"}, + "copyparty": {"copyparty"}, + } + _add(services, *quadlet_services.get(parts[1], set())) return services if parts[0] == "scripts": diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh index b0b08c0..148751f 100755 --- a/scripts/deploy-remote.sh +++ b/scripts/deploy-remote.sh @@ -92,7 +92,7 @@ service_is_allowed() { dankclaw:caddy|dankclaw:homepage|\ dankclaw:frank-default-large|dankclaw:frank-default-npu|\ dankclaw:frank-default-sightsound|\ - dankserver:mariadb|dankserver:redis|dankserver:romm|\ + dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\ dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|\ dankserver:prowlarr|dankserver:qbittorrent|dankserver:radarr|\ dankserver:sonarr|dankserver:lidarr|dankserver:readarr|\ @@ -526,6 +526,108 @@ wait_container_healthy() { return 1 } +# --- dankserver media/library stack ---------------------------------------------- +# These services migrated from compose-era bare containers to boot-persistent +# Quadlet units installed from this repo (podman 5.x v1 generator honors the +# WantedBy=default.target inside each .container file). The first deploy of a +# service retires the old container and migrates the data root before starting +# the unit; re-running the handler on an already-active unit restarts only the +# selected unit. + +migrate_data_root() { # $1 = old /opt path, $2 = new data-root path (same fs: rename) + local from="$1" to="$2" + [[ -d "$from" ]] || return 0 + mv -- "$from" "$to" + chown -R "$(id -u):$(id -g)" "$to" +} + +deploy_romm_stack() { + local service="$1" unit vol tmp + case "$service" in + mariadb) service=romm-mariadb ;; + redis) service=romm-redis ;; + esac + for unit in romm-mariadb romm-redis romm; do + cp "dankserver/romm/quadlet/$unit.container" "$quadlet_unit_dir/" + done + systemctl --user daemon-reload + if ! systemctl --user is-active --quiet romm-mariadb.service; then + # First cutover: the env file must exist before the first start, or + # the units would boot with empty secrets. Fail before stopping anything. + [[ -f /home/dank/Containers/romm/env ]] || { + echo "FAIL: /home/dank/Containers/romm/env does not exist; seed it before the first romm deploy" >&2 + return 1 + } + # Capture anonymous volume names while the containers are still inspectable, + # then stop and rm the compose-era trio. + local vols + vols="$(podman inspect -f '{{range .Mounts}}{{if eq .Type "volume"}}{{.Name}} {{end}}{{end}}' romm 2>/dev/null || true)" + podman stop -t 60 romm-mariadb romm-redis romm || true + podman rm romm-mariadb romm-redis romm || true + for vol in $vols; do + tmp="$(mktemp -d)" + podman volume export --output "$tmp/v.tar" "$vol" + # --skip-old-files keeps live bind-mounted content (config/, library/, + # resources/, mariadb/, redis/) and rescues only unshadowed entries like assets/. + tar --skip-old-files -C /home/dank/Containers/romm -xf "$tmp/v.tar" + rm -rf -- "$tmp" + done + migrate_data_root /opt/romm /home/dank/Containers/romm + systemctl --user start romm-mariadb.service + wait_container_healthy romm-mariadb 120 || return 1 + systemctl --user start romm-redis.service + wait_container_healthy romm-redis 60 || return 1 + if [[ "$service" == "romm" ]]; then + systemctl --user start romm.service + fi + return 0 + fi + systemctl --user restart "$service.service" +} + +deploy_jellyfin() { + cp "dankserver/jellyfin/quadlet/jellyfin.container" "$quadlet_unit_dir/" + systemctl --user daemon-reload + if ! systemctl --user is-active -q jellyfin.service; then + podman stop -t 30 jellyfin || true + podman rm jellyfin || true + migrate_data_root /opt/jellyfin /home/dank/Containers/jellyfin + fi + systemctl --user restart jellyfin.service +} + +deploy_calibre_web() { + cp "dankserver/calibre-web/quadlet/calibre-web.container" "$quadlet_unit_dir/" + systemctl --user daemon-reload + if ! systemctl --user is-active -q calibre-web.service; then + # The compose-era container ran under a podman-generate-systemd unit; stop + # that unit first so its Restart=always cannot resurrect the old container + # and collide with the new ContainerName. + systemctl --user stop container-calibre-web.service 2>/dev/null || true + podman stop calibre-web || true + podman rm calibre-web || true + fi + systemctl --user restart calibre-web.service +} + +deploy_copyparty() { + # The admin account is created from ${COPAY_ACCOUNT}:${COPAY_PASSWORD} expanded + # at ExecStart time; a missing env file must fail the unit, not boot copyparty + # with a garbage admin password. + [[ -f /home/dank/Containers/copyparty/env ]] || { + echo "FAIL: /home/dank/Containers/copyparty/env does not exist; seed it before the first copyparty deploy" >&2 + return 1 + } + cp "dankserver/copyparty/quadlet/copyparty.container" "$quadlet_unit_dir/" + systemctl --user daemon-reload + if ! systemctl --user is-active -q copyparty.service; then + podman stop -t 15 copyparty || true + podman rm copyparty || true + migrate_data_root /opt/copyparty /home/dank/Containers/copyparty + fi + systemctl --user restart copyparty.service +} + deploy_authentik() { local unit mkdir -p "$quadlet_unit_dir" @@ -696,6 +798,10 @@ deploy_service() { frank-default-npu) deploy_llm_npu ;; frank-default-sightsound) deploy_llm_sightsound ;; hermes|hermes-dashboard|hermes-webui) deploy_hermes ;; + romm|romm-mariadb|romm-redis|mariadb|redis) deploy_romm_stack "$service" ;; + jellyfin) deploy_jellyfin ;; + calibre-web) deploy_calibre_web ;; + copyparty) deploy_copyparty ;; *) deploy_compose_service "$service" ;; esac } diff --git a/scripts/deploy.sh b/scripts/deploy.sh index dc95ec9..fe52836 100755 --- a/scripts/deploy.sh +++ b/scripts/deploy.sh @@ -122,8 +122,8 @@ valid_service() { dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:anubis|\ dankclaw:frank-default-large|dankclaw:frank-default-npu|\ dankclaw:frank-default-sightsound|\ - dankserver:mariadb|dankserver:redis|dankserver:romm|dankserver:copyparty|\ - dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\ + dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\ + dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\ dankserver:qbittorrent|dankserver:radarr|dankserver:sonarr|\ dankserver:lidarr|dankserver:readarr|dankserver:node-exporter|\ dankserver:frank-default-small) diff --git a/scripts/test-changed.sh b/scripts/test-changed.sh index ddbc62b..1e4ab39 100755 --- a/scripts/test-changed.sh +++ b/scripts/test-changed.sh @@ -205,6 +205,14 @@ for path in "${CHANGED[@]}"; do old/scripts/*|old/scripts/**) add_test tests/scripts_syntax.bats ;; + # Cutover-era dankserver quadlet units (romm trio, jellyfin, calibre-web, + # copyparty): the seam checks boot-persistence + v1-generator contract; + # deploy-flow seams guard the deployer routing that installs them. + dankserver/romm/*|dankserver/jellyfin/*|dankserver/calibre-web/*|dankserver/copyparty/*) + add_test tests/dankserver_quadlet.bats + add_test tests/deployment_flow.bats + add_test tests/deployment_scoping.bats + ;; report/*) # Frozen audit reports are point-in-time artifacts; not testable. ;; diff --git a/tests/dankserver_quadlet.bats b/tests/dankserver_quadlet.bats new file mode 100755 index 0000000..0ca62f8 --- /dev/null +++ b/tests/dankserver_quadlet.bats @@ -0,0 +1,45 @@ +#!/usr/bin/env bats +# Seam: the six cutover-era dankserver quadlet units (romm trio, jellyfin, +# calibre-web, copyparty) must keep their boot-persistence and v1-generator +# contracts. The podman 5.x v1 Quadlet generator silently drops or hard-fails +# on several keys; these tests pin the contract that keeps the units loadable +# and secret-free in the repo. + +load helpers + +@test "all six cutover units exist under dankserver//quadlet/" { + for unit in romm/quadlet/romm romm/quadlet/romm-mariadb romm/quadlet/romm-redis jellyfin/quadlet/jellyfin calibre-web/quadlet/calibre-web copyparty/quadlet/copyparty; do + [ -f "$REPO_ROOT/dankserver/$unit.container" ] || return 1 + done +} + +@test "every cutover unit is boot-persistent (WantedBy=default.target)" { + for unit in romm/quadlet/romm romm/quadlet/romm-mariadb romm/quadlet/romm-redis jellyfin/quadlet/jellyfin calibre-web/quadlet/calibre-web copyparty/quadlet/copyparty; do + grep -q '^WantedBy=default.target$' "$REPO_ROOT/dankserver/$unit.container" || return 1 + done +} + +@test "copyparty uses Exec= not Command= (v1 generator hard-fails on Command=)" { + unit="$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" + grep -q '^Command=' "$unit" && return 1 + grep -q '^Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD}' "$unit" || return 1 +} + +@test "copyparty and romm consume host-local env files, never in-repo secrets" { + grep -q '^EnvironmentFile=/home/dank/Containers/copyparty/env$' \ + "$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" || return 1 + for unit in romm/quadlet/romm romm/quadlet/romm-mariadb; do + grep -q '^EnvironmentFile=/home/dank/Containers/romm/env$' \ + "$REPO_ROOT/dankserver/$unit.container" || return 1 + done + # No literal credential may ever appear in a tracked unit file: the only + # Exec= arguments must be variable expansions, never a literal account:secret. + ! grep -qE '\-a [A-Za-z0-9]+:[A-Za-z0-9]' "$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" || return 1 +} + +@test "romm db services keep their service-discovery aliases on the appnet" { + grep -q '^Network=dankserver_appnet:alias=mariadb$' \ + "$REPO_ROOT/dankserver/romm/quadlet/romm-mariadb.container" || return 1 + grep -q '^Network=dankserver_appnet:alias=redis$' \ + "$REPO_ROOT/dankserver/romm/quadlet/romm-redis.container" || return 1 +}