dankserver: quadlet units + deploy handlers for romm trio, jellyfin, calibre-web, copyparty
Cutover of the six surviving dankserver services from compose-era bare
containers to boot-persistent Quadlet units (WantedBy=default.target; podman
5.x v1 generator honors it at user-manager start).
Units are faithful to live inspect ground truth (image pins = running tags,
not compose inventory):
- romm trio shares one data root: /home/dank/Containers/romm mounted whole at
/romm; mariadb datadir and redis data dir live inside it. Aliases mariadb/
redis preserved on dankserver_appnet via Network=...:alias=. Secrets stay in
the host-local env file (EnvironmentFile + ${VAR} expansion in the generated
ExecStart, gitea precedent). copyparty passes its admin account via
Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} (Exec= not Command=: the v1
generator hard-fails on Command=); entropy stays rw only there.
- jellyfin keeps every creation-time env as Environment= lines (zero drift);
Device=/dev/dri + GroupAdd=keep-groups preserve hardware transcoding.
- calibre-web pins the exact running image tag (id 986277563e76 =
0.6.27-ls397), pasta network preserved.
Deployer: first-cutover handlers retire the old container, rescue unshadowed
anonymous-volume content (podman volume export + tar --skip-old-files), mv
data roots on the same fs, then start units in dependency order with health
gates. Re-deploys restart only the selected unit. deploy-plan.py maps compose
keys mariadb/redis to the new unit names; allowlists updated. New seam test
tests/dankserver_quadlet.bats pins boot-persistence + v1-generator contract;
test-changed.sh maps the new dirs to it. Full suite green (209 tests).
This commit is contained in:
Frank
+21
-8
@@ -42,8 +42,8 @@ SERVICE_ORDER = (
|
||||
"authentik-outpost",
|
||||
"caddy",
|
||||
"homepage",
|
||||
"mariadb",
|
||||
"redis",
|
||||
"romm-mariadb",
|
||||
"romm-redis",
|
||||
"romm",
|
||||
"copyparty",
|
||||
"jellyfin",
|
||||
@@ -89,8 +89,8 @@ DANKCLAW_SERVICES = {
|
||||
}
|
||||
|
||||
DANKSERVER_SERVICES = {
|
||||
"mariadb",
|
||||
"redis",
|
||||
"romm-mariadb",
|
||||
"romm-redis",
|
||||
"romm",
|
||||
"copyparty",
|
||||
"jellyfin",
|
||||
@@ -134,6 +134,8 @@ DANKSERVER_COMPOSE_SERVICES = {
|
||||
"lidarr",
|
||||
"readarr",
|
||||
}
|
||||
COMPOSE_NAME_MAP = {"mariadb": "romm-mariadb", "redis": "romm-redis"}
|
||||
|
||||
|
||||
|
||||
def _add(services: set[str], *names: str) -> None:
|
||||
@@ -191,7 +193,7 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
|
||||
# An unavailable or malformed revision is safer as a broad compose plan
|
||||
# than as a silent no-op. It still cannot include LLM units.
|
||||
if (old_doc and not new_doc) or (new_doc and not old_doc and names):
|
||||
return allowed
|
||||
return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
|
||||
|
||||
# Top-level networks/configuration can affect every compose service even
|
||||
# when no individual service mapping changed. Ignore the services key while
|
||||
@@ -199,9 +201,10 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
|
||||
old_globals = {key: value for key, value in old_doc.items() if key != "services"}
|
||||
new_globals = {key: value for key, value in new_doc.items() if key != "services"}
|
||||
if old_globals != new_globals:
|
||||
return allowed
|
||||
return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
|
||||
|
||||
return {name for name in names if name in allowed and old.get(name) != new.get(name)}
|
||||
changed = {name for name in names if name in allowed and old.get(name) != new.get(name)}
|
||||
return {COMPOSE_NAME_MAP.get(n, n) for n in changed}
|
||||
|
||||
|
||||
def services_for_path(path: str, target: str) -> set[str]:
|
||||
@@ -297,7 +300,17 @@ def services_for_path(path: str, target: str) -> set[str]:
|
||||
|
||||
if parts[0] == "dankserver":
|
||||
if len(parts) >= 2 and parts[1] == "compose.yaml":
|
||||
_add(services, *DANKSERVER_COMPOSE_SERVICES)
|
||||
# Compose service keys map onto the deployed unit names.
|
||||
_add(services, *(COMPOSE_NAME_MAP.get(n, n) for n in DANKSERVER_COMPOSE_SERVICES))
|
||||
return services
|
||||
if len(parts) >= 3 and parts[2] == "quadlet":
|
||||
quadlet_services = {
|
||||
"romm": {"romm", "romm-mariadb", "romm-redis"},
|
||||
"jellyfin": {"jellyfin"},
|
||||
"calibre-web": {"calibre-web"},
|
||||
"copyparty": {"copyparty"},
|
||||
}
|
||||
_add(services, *quadlet_services.get(parts[1], set()))
|
||||
return services
|
||||
|
||||
if parts[0] == "scripts":
|
||||
|
||||
+107
-1
@@ -92,7 +92,7 @@ service_is_allowed() {
|
||||
dankclaw:caddy|dankclaw:homepage|\
|
||||
dankclaw:frank-default-large|dankclaw:frank-default-npu|\
|
||||
dankclaw:frank-default-sightsound|\
|
||||
dankserver:mariadb|dankserver:redis|dankserver:romm|\
|
||||
dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
|
||||
dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|\
|
||||
dankserver:prowlarr|dankserver:qbittorrent|dankserver:radarr|\
|
||||
dankserver:sonarr|dankserver:lidarr|dankserver:readarr|\
|
||||
@@ -526,6 +526,108 @@ wait_container_healthy() {
|
||||
return 1
|
||||
}
|
||||
|
||||
# --- dankserver media/library stack ----------------------------------------------
|
||||
# These services migrated from compose-era bare containers to boot-persistent
|
||||
# Quadlet units installed from this repo (podman 5.x v1 generator honors the
|
||||
# WantedBy=default.target inside each .container file). The first deploy of a
|
||||
# service retires the old container and migrates the data root before starting
|
||||
# the unit; re-running the handler on an already-active unit restarts only the
|
||||
# selected unit.
|
||||
|
||||
migrate_data_root() { # $1 = old /opt path, $2 = new data-root path (same fs: rename)
|
||||
local from="$1" to="$2"
|
||||
[[ -d "$from" ]] || return 0
|
||||
mv -- "$from" "$to"
|
||||
chown -R "$(id -u):$(id -g)" "$to"
|
||||
}
|
||||
|
||||
deploy_romm_stack() {
|
||||
local service="$1" unit vol tmp
|
||||
case "$service" in
|
||||
mariadb) service=romm-mariadb ;;
|
||||
redis) service=romm-redis ;;
|
||||
esac
|
||||
for unit in romm-mariadb romm-redis romm; do
|
||||
cp "dankserver/romm/quadlet/$unit.container" "$quadlet_unit_dir/"
|
||||
done
|
||||
systemctl --user daemon-reload
|
||||
if ! systemctl --user is-active --quiet romm-mariadb.service; then
|
||||
# First cutover: the env file must exist before the first start, or
|
||||
# the units would boot with empty secrets. Fail before stopping anything.
|
||||
[[ -f /home/dank/Containers/romm/env ]] || {
|
||||
echo "FAIL: /home/dank/Containers/romm/env does not exist; seed it before the first romm deploy" >&2
|
||||
return 1
|
||||
}
|
||||
# Capture anonymous volume names while the containers are still inspectable,
|
||||
# then stop and rm the compose-era trio.
|
||||
local vols
|
||||
vols="$(podman inspect -f '{{range .Mounts}}{{if eq .Type "volume"}}{{.Name}} {{end}}{{end}}' romm 2>/dev/null || true)"
|
||||
podman stop -t 60 romm-mariadb romm-redis romm || true
|
||||
podman rm romm-mariadb romm-redis romm || true
|
||||
for vol in $vols; do
|
||||
tmp="$(mktemp -d)"
|
||||
podman volume export --output "$tmp/v.tar" "$vol"
|
||||
# --skip-old-files keeps live bind-mounted content (config/, library/,
|
||||
# resources/, mariadb/, redis/) and rescues only unshadowed entries like assets/.
|
||||
tar --skip-old-files -C /home/dank/Containers/romm -xf "$tmp/v.tar"
|
||||
rm -rf -- "$tmp"
|
||||
done
|
||||
migrate_data_root /opt/romm /home/dank/Containers/romm
|
||||
systemctl --user start romm-mariadb.service
|
||||
wait_container_healthy romm-mariadb 120 || return 1
|
||||
systemctl --user start romm-redis.service
|
||||
wait_container_healthy romm-redis 60 || return 1
|
||||
if [[ "$service" == "romm" ]]; then
|
||||
systemctl --user start romm.service
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
systemctl --user restart "$service.service"
|
||||
}
|
||||
|
||||
deploy_jellyfin() {
|
||||
cp "dankserver/jellyfin/quadlet/jellyfin.container" "$quadlet_unit_dir/"
|
||||
systemctl --user daemon-reload
|
||||
if ! systemctl --user is-active -q jellyfin.service; then
|
||||
podman stop -t 30 jellyfin || true
|
||||
podman rm jellyfin || true
|
||||
migrate_data_root /opt/jellyfin /home/dank/Containers/jellyfin
|
||||
fi
|
||||
systemctl --user restart jellyfin.service
|
||||
}
|
||||
|
||||
deploy_calibre_web() {
|
||||
cp "dankserver/calibre-web/quadlet/calibre-web.container" "$quadlet_unit_dir/"
|
||||
systemctl --user daemon-reload
|
||||
if ! systemctl --user is-active -q calibre-web.service; then
|
||||
# The compose-era container ran under a podman-generate-systemd unit; stop
|
||||
# that unit first so its Restart=always cannot resurrect the old container
|
||||
# and collide with the new ContainerName.
|
||||
systemctl --user stop container-calibre-web.service 2>/dev/null || true
|
||||
podman stop calibre-web || true
|
||||
podman rm calibre-web || true
|
||||
fi
|
||||
systemctl --user restart calibre-web.service
|
||||
}
|
||||
|
||||
deploy_copyparty() {
|
||||
# The admin account is created from ${COPAY_ACCOUNT}:${COPAY_PASSWORD} expanded
|
||||
# at ExecStart time; a missing env file must fail the unit, not boot copyparty
|
||||
# with a garbage admin password.
|
||||
[[ -f /home/dank/Containers/copyparty/env ]] || {
|
||||
echo "FAIL: /home/dank/Containers/copyparty/env does not exist; seed it before the first copyparty deploy" >&2
|
||||
return 1
|
||||
}
|
||||
cp "dankserver/copyparty/quadlet/copyparty.container" "$quadlet_unit_dir/"
|
||||
systemctl --user daemon-reload
|
||||
if ! systemctl --user is-active -q copyparty.service; then
|
||||
podman stop -t 15 copyparty || true
|
||||
podman rm copyparty || true
|
||||
migrate_data_root /opt/copyparty /home/dank/Containers/copyparty
|
||||
fi
|
||||
systemctl --user restart copyparty.service
|
||||
}
|
||||
|
||||
deploy_authentik() {
|
||||
local unit
|
||||
mkdir -p "$quadlet_unit_dir"
|
||||
@@ -696,6 +798,10 @@ deploy_service() {
|
||||
frank-default-npu) deploy_llm_npu ;;
|
||||
frank-default-sightsound) deploy_llm_sightsound ;;
|
||||
hermes|hermes-dashboard|hermes-webui) deploy_hermes ;;
|
||||
romm|romm-mariadb|romm-redis|mariadb|redis) deploy_romm_stack "$service" ;;
|
||||
jellyfin) deploy_jellyfin ;;
|
||||
calibre-web) deploy_calibre_web ;;
|
||||
copyparty) deploy_copyparty ;;
|
||||
*) deploy_compose_service "$service" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
+2
-2
@@ -122,8 +122,8 @@ valid_service() {
|
||||
dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:anubis|\
|
||||
dankclaw:frank-default-large|dankclaw:frank-default-npu|\
|
||||
dankclaw:frank-default-sightsound|\
|
||||
dankserver:mariadb|dankserver:redis|dankserver:romm|dankserver:copyparty|\
|
||||
dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\
|
||||
dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
|
||||
dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\
|
||||
dankserver:qbittorrent|dankserver:radarr|dankserver:sonarr|\
|
||||
dankserver:lidarr|dankserver:readarr|dankserver:node-exporter|\
|
||||
dankserver:frank-default-small)
|
||||
|
||||
@@ -205,6 +205,14 @@ for path in "${CHANGED[@]}"; do
|
||||
old/scripts/*|old/scripts/**)
|
||||
add_test tests/scripts_syntax.bats
|
||||
;;
|
||||
# Cutover-era dankserver quadlet units (romm trio, jellyfin, calibre-web,
|
||||
# copyparty): the seam checks boot-persistence + v1-generator contract;
|
||||
# deploy-flow seams guard the deployer routing that installs them.
|
||||
dankserver/romm/*|dankserver/jellyfin/*|dankserver/calibre-web/*|dankserver/copyparty/*)
|
||||
add_test tests/dankserver_quadlet.bats
|
||||
add_test tests/deployment_flow.bats
|
||||
add_test tests/deployment_scoping.bats
|
||||
;;
|
||||
report/*)
|
||||
# Frozen audit reports are point-in-time artifacts; not testable.
|
||||
;;
|
||||
|
||||
Reference in New Issue
Block a user