dankserver: quadlet units + deploy handlers for romm trio, jellyfin, calibre-web, copyparty
Cutover of the six surviving dankserver services from compose-era bare
containers to boot-persistent Quadlet units (WantedBy=default.target; podman
5.x v1 generator honors it at user-manager start).
Units are faithful to live inspect ground truth (image pins = running tags,
not compose inventory):
- romm trio shares one data root: /home/dank/Containers/romm mounted whole at
/romm; mariadb datadir and redis data dir live inside it. Aliases mariadb/
redis preserved on dankserver_appnet via Network=...:alias=. Secrets stay in
the host-local env file (EnvironmentFile + ${VAR} expansion in the generated
ExecStart, gitea precedent). copyparty passes its admin account via
Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} (Exec= not Command=: the v1
generator hard-fails on Command=); entropy stays rw only there.
- jellyfin keeps every creation-time env as Environment= lines (zero drift);
Device=/dev/dri + GroupAdd=keep-groups preserve hardware transcoding.
- calibre-web pins the exact running image tag (id 986277563e76 =
0.6.27-ls397), pasta network preserved.
Deployer: first-cutover handlers retire the old container, rescue unshadowed
anonymous-volume content (podman volume export + tar --skip-old-files), mv
data roots on the same fs, then start units in dependency order with health
gates. Re-deploys restart only the selected unit. deploy-plan.py maps compose
keys mariadb/redis to the new unit names; allowlists updated. New seam test
tests/dankserver_quadlet.bats pins boot-persistence + v1-generator contract;
test-changed.sh maps the new dirs to it. Full suite green (209 tests).
This commit is contained in:
Frank
@@ -0,0 +1,43 @@
|
||||
# Quadlet unit: Calibre-Web library server (rootless, boot-persistent).
|
||||
#
|
||||
# Install path on dankserver:
|
||||
# ~/.config/containers/systemd/calibre-web.container
|
||||
# Unit name: calibre-web.service (podman 5.x drops the container- prefix)
|
||||
#
|
||||
# The data roots already lived under /home/dank/Containers/calibre-web in the
|
||||
# compose era; this unit keeps those exact paths. The image pin is the exact
|
||||
# tag of the image the live container runs (image id 986277563e76), so the
|
||||
# cutover recreation changes zero bits of application code. No secrets: this
|
||||
# unit takes no EnvironmentFile.
|
||||
|
||||
[Unit]
|
||||
Description=Calibre-Web library server container
|
||||
After=network.target
|
||||
|
||||
[Container]
|
||||
ContainerName=calibre-web
|
||||
Image=lscr.io/linuxserver/calibre-web:0.6.27-ls397
|
||||
Network=pasta
|
||||
Environment=DOCKER_MODS=linuxserver/mods:universal-calibre
|
||||
Environment=LANG=en_US.UTF-8
|
||||
Environment=LANGUAGE=en_US.UTF-8
|
||||
Environment=LSIO_FIRST_PARTY=true
|
||||
Environment=OAUTHLIB_RELAX_TOKEN_SCOPE=1
|
||||
Environment=PGID=1000
|
||||
Environment=PUID=1000
|
||||
Environment=QTWEBENGINE_CHROMIUM_FLAGS=--no-sandbox
|
||||
Environment=S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
|
||||
Environment=S6_STAGE2_HOOK=/docker-mods
|
||||
Environment=TERM=xterm
|
||||
Environment=TZ=America/Vancouver
|
||||
Environment=VIRTUAL_ENV=/lsiopy
|
||||
PublishPort=8083:8083
|
||||
Volume=/home/dank/Containers/calibre-web/config:/config
|
||||
Volume=/home/dank/Containers/calibre-web/books:/books
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,37 @@
|
||||
# Quadlet unit: Copyparty file server (rootless, boot-persistent).
|
||||
#
|
||||
# Install path on dankserver: ~/.config/containers/systemd/copyparty.container
|
||||
# Unit name: copyparty.service (podman 5.x drops the container- prefix)
|
||||
#
|
||||
# The image's default entrypoint is /bin/ash /z/cpp.sh -c /z/initcfg; the
|
||||
# Command= line below reproduces the compose-era argv exactly: the admin
|
||||
# account is passed as -a <user>:<password>. ${COPAY_ACCOUNT} and
|
||||
# ${COPAY_PASSWORD} are expanded by systemd at ExecStart time from the
|
||||
# host-local env file /home/dank/Containers/copyparty/env (mode 0600).
|
||||
# This file holds no secrets. The deployer refuses to start this unit before
|
||||
# that env file exists, so a missing env file fails the unit instead of
|
||||
# creating an admin account with a garbage password.
|
||||
#
|
||||
# /w is the entropy volume: copyparty's dank admin account is the only write
|
||||
# path into it; every other service mounts the share read-only or not at all.
|
||||
|
||||
[Unit]
|
||||
Description=Copyparty file server container
|
||||
After=network.target
|
||||
|
||||
[Container]
|
||||
ContainerName=copyparty
|
||||
Image=ghcr.io/9001/copyparty-ac:latest
|
||||
Network=dankserver_appnet
|
||||
EnvironmentFile=/home/dank/Containers/copyparty/env
|
||||
Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank
|
||||
Volume=/mnt/entropy:/w
|
||||
Volume=/home/dank/Containers/copyparty/cfg:/cfg
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=/home/dank/Containers/copyparty/env
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,58 @@
|
||||
# Quadlet unit: Jellyfin media server (rootless, boot-persistent).
|
||||
#
|
||||
# Install path on dankserver: ~/.config/containers/systemd/jellyfin.container
|
||||
# Unit name: jellyfin.service (podman 5.x drops the container- prefix)
|
||||
#
|
||||
# Data roots migrated from /opt/jellyfin to /home/dank/Containers/jellyfin at
|
||||
# cutover. The entropy volume is mounted read-only: nothing automated ever
|
||||
# writes there; copyparty is the only write path for /mnt/entropy. Every
|
||||
# creation-time environment variable of the compose-era container is kept as
|
||||
# an Environment= line (zero drift); none of them are secrets, so this unit
|
||||
# needs no EnvironmentFile.
|
||||
|
||||
[Unit]
|
||||
Description=Jellyfin media server container
|
||||
After=network.target
|
||||
|
||||
[Container]
|
||||
ContainerName=jellyfin
|
||||
Image=ghcr.io/jellyfin/jellyfin:latest
|
||||
Network=dankserver_appnet
|
||||
Environment=DEBIAN_FRONTEND=noninteractive
|
||||
Environment=DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true
|
||||
Environment=JELLYFIN_CACHE_DIR=/cache
|
||||
Environment=JELLYFIN_CONFIG_DIR=/config/config
|
||||
Environment=JELLYFIN_DATA_DIR=/config
|
||||
Environment=JELLYFIN_FFMPEG=/usr/lib/jellyfin-ffmpeg/ffmpeg
|
||||
Environment=JELLYFIN_LOG_DIR=/config/log
|
||||
Environment=JELLYFIN_PublishedServerUrl=http://192.168.0.235:8096
|
||||
Environment=JELLYFIN_WEB_DIR=/jellyfin/jellyfin-web
|
||||
Environment=LANG=en_US.UTF-8
|
||||
Environment=LANGUAGE=en_US:en
|
||||
Environment=LC_ALL=en_US.UTF-8
|
||||
Environment=LD_PRELOAD=/usr/lib/jellyfin/libjemalloc.so.2
|
||||
Environment=MALLOC_TRIM_THRESHOLD_=131072
|
||||
Environment=NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
|
||||
Environment=NVIDIA_VISIBLE_DEVICES=all
|
||||
Environment=XDG_CACHE_HOME=/cache
|
||||
PublishPort=8096:8096
|
||||
PublishPort=8920:8920
|
||||
PublishPort=7359:7359/udp
|
||||
PublishPort=1900:1900/udp
|
||||
Volume=/home/dank/Containers/jellyfin/config:/config
|
||||
Volume=/home/dank/Containers/jellyfin/cache:/cache
|
||||
Volume=/mnt/entropy/Movies:/data/movies:ro
|
||||
Volume=/mnt/entropy/TVShows:/data/shows:ro
|
||||
Device=/dev/dri
|
||||
GroupAdd=keep-groups
|
||||
HealthCmd=curl -f http://localhost:8096/health
|
||||
HealthInterval=30s
|
||||
HealthTimeout=10s
|
||||
HealthRetries=3
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,34 @@
|
||||
# Quadlet unit: MariaDB backing store for RomM (rootless, boot-persistent).
|
||||
#
|
||||
# Install path on dankserver: ~/.config/containers/systemd/romm-mariadb.container
|
||||
# Unit name: romm-mariadb.service (podman 5.x drops the container- prefix)
|
||||
#
|
||||
# The alias `mariadb` on dankserver_appnet is what makes DB_HOST=mariadb in
|
||||
# the RomM unit resolve. Secrets (MARIADB_ROOT_PASSWORD, MARIADB_PASSWORD)
|
||||
# live in the shared host-local env file /home/dank/Containers/romm/env
|
||||
# (mode 0600); this file holds no secrets.
|
||||
|
||||
[Unit]
|
||||
Description=RomM MariaDB database container
|
||||
After=network.target
|
||||
|
||||
[Container]
|
||||
ContainerName=romm-mariadb
|
||||
Image=docker.io/library/mariadb:11
|
||||
Network=dankserver_appnet:alias=mariadb
|
||||
EnvironmentFile=/home/dank/Containers/romm/env
|
||||
Environment=MARIADB_DATABASE=romm
|
||||
Environment=MARIADB_USER=romm
|
||||
Volume=/home/dank/Containers/romm/mariadb:/var/lib/mysql
|
||||
HealthCmd=mariadb-admin ping -h localhost
|
||||
HealthInterval=10s
|
||||
HealthTimeout=5s
|
||||
HealthRetries=3
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=/home/dank/Containers/romm/env
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,28 @@
|
||||
# Quadlet unit: Redis cache for RomM (rootless, boot-persistent).
|
||||
#
|
||||
# Install path on dankserver: ~/.config/containers/systemd/romm-redis.container
|
||||
# Unit name: romm-redis.service (podman 5.x drops the container- prefix)
|
||||
#
|
||||
# The alias `redis` on dankserver_appnet is what makes REDIS_HOST=redis in
|
||||
# the RomM unit resolve. No secrets: this unit takes no EnvironmentFile.
|
||||
|
||||
[Unit]
|
||||
Description=RomM Redis cache container
|
||||
After=network.target
|
||||
|
||||
[Container]
|
||||
ContainerName=romm-redis
|
||||
Image=docker.io/library/redis:7-alpine
|
||||
Network=dankserver_appnet:alias=redis
|
||||
Volume=/home/dank/Containers/romm/redis:/data
|
||||
HealthCmd=redis-cli ping
|
||||
HealthInterval=10s
|
||||
HealthTimeout=5s
|
||||
HealthRetries=3
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,42 @@
|
||||
# Quadlet unit: RomM library manager (rootless, boot-persistent).
|
||||
#
|
||||
# Install path on dankserver: ~/.config/containers/systemd/romm.container
|
||||
# Unit name: romm.service (podman 5.x drops the container- prefix)
|
||||
#
|
||||
# The whole data root lives at /home/dank/Containers/romm and is mounted at
|
||||
# /romm, so config/, library/, resources/ and assets/ sit inside it exactly as
|
||||
# the compose-era bind mounts + anonymous volume did. Secrets (DB_PASSWD,
|
||||
# ROMM_AUTH_SECRET_KEY, ROMM_PASSWORD, SCREENSCRAPER_DEV_*) live in the
|
||||
# host-local env file /home/dank/Containers/romm/env (mode 0600); this file
|
||||
# holds no secrets. The network dankserver_appnet must exist before first
|
||||
# start (it is the compose-era network; on a fresh host create it first).
|
||||
|
||||
[Unit]
|
||||
Description=RomM library manager container
|
||||
Wants=romm-mariadb.service
|
||||
After=romm-mariadb.service romm-redis.service network.target
|
||||
|
||||
[Container]
|
||||
ContainerName=romm
|
||||
Image=ghcr.io/rommapp/romm:latest
|
||||
Network=dankserver_appnet
|
||||
EnvironmentFile=/home/dank/Containers/romm/env
|
||||
Environment=DB_HOST=mariadb
|
||||
Environment=DB_NAME=romm
|
||||
Environment=DB_USER=romm
|
||||
Environment=REDIS_HOST=redis
|
||||
Environment=HASHEOUS_API_ENABLED=true
|
||||
PublishPort=8085:8080
|
||||
Volume=/home/dank/Containers/romm:/romm
|
||||
HealthCmd=curl -f http://localhost:8080/health
|
||||
HealthInterval=30s
|
||||
HealthTimeout=10s
|
||||
HealthRetries=3
|
||||
|
||||
[Service]
|
||||
EnvironmentFile=/home/dank/Containers/romm/env
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
+21
-8
@@ -42,8 +42,8 @@ SERVICE_ORDER = (
|
||||
"authentik-outpost",
|
||||
"caddy",
|
||||
"homepage",
|
||||
"mariadb",
|
||||
"redis",
|
||||
"romm-mariadb",
|
||||
"romm-redis",
|
||||
"romm",
|
||||
"copyparty",
|
||||
"jellyfin",
|
||||
@@ -89,8 +89,8 @@ DANKCLAW_SERVICES = {
|
||||
}
|
||||
|
||||
DANKSERVER_SERVICES = {
|
||||
"mariadb",
|
||||
"redis",
|
||||
"romm-mariadb",
|
||||
"romm-redis",
|
||||
"romm",
|
||||
"copyparty",
|
||||
"jellyfin",
|
||||
@@ -134,6 +134,8 @@ DANKSERVER_COMPOSE_SERVICES = {
|
||||
"lidarr",
|
||||
"readarr",
|
||||
}
|
||||
COMPOSE_NAME_MAP = {"mariadb": "romm-mariadb", "redis": "romm-redis"}
|
||||
|
||||
|
||||
|
||||
def _add(services: set[str], *names: str) -> None:
|
||||
@@ -191,7 +193,7 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
|
||||
# An unavailable or malformed revision is safer as a broad compose plan
|
||||
# than as a silent no-op. It still cannot include LLM units.
|
||||
if (old_doc and not new_doc) or (new_doc and not old_doc and names):
|
||||
return allowed
|
||||
return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
|
||||
|
||||
# Top-level networks/configuration can affect every compose service even
|
||||
# when no individual service mapping changed. Ignore the services key while
|
||||
@@ -199,9 +201,10 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
|
||||
old_globals = {key: value for key, value in old_doc.items() if key != "services"}
|
||||
new_globals = {key: value for key, value in new_doc.items() if key != "services"}
|
||||
if old_globals != new_globals:
|
||||
return allowed
|
||||
return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}
|
||||
|
||||
return {name for name in names if name in allowed and old.get(name) != new.get(name)}
|
||||
changed = {name for name in names if name in allowed and old.get(name) != new.get(name)}
|
||||
return {COMPOSE_NAME_MAP.get(n, n) for n in changed}
|
||||
|
||||
|
||||
def services_for_path(path: str, target: str) -> set[str]:
|
||||
@@ -297,7 +300,17 @@ def services_for_path(path: str, target: str) -> set[str]:
|
||||
|
||||
if parts[0] == "dankserver":
|
||||
if len(parts) >= 2 and parts[1] == "compose.yaml":
|
||||
_add(services, *DANKSERVER_COMPOSE_SERVICES)
|
||||
# Compose service keys map onto the deployed unit names.
|
||||
_add(services, *(COMPOSE_NAME_MAP.get(n, n) for n in DANKSERVER_COMPOSE_SERVICES))
|
||||
return services
|
||||
if len(parts) >= 3 and parts[2] == "quadlet":
|
||||
quadlet_services = {
|
||||
"romm": {"romm", "romm-mariadb", "romm-redis"},
|
||||
"jellyfin": {"jellyfin"},
|
||||
"calibre-web": {"calibre-web"},
|
||||
"copyparty": {"copyparty"},
|
||||
}
|
||||
_add(services, *quadlet_services.get(parts[1], set()))
|
||||
return services
|
||||
|
||||
if parts[0] == "scripts":
|
||||
|
||||
+107
-1
@@ -92,7 +92,7 @@ service_is_allowed() {
|
||||
dankclaw:caddy|dankclaw:homepage|\
|
||||
dankclaw:frank-default-large|dankclaw:frank-default-npu|\
|
||||
dankclaw:frank-default-sightsound|\
|
||||
dankserver:mariadb|dankserver:redis|dankserver:romm|\
|
||||
dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
|
||||
dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|\
|
||||
dankserver:prowlarr|dankserver:qbittorrent|dankserver:radarr|\
|
||||
dankserver:sonarr|dankserver:lidarr|dankserver:readarr|\
|
||||
@@ -526,6 +526,108 @@ wait_container_healthy() {
|
||||
return 1
|
||||
}
|
||||
|
||||
# --- dankserver media/library stack ----------------------------------------------
|
||||
# These services migrated from compose-era bare containers to boot-persistent
|
||||
# Quadlet units installed from this repo (podman 5.x v1 generator honors the
|
||||
# WantedBy=default.target inside each .container file). The first deploy of a
|
||||
# service retires the old container and migrates the data root before starting
|
||||
# the unit; re-running the handler on an already-active unit restarts only the
|
||||
# selected unit.
|
||||
|
||||
migrate_data_root() { # $1 = old /opt path, $2 = new data-root path (same fs: rename)
|
||||
local from="$1" to="$2"
|
||||
[[ -d "$from" ]] || return 0
|
||||
mv -- "$from" "$to"
|
||||
chown -R "$(id -u):$(id -g)" "$to"
|
||||
}
|
||||
|
||||
deploy_romm_stack() {
|
||||
local service="$1" unit vol tmp
|
||||
case "$service" in
|
||||
mariadb) service=romm-mariadb ;;
|
||||
redis) service=romm-redis ;;
|
||||
esac
|
||||
for unit in romm-mariadb romm-redis romm; do
|
||||
cp "dankserver/romm/quadlet/$unit.container" "$quadlet_unit_dir/"
|
||||
done
|
||||
systemctl --user daemon-reload
|
||||
if ! systemctl --user is-active --quiet romm-mariadb.service; then
|
||||
# First cutover: the env file must exist before the first start, or
|
||||
# the units would boot with empty secrets. Fail before stopping anything.
|
||||
[[ -f /home/dank/Containers/romm/env ]] || {
|
||||
echo "FAIL: /home/dank/Containers/romm/env does not exist; seed it before the first romm deploy" >&2
|
||||
return 1
|
||||
}
|
||||
# Capture anonymous volume names while the containers are still inspectable,
|
||||
# then stop and rm the compose-era trio.
|
||||
local vols
|
||||
vols="$(podman inspect -f '{{range .Mounts}}{{if eq .Type "volume"}}{{.Name}} {{end}}{{end}}' romm 2>/dev/null || true)"
|
||||
podman stop -t 60 romm-mariadb romm-redis romm || true
|
||||
podman rm romm-mariadb romm-redis romm || true
|
||||
for vol in $vols; do
|
||||
tmp="$(mktemp -d)"
|
||||
podman volume export --output "$tmp/v.tar" "$vol"
|
||||
# --skip-old-files keeps live bind-mounted content (config/, library/,
|
||||
# resources/, mariadb/, redis/) and rescues only unshadowed entries like assets/.
|
||||
tar --skip-old-files -C /home/dank/Containers/romm -xf "$tmp/v.tar"
|
||||
rm -rf -- "$tmp"
|
||||
done
|
||||
migrate_data_root /opt/romm /home/dank/Containers/romm
|
||||
systemctl --user start romm-mariadb.service
|
||||
wait_container_healthy romm-mariadb 120 || return 1
|
||||
systemctl --user start romm-redis.service
|
||||
wait_container_healthy romm-redis 60 || return 1
|
||||
if [[ "$service" == "romm" ]]; then
|
||||
systemctl --user start romm.service
|
||||
fi
|
||||
return 0
|
||||
fi
|
||||
systemctl --user restart "$service.service"
|
||||
}
|
||||
|
||||
deploy_jellyfin() {
|
||||
cp "dankserver/jellyfin/quadlet/jellyfin.container" "$quadlet_unit_dir/"
|
||||
systemctl --user daemon-reload
|
||||
if ! systemctl --user is-active -q jellyfin.service; then
|
||||
podman stop -t 30 jellyfin || true
|
||||
podman rm jellyfin || true
|
||||
migrate_data_root /opt/jellyfin /home/dank/Containers/jellyfin
|
||||
fi
|
||||
systemctl --user restart jellyfin.service
|
||||
}
|
||||
|
||||
deploy_calibre_web() {
|
||||
cp "dankserver/calibre-web/quadlet/calibre-web.container" "$quadlet_unit_dir/"
|
||||
systemctl --user daemon-reload
|
||||
if ! systemctl --user is-active -q calibre-web.service; then
|
||||
# The compose-era container ran under a podman-generate-systemd unit; stop
|
||||
# that unit first so its Restart=always cannot resurrect the old container
|
||||
# and collide with the new ContainerName.
|
||||
systemctl --user stop container-calibre-web.service 2>/dev/null || true
|
||||
podman stop calibre-web || true
|
||||
podman rm calibre-web || true
|
||||
fi
|
||||
systemctl --user restart calibre-web.service
|
||||
}
|
||||
|
||||
deploy_copyparty() {
|
||||
# The admin account is created from ${COPAY_ACCOUNT}:${COPAY_PASSWORD} expanded
|
||||
# at ExecStart time; a missing env file must fail the unit, not boot copyparty
|
||||
# with a garbage admin password.
|
||||
[[ -f /home/dank/Containers/copyparty/env ]] || {
|
||||
echo "FAIL: /home/dank/Containers/copyparty/env does not exist; seed it before the first copyparty deploy" >&2
|
||||
return 1
|
||||
}
|
||||
cp "dankserver/copyparty/quadlet/copyparty.container" "$quadlet_unit_dir/"
|
||||
systemctl --user daemon-reload
|
||||
if ! systemctl --user is-active -q copyparty.service; then
|
||||
podman stop -t 15 copyparty || true
|
||||
podman rm copyparty || true
|
||||
migrate_data_root /opt/copyparty /home/dank/Containers/copyparty
|
||||
fi
|
||||
systemctl --user restart copyparty.service
|
||||
}
|
||||
|
||||
deploy_authentik() {
|
||||
local unit
|
||||
mkdir -p "$quadlet_unit_dir"
|
||||
@@ -696,6 +798,10 @@ deploy_service() {
|
||||
frank-default-npu) deploy_llm_npu ;;
|
||||
frank-default-sightsound) deploy_llm_sightsound ;;
|
||||
hermes|hermes-dashboard|hermes-webui) deploy_hermes ;;
|
||||
romm|romm-mariadb|romm-redis|mariadb|redis) deploy_romm_stack "$service" ;;
|
||||
jellyfin) deploy_jellyfin ;;
|
||||
calibre-web) deploy_calibre_web ;;
|
||||
copyparty) deploy_copyparty ;;
|
||||
*) deploy_compose_service "$service" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
+2
-2
@@ -122,8 +122,8 @@ valid_service() {
|
||||
dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:anubis|\
|
||||
dankclaw:frank-default-large|dankclaw:frank-default-npu|\
|
||||
dankclaw:frank-default-sightsound|\
|
||||
dankserver:mariadb|dankserver:redis|dankserver:romm|dankserver:copyparty|\
|
||||
dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\
|
||||
dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
|
||||
dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\
|
||||
dankserver:qbittorrent|dankserver:radarr|dankserver:sonarr|\
|
||||
dankserver:lidarr|dankserver:readarr|dankserver:node-exporter|\
|
||||
dankserver:frank-default-small)
|
||||
|
||||
@@ -205,6 +205,14 @@ for path in "${CHANGED[@]}"; do
|
||||
old/scripts/*|old/scripts/**)
|
||||
add_test tests/scripts_syntax.bats
|
||||
;;
|
||||
# Cutover-era dankserver quadlet units (romm trio, jellyfin, calibre-web,
|
||||
# copyparty): the seam checks boot-persistence + v1-generator contract;
|
||||
# deploy-flow seams guard the deployer routing that installs them.
|
||||
dankserver/romm/*|dankserver/jellyfin/*|dankserver/calibre-web/*|dankserver/copyparty/*)
|
||||
add_test tests/dankserver_quadlet.bats
|
||||
add_test tests/deployment_flow.bats
|
||||
add_test tests/deployment_scoping.bats
|
||||
;;
|
||||
report/*)
|
||||
# Frozen audit reports are point-in-time artifacts; not testable.
|
||||
;;
|
||||
|
||||
Executable
+45
@@ -0,0 +1,45 @@
|
||||
#!/usr/bin/env bats
|
||||
# Seam: the six cutover-era dankserver quadlet units (romm trio, jellyfin,
|
||||
# calibre-web, copyparty) must keep their boot-persistence and v1-generator
|
||||
# contracts. The podman 5.x v1 Quadlet generator silently drops or hard-fails
|
||||
# on several keys; these tests pin the contract that keeps the units loadable
|
||||
# and secret-free in the repo.
|
||||
|
||||
load helpers
|
||||
|
||||
@test "all six cutover units exist under dankserver/<svc>/quadlet/" {
|
||||
for unit in romm/quadlet/romm romm/quadlet/romm-mariadb romm/quadlet/romm-redis jellyfin/quadlet/jellyfin calibre-web/quadlet/calibre-web copyparty/quadlet/copyparty; do
|
||||
[ -f "$REPO_ROOT/dankserver/$unit.container" ] || return 1
|
||||
done
|
||||
}
|
||||
|
||||
@test "every cutover unit is boot-persistent (WantedBy=default.target)" {
|
||||
for unit in romm/quadlet/romm romm/quadlet/romm-mariadb romm/quadlet/romm-redis jellyfin/quadlet/jellyfin calibre-web/quadlet/calibre-web copyparty/quadlet/copyparty; do
|
||||
grep -q '^WantedBy=default.target$' "$REPO_ROOT/dankserver/$unit.container" || return 1
|
||||
done
|
||||
}
|
||||
|
||||
@test "copyparty uses Exec= not Command= (v1 generator hard-fails on Command=)" {
|
||||
unit="$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container"
|
||||
grep -q '^Command=' "$unit" && return 1
|
||||
grep -q '^Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD}' "$unit" || return 1
|
||||
}
|
||||
|
||||
@test "copyparty and romm consume host-local env files, never in-repo secrets" {
|
||||
grep -q '^EnvironmentFile=/home/dank/Containers/copyparty/env$' \
|
||||
"$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" || return 1
|
||||
for unit in romm/quadlet/romm romm/quadlet/romm-mariadb; do
|
||||
grep -q '^EnvironmentFile=/home/dank/Containers/romm/env$' \
|
||||
"$REPO_ROOT/dankserver/$unit.container" || return 1
|
||||
done
|
||||
# No literal credential may ever appear in a tracked unit file: the only
|
||||
# Exec= arguments must be variable expansions, never a literal account:secret.
|
||||
! grep -qE '\-a [A-Za-z0-9]+:[A-Za-z0-9]' "$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" || return 1
|
||||
}
|
||||
|
||||
@test "romm db services keep their service-discovery aliases on the appnet" {
|
||||
grep -q '^Network=dankserver_appnet:alias=mariadb$' \
|
||||
"$REPO_ROOT/dankserver/romm/quadlet/romm-mariadb.container" || return 1
|
||||
grep -q '^Network=dankserver_appnet:alias=redis$' \
|
||||
"$REPO_ROOT/dankserver/romm/quadlet/romm-redis.container" || return 1
|
||||
}
|
||||
Reference in New Issue
Block a user