docker_compose_v2 ansible (instead of shell)

- remove immich decommision (it's fine(tm))
- use ansible to create container, instead of bash script

.github/workflows/infra.yaml

@@ -29,7 +29,7 @@ jobs:
           apt update
           apt install -y python3-pip
           pip3 install -r requirements.txt
-          ansible-galaxy collection install community.general infisical.vault
+          ansible-galaxy collection install community.general community.docker infisical.vault --force
 
       - name: Check playbooks
         run: |

infra/cloud/0000_proxmox_playbook.yaml

@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      register: create
+      notify: Initial boot
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,21 +65,8 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    # Initial boot
+    - name: Force all notified handlers to run
-    # For some reason debian cloud images don't use
+      ansible.builtin.meta: flush_handlers
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      when: create.changed is true
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -108,3 +95,18 @@
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
+  handlers:
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90

infra/cloud/0002_docker_playbook.yaml

@@ -1,4 +1,4 @@
-- name: Install software
+- name: Install docker
   hosts: cloud
   gather_facts: false
   tasks:

infra/cloud/0003_00_cleanup_script_deploy_playbook.yaml

@@ -0,0 +1,13 @@
+- name: Cleanup old ~/nextcloud directory
+  hosts: cloud
+  gather_facts: false
+  vars:
+    app: nextcloud
+  tasks:
+    - name: Wait for connection
+      ansible.builtin.wait_for_connection:
+        timeout: 300
+    - name: Delete nextcloud directory
+      ansible.builtin.file:
+        path: "$HOME/{{ app }}"
+        state: absent

infra/cloud/0003_nextcloud_playbook.yaml

@@ -2,21 +2,29 @@
   hosts: cloud
   gather_facts: false
   vars:
-    app: nextcloud
+    container: nextcloud-aio-mastercontainer
   tasks:
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
-    - name: Get user
+    - name: Deploy master container
-      ansible.builtin.user:
+      community.docker.docker_container:
-        name: debian
+        image: nextcloud/all-in-one:latest
-      register: user
+        recreate: true
-    - name: Copy project
+        state: started
-      ansible.builtin.copy:
+        restart_policy: unless-stopped
-        src: "./{{ app }}"
+        init: true
-        dest: "{{ user.home }}"
+        name: "{{ container }}"
-        mode: "0744"
+        published_ports:
-    - name: Re-deploy
+          - 8080:8080
-      ansible.builtin.command: bash all-in-one.sh
+        env:
-      args:
+          NEXTCLOUD_UPLOAD_LIMIT: 16G
-        chdir: "{{ user.home }}/{{ app }}"
+          NEXTCLOUD_MAX_TIME: "7200"
+          NEXTCLOUD_ADDITIONAL_APKS: imagemagick ffmpeg
+          APACHE_PORT: "11000"
+          APACHE_IP_BINDING: "0.0.0.0"
+          TZ: Europe/London
+          AIO_DISABLE_BACKUP_SECTION: "true"
+        volumes:
+          - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
+          - /var/run/docker.sock:/var/run/docker.sock:ro

infra/cloud/0004_decommission_immich_playbook.yaml

@@ -1,71 +0,0 @@
-- name: Decommission Immich
-  hosts: cloud
-  gather_facts: false
-  vars:
-    app: immich
-    api_user: "{{ lookup('ansible.builtin.env', 'PROXMOX_USER') }}"
-    api_host: "{{ lookup('ansible.builtin.env', 'PROXMOX_HOST' ) }}"
-    api_token_id: "{{ lookup('ansible.builtin.env', 'PROXMOX_TOKEN_ID') }}"
-    api_token_secret: "{{ lookup('ansible.builtin.env', 'PROXMOX_TOKEN_SECRET') }}"
-    vmname: "{{ inventory_hostname | regex_replace('^([^\\.]+)\\..+$', '\\1') }}"
-    node: pve
-  module_defaults:
-    community.general.proxmox_kvm:
-      api_user: "{{ api_user }}"
-      api_host: "{{ api_host }}"
-      api_token_id: "{{ api_token_id }}"
-      api_token_secret: "{{ api_token_secret }}"
-      name: "{{ vmname }}"
-      node: "{{ node }}"
-    community.general.proxmox_disk:
-      api_user: "{{ api_user }}"
-      api_host: "{{ api_host }}"
-      api_token_id: "{{ api_token_id }}"
-      api_token_secret: "{{ api_token_secret }}"
-      name: "{{ vmname }}"
-  tasks:
-    - name: Wait for connection
-      ansible.builtin.wait_for_connection:
-        timeout: 300
-    - name: Get user
-      ansible.builtin.user:
-        name: debian
-      register: user
-    - name: Docker compose down
-      ansible.builtin.command: docker compose down
-      args:
-        chdir: "{{ user.home }}/{{ app }}"
-      ignore_errors: true
-    - name: Remove docker volumes
-      ansible.builtin.command: docker compose down --volumes
-      args:
-        chdir: "{{ user.home }}/{{ app }}"
-      ignore_errors: true
-    - name: Remove config directory
-      ansible.builtin.file:
-        path: "{{ user.home }}/{{ app }}"
-        state: absent
-
-    - name: Destroy media disk
-      community.general.proxmox_disk:
-        disk: scsi2
-        state: absent
-      delegate_to: localhost
-    - name: Remove media mount
-      ansible.posix.mount:
-        src: /dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:2-part1
-        path: /mnt/media
-        fstype: ext4
-        opts: rw,errors=remount-ro,x-systemd.growfs
-        state: absent
-      become: true
-    - name: Remove media directory
-      ansible.builtin.file:
-        path: /mnt/media
-        state: absent
-      become: true
-    - name: Restart VM
-      community.general.proxmox_kvm:
-        state: restarted
-        timeout: 60
-      delegate_to: localhost

infra/cloud/nextcloud/all-in-one.sh

@@ -1,21 +0,0 @@
-#!/bin/bash
-
-docker stop nextcloud-aio-mastercontainer || true
-docker rm nextcloud-aio-mastercontainer || true
-
-docker run \
---init \
---sig-proxy=false \
---name nextcloud-aio-mastercontainer \
---restart unless-stopped \
---publish 8080:8080 \
---env NEXTCLOUD_UPLOAD_LIMIT=16G \
---env NEXTCLOUD_MAX_TIME=7200 \
---env NEXTCLOUD_ADDITIONAL_APKS="imagemagick ffmpeg" \
---env APACHE_PORT=11000 \
---env APACHE_IP_BINDING=0.0.0.0 \
---env TZ=Europe/London \
---env AIO_DISABLE_BACKUP_SECTION=true \
---volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
---volume /var/run/docker.sock:/var/run/docker.sock:ro \
--d nextcloud/all-in-one:latest

infra/music/0000_proxmox_playbook.yaml

@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      register: create
+      notify: Initial boot
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,21 +65,8 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    # Initial boot
+    - name: Force all notified handlers to run
-    # For some reason debian cloud images don't use
+      ansible.builtin.meta: flush_handlers
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      when: create.changed is true
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -114,3 +101,18 @@
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
+  handlers:
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90

infra/music/0002_docker_playbook.yaml

@@ -1,4 +1,4 @@
-- name: Install software
+- name: Install docker
   hosts: music
   gather_facts: false
   tasks:

infra/music/0003_music_playbook.yaml

@@ -7,46 +7,39 @@
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
-    - name: Get user
-      ansible.builtin.user:
-        name: debian
-      register: user
     - name: Docker compose down
-      ansible.builtin.command: docker compose down
+      community.docker.docker_compose_v2:
-      args:
+        project_src: "$HOME/{{ app }}"
-        chdir: "{{ user.home }}/{{ app }}"
+        state: absent
-      ignore_errors: true
     - name: Copy project
       ansible.builtin.copy:
         src: "./{{ app }}"
-        dest: "{{ user.home }}"
+        dest: "$HOME"
         mode: "0744"
-
     - name: Replace LastFM API key secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "LASTFM_APIKEY_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/music', secret_name='LASTFM_APIKEY')['value'] }}"
     - name: Replace LastFM secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "LASTFM_SECRET_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/music', secret_name='LASTFM_SECRET')['value'] }}"
     - name: Replace Mongo Password secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "SPOTIFY_ID_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/music', secret_name='SPOTIFY_ID')['value'] }}"
     - name: Replace SMTP Password secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "SPOTIFY_SECRET_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/music', secret_name='SPOTIFY_SECRET')['value'] }}"
 
-    - name: Docker compose up -d
+    - name: Docker compose up
-      ansible.builtin.command: docker compose up -d
+      community.docker.docker_compose_v2:
-      args:
+        project_src: "$HOME/{{ app }}"
-        chdir: "{{ user.home }}/{{ app }}"
 
     - name: Update data permissions
       ansible.builtin.file:

infra/photos/0000_proxmox_playbook.yaml

@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      register: create
+      notify: Initial boot
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,21 +65,8 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    # Initial boot
+    - name: Force all notified handlers to run
-    # For some reason debian cloud images don't use
+      ansible.builtin.meta: flush_handlers
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      when: create.changed is true
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -114,3 +101,18 @@
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
+  handlers:
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90

infra/photos/0002_docker_playbook.yaml

@@ -1,4 +1,4 @@
-- name: Install software
+- name: Install docker
   hosts: photos
   gather_facts: false
   tasks:

infra/photos/0003_immich_playbook.yaml

@@ -1,5 +1,5 @@
 - name: Deploy app
-  hosts: photos 
+  hosts: photos
   gather_facts: false
   vars:
     app: immich
@@ -7,31 +7,25 @@
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
-    - name: Get user
-      ansible.builtin.user:
-        name: debian
-      register: user
     - name: Docker compose down
-      ansible.builtin.command: docker compose down
+      community.docker.docker_compose_v2:
-      args:
+        project_src: "$HOME/{{ app }}"
-        chdir: "{{ user.home }}/{{ app }}"
+        state: absent
-      ignore_errors: true
     - name: Copy project
       ansible.builtin.copy:
         src: "./{{ app }}"
-        dest: "{{ user.home }}"
+        dest: "$HOME"
         mode: "0744"
     - name: Replace Typesense secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "TYPESENSE_API_KEY_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/photos', secret_name='TYPESENSE_API_KEY')['value'] }}"
     - name: Replace DB secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "DB_PASSWORD_VALUE"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/photos', secret_name='DB_PASSWORD')['value'] }}"
     - name: Docker compose up -d
-      ansible.builtin.command: docker compose up -d
+      community.docker.docker_compose_v2:
-      args:
+        project_src: "$HOME/{{ app }}"
-        chdir: "{{ user.home }}/{{ app }}"

infra/samba/0000_proxmox_playbook.yaml

@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      register: create
+      notify: Initial boot
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,21 +65,8 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    # Initial boot
+    - name: Force all notified handlers to run
-    # For some reason debian cloud images don't use
+      ansible.builtin.meta: flush_handlers
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      when: create.changed is true
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -113,3 +100,18 @@
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
+  handlers:
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90

infra/samba/0002_docker_playbook.yaml

@@ -1,4 +1,4 @@
-- name: Install software
+- name: Install docker
   hosts: samba
   gather_facts: false
   tasks:

infra/samba/0003_samba_playbook.yaml

@@ -7,32 +7,25 @@
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
-    - name: Get user
-      ansible.builtin.user:
-        name: debian
-      register: user
-
     - name: Docker compose down
-      ansible.builtin.command: docker compose down
+      community.docker.docker_compose_v2:
-      args:
+        project_src: "$HOME/{{ app }}"
-        chdir: "{{ user.home }}/{{ app }}"
+        state: absent
-      ignore_errors: true
     - name: Copy project
       ansible.builtin.copy:
         src: "./{{ app }}"
-        dest: "{{ user.home }}"
+        dest: "$HOME"
         mode: "0744"
 
     - name: Replace KVK Password secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/config.yml"
+        path: "$HOME/{{ app }}/config.yml"
         regexp: "KVK_PASSWORD"
         replace: "{{ lookup('infisical.vault.read_secrets', env_slug='prod', path='/samba', secret_name='KVK_PASSWORD')['value'] }}"
 
-    - name: Docker compose up -d
+    - name: Docker compose up
-      ansible.builtin.command: docker compose up -d
+      community.docker.docker_compose_v2:
-      args:
+        project_src: "$HOME/{{ app }}"
-        chdir: "{{ user.home }}/{{ app }}"
 
     - name: Update samba permissions
       ansible.builtin.file:

infra/secrets/0000_proxmox_playbook.yaml

@@ -36,7 +36,7 @@
       community.general.proxmox_kvm:
         clone: "{{ node }}-debian-12"
         storage: nvme
-      register: create
+      notify: Initial boot
     - name: Wait for status
       community.general.proxmox_kvm:
         state: current
@@ -65,21 +65,8 @@
           ipconfig0: ip=dhcp,ip6=auto
           ipconfig1: ip=dhcp
 
-    # Initial boot
+    - name: Force all notified handlers to run
-    # For some reason debian cloud images don't use
+      ansible.builtin.meta: flush_handlers
-    # cloud-init for networking on first boot (cloud-init files
-    # are regenerated AFTER networking starts). But we need the
-    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
-    - name: Initial boot
-      when: create.changed is true
-      block:
-        - name: Start
-          community.general.proxmox_kvm:
-            state: started
-          register: start
-        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
-          ansible.builtin.wait_for:
-            timeout: 90
 
     # VM Configuration
     - name: Resize root disk
@@ -109,3 +96,18 @@
       community.general.proxmox_kvm:
         state: restarted
         timeout: 60
+  handlers:
+    # Initial boot
+    # For some reason debian cloud images don't use
+    # cloud-init for networking on first boot (cloud-init files
+    # are regenerated AFTER networking starts). But we need the
+    # hostname to be registered with DHCP later on so ¯\_(ツ)_/¯
+    - name: Initial boot
+      block:
+        - name: Start
+          community.general.proxmox_kvm:
+            state: started
+          register: start
+        - name: Wait 1.5 min # Initial apt update, apt upgrade, cloud-init
+          ansible.builtin.wait_for:
+            timeout: 90

infra/secrets/0002_docker_playbook.yaml

@@ -1,4 +1,4 @@
-- name: Install software
+- name: Install docker
   hosts: secrets
   gather_facts: false
   tasks:

infra/secrets/0003_infiscal_playbook.yaml

@@ -7,43 +7,37 @@
     - name: Wait for connection
       ansible.builtin.wait_for_connection:
         timeout: 300
-    - name: Get user
-      ansible.builtin.user:
-        name: debian
-      register: user
     - name: Docker compose down
-      ansible.builtin.command: docker compose down
+      community.docker.docker_compose_v2:
-      args:
+        project_src: "$HOME/{{ app }}"
-        chdir: "{{ user.home }}/{{ app }}"
+        state: absent
-      ignore_errors: true
     - name: Copy project
       ansible.builtin.copy:
         src: "./{{ app }}"
-        dest: "{{ user.home }}"
+        dest: "$HOME"
         mode: "0744"
 
     - name: Replace Encryption Key secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "ENCRYPTION_KEY_VALUE"
         replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_ENCRYPTION_KEY') }}"
     - name: Replace Auth secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "AUTH_SECRET_VALUE"
         replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_AUTH_SECRET') }}"
     - name: Replace Mongo Password secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "MONGO_PASSWORD_VALUE"
         replace: "{{ lookup('ansible.builtin.env', 'INFISICAL_MONGO_PASSWORD') }}"
     - name: Replace SMTP Password secret
       ansible.builtin.replace:
-        path: "{{ user.home }}/{{ app }}/.env"
+        path: "$HOME/{{ app }}/.env"
         regexp: "SMTP_PASSWORD_VALUE"
         replace: "{{ lookup('ansible.builtin.env', 'SMTP_PASSWORD') }}"
 
     - name: Docker compose up -d
-      ansible.builtin.command: docker compose up -d
+      community.docker.docker_compose_v2:
-      args:
+        project_src: "$HOME/{{ app }}"
-        chdir: "{{ user.home }}/{{ app }}"