sjat
3a31b8e6f4
The Caddyfile was bind-mounted as a single file. ansible.builtin.template writes
atomically (temp + rename), so a re-render swaps the file's inode while the running
container keeps the old one — `caddy reload` then re-read stale config and silently
no-op'd ("config is unchanged"), so new routes never loaded. Surfaced deploying the
NetBird route: Caddy never requested its cert. Fix: render to ./caddy/Caddyfile and
mount the ./caddy DIRECTORY at /etc/caddy — directory mounts reflect inode swaps, so
graceful `caddy reload` works. Proven on askari: atomic replace in the host dir is
visible inside the running container.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
50 lines
1.5 KiB
YAML
50 lines
1.5 KiB
YAML
---
|
|
- name: Ensure the service directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ reverse_proxy__base_dir }}"
|
|
state: directory
|
|
mode: "0750"
|
|
tags: [config]
|
|
|
|
- name: Ensure the Caddy config directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ reverse_proxy__base_dir }}/caddy"
|
|
state: directory
|
|
mode: "0750"
|
|
tags: [config]
|
|
|
|
# Render into a directory that is bind-mounted whole (./caddy -> /etc/caddy). Mounting
|
|
# the directory, not the single file, means an atomic template rewrite (which swaps the
|
|
# file inode) stays visible inside the running container, so `caddy reload` picks it up.
|
|
# A single-file bind mount pins the original inode and reload silently no-ops (ADR-024).
|
|
- name: Render the Caddyfile
|
|
ansible.builtin.template:
|
|
src: Caddyfile.j2
|
|
dest: "{{ reverse_proxy__base_dir }}/caddy/Caddyfile"
|
|
mode: "0644"
|
|
notify: reload caddy
|
|
tags: [config]
|
|
|
|
- name: Render the Gandi DNS-01 token env file
|
|
ansible.builtin.template:
|
|
src: env.j2
|
|
dest: "{{ reverse_proxy__base_dir }}/env"
|
|
mode: "0600"
|
|
no_log: true # contains the Gandi PAT
|
|
when: reverse_proxy__acme_dns_provider == 'gandi'
|
|
notify: reload caddy
|
|
tags: [config]
|
|
|
|
- name: Render the compose file
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ reverse_proxy__base_dir }}/docker-compose.yml"
|
|
mode: "0644"
|
|
tags: [config]
|
|
|
|
- name: Bring the reverse proxy up
|
|
community.docker.docker_compose_v2:
|
|
project_src: "{{ reverse_proxy__base_dir }}"
|
|
state: present
|
|
when: reverse_proxy__manage | bool
|
|
tags: [deploy]
|