Add Atlas media and storage services

ansible/roles/profile_server/tasks/main.yml

@@ -8,15 +8,16 @@
     fail_msg: >-
       server_firewall_backend must be firewalld for the Rocky server profile.
 
-- name: Require server container secret variables
-  tags: [dotfiles, dotfiles:server, services]
+- name: Require server database secret variables
+  tags: [dotfiles, dotfiles:server, services, navidrome]
   ansible.builtin.assert:
     that:
-      - (vault_navidrome_db_password | default('')) | length > 0
+      - server_navidrome_db_password | length > 0
       - (vault_postgres_root_password | default('')) | length > 0
     fail_msg: >-
-      Server container secrets are missing. Define vault_navidrome_db_password and
-      vault_postgres_root_password in secrets/vault.yml or another vars source.
+      Define vault_navidrome_db_password and vault_postgres_root_password in Vault
+      before rendering the Navidrome database configuration.
+  no_log: true
 
 - name: Configure DuckDNS updater
   tags: [dotfiles, dotfiles:server, duckdns]
@@ -71,6 +72,12 @@
   tags: [services, podman]
   ansible.builtin.include_tasks: podman-compose.yml
 
+- name: Configure Atlas music mount
+  ansible.builtin.import_tasks: rclone-music.yml
+
+- name: Configure rootless Navidrome
+  ansible.builtin.import_tasks: navidrome.yml
+
 - name: Disable SSH root login on server
   tags: [services]
   ansible.builtin.lineinfile:

ansible/roles/profile_server/tasks/navidrome.yml

@@ -0,0 +1,114 @@
+---
+- name: Read server account details for rootless Navidrome
+  tags: [services, podman, rclone, navidrome]
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ server_username }}"
+  when: server_atlas_music_enabled | bool
+
+- name: Check for a running legacy rootful Navidrome container
+  tags: [services, podman, navidrome]
+  ansible.builtin.command:
+    argv:
+      - podman
+      - container
+      - inspect
+      - --format
+      - "{{ '{{.State.Running}}' }}"
+      - navidrome
+  register: server_legacy_navidrome_container
+  changed_when: false
+  failed_when: false
+  check_mode: false
+  when: server_atlas_music_enabled | bool
+
+- name: Refuse concurrent legacy and rootless Navidrome
+  tags: [services, podman, navidrome]
+  ansible.builtin.assert:
+    that:
+      - >-
+        server_legacy_navidrome_container.rc != 0
+        or server_legacy_navidrome_container.stdout | trim != 'true'
+    fail_msg: >-
+      Stop the legacy rootful Navidrome container before enabling the rootless Quadlet.
+      The playbook does not remove the old container or its data automatically.
+  when: server_atlas_music_enabled | bool
+
+- name: Enable lingering for rootless Navidrome
+  tags: [services, podman, navidrome]
+  ansible.builtin.command:
+    argv:
+      - loginctl
+      - enable-linger
+      - "{{ server_username }}"
+    creates: "/var/lib/systemd/linger/{{ server_username }}"
+  when: server_atlas_music_enabled | bool
+
+- name: Start server user systemd manager
+  tags: [services, podman, navidrome]
+  ansible.builtin.systemd:
+    name: "user@{{ ansible_facts['getent_passwd'][server_username][1] }}.service"
+    state: started
+  when:
+    - server_atlas_music_enabled | bool
+    - not ansible_check_mode
+
+- name: Create rootless Navidrome Quadlet directory
+  tags: [services, podman, navidrome]
+  ansible.builtin.file:
+    path: "{{ server_navidrome_quadlet_dir }}"
+    state: directory
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0700"
+  when: server_atlas_music_enabled | bool
+
+- name: Create private rootless Navidrome configuration directory
+  tags: [services, podman, navidrome]
+  ansible.builtin.file:
+    path: "{{ server_navidrome_env_dir }}"
+    state: directory
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0700"
+  when: server_atlas_music_enabled | bool
+
+- name: Render Vault-backed rootless Navidrome environment
+  tags: [services, podman, navidrome]
+  ansible.builtin.template:
+    src: navidrome.env.j2
+    dest: "{{ server_navidrome_env_file }}"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0600"
+  no_log: true
+  diff: false
+  notify: Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Render rootless Navidrome Quadlet
+  tags: [services, podman, navidrome]
+  ansible.builtin.template:
+    src: navidrome.container.j2
+    dest: "{{ server_navidrome_quadlet_dir }}/navidrome.container"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0644"
+  notify: Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Start rootless Navidrome Quadlet
+  tags: [services, podman, navidrome]
+  become_user: "{{ server_username }}"
+  ansible.builtin.systemd:
+    name: navidrome.service
+    scope: user
+    state: started
+    daemon_reload: true
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}"
+    DBUS_SESSION_BUS_ADDRESS: >-
+      unix:path=/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}/bus
+  when:
+    - server_atlas_music_enabled | bool
+    - not ansible_check_mode

ansible/roles/profile_server/tasks/rclone-music.yml

@@ -0,0 +1,105 @@
+---
+- name: Require completed Atlas SFTP mount configuration
+  tags: [services, rclone, navidrome]
+  ansible.builtin.assert:
+    that:
+      - server_atlas_sftp_host != 'CHANGEME_ATLAS_WIREGUARD_IP'
+      - server_atlas_sftp_known_host != 'CHANGEME_ATLAS_SSH_HOST_KEY'
+      - server_atlas_sftp_known_host | length > 0
+      - server_atlas_sftp_private_key | length > 0
+      - server_atlas_sftp_remote_path == '/pool/media/music'
+    fail_msg: >-
+      Define the Atlas WireGuard address, pinned SSH host key and Vault-backed
+      SFTP private key before enabling the music mount.
+  no_log: true
+  when: server_atlas_music_enabled | bool
+
+- name: Create private rclone configuration directory
+  tags: [services, rclone, navidrome]
+  ansible.builtin.file:
+    path: "{{ server_rclone_config_dir }}"
+    state: directory
+    owner: root
+    group: "{{ server_user_group }}"
+    mode: "0750"
+  when: server_atlas_music_enabled | bool
+
+- name: Install Vault-backed Atlas SFTP private key
+  tags: [services, rclone, navidrome]
+  ansible.builtin.copy:
+    content: "{{ server_atlas_sftp_private_key | trim }}\n"
+    dest: "{{ server_atlas_sftp_private_key_file }}"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0600"
+  no_log: true
+  diff: false
+  notify:
+    - Restart rclone music mount
+    - Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Install pinned Atlas SSH host key
+  tags: [services, rclone, navidrome]
+  ansible.builtin.copy:
+    content: "{{ server_atlas_sftp_known_host | trim }}\n"
+    dest: "{{ server_atlas_sftp_known_hosts_file }}"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0640"
+  notify:
+    - Restart rclone music mount
+    - Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Render Atlas SFTP rclone configuration
+  tags: [services, rclone, navidrome]
+  ansible.builtin.template:
+    src: rclone.conf.j2
+    dest: "{{ server_rclone_config_file }}"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0600"
+  notify:
+    - Restart rclone music mount
+    - Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Create rclone music directories
+  tags: [services, rclone, navidrome]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0750"
+  loop:
+    - "{{ server_rclone_music_mountpoint }}"
+    - "{{ server_rclone_music_cache_dir }}"
+  loop_control:
+    label: "{{ item }}"
+  when: server_atlas_music_enabled | bool
+
+- name: Render rclone music system service
+  tags: [services, rclone, navidrome]
+  ansible.builtin.template:
+    src: rclone-music.service.j2
+    dest: "/etc/systemd/system/{{ server_rclone_music_service }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart rclone music mount
+    - Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Enable and start rclone music mount
+  tags: [services, rclone, navidrome]
+  ansible.builtin.systemd:
+    name: "{{ server_rclone_music_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true
+  when:
+    - server_atlas_music_enabled | bool
+    - not ansible_check_mode