Add Atlas media and storage services

ansible/roles/profile_server/tasks/rclone-music.yml

@@ -0,0 +1,105 @@
+---
+- name: Require completed Atlas SFTP mount configuration
+  tags: [services, rclone, navidrome]
+  ansible.builtin.assert:
+    that:
+      - server_atlas_sftp_host != 'CHANGEME_ATLAS_WIREGUARD_IP'
+      - server_atlas_sftp_known_host != 'CHANGEME_ATLAS_SSH_HOST_KEY'
+      - server_atlas_sftp_known_host | length > 0
+      - server_atlas_sftp_private_key | length > 0
+      - server_atlas_sftp_remote_path == '/pool/media/music'
+    fail_msg: >-
+      Define the Atlas WireGuard address, pinned SSH host key and Vault-backed
+      SFTP private key before enabling the music mount.
+  no_log: true
+  when: server_atlas_music_enabled | bool
+
+- name: Create private rclone configuration directory
+  tags: [services, rclone, navidrome]
+  ansible.builtin.file:
+    path: "{{ server_rclone_config_dir }}"
+    state: directory
+    owner: root
+    group: "{{ server_user_group }}"
+    mode: "0750"
+  when: server_atlas_music_enabled | bool
+
+- name: Install Vault-backed Atlas SFTP private key
+  tags: [services, rclone, navidrome]
+  ansible.builtin.copy:
+    content: "{{ server_atlas_sftp_private_key | trim }}\n"
+    dest: "{{ server_atlas_sftp_private_key_file }}"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0600"
+  no_log: true
+  diff: false
+  notify:
+    - Restart rclone music mount
+    - Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Install pinned Atlas SSH host key
+  tags: [services, rclone, navidrome]
+  ansible.builtin.copy:
+    content: "{{ server_atlas_sftp_known_host | trim }}\n"
+    dest: "{{ server_atlas_sftp_known_hosts_file }}"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0640"
+  notify:
+    - Restart rclone music mount
+    - Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Render Atlas SFTP rclone configuration
+  tags: [services, rclone, navidrome]
+  ansible.builtin.template:
+    src: rclone.conf.j2
+    dest: "{{ server_rclone_config_file }}"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0600"
+  notify:
+    - Restart rclone music mount
+    - Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Create rclone music directories
+  tags: [services, rclone, navidrome]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0750"
+  loop:
+    - "{{ server_rclone_music_mountpoint }}"
+    - "{{ server_rclone_music_cache_dir }}"
+  loop_control:
+    label: "{{ item }}"
+  when: server_atlas_music_enabled | bool
+
+- name: Render rclone music system service
+  tags: [services, rclone, navidrome]
+  ansible.builtin.template:
+    src: rclone-music.service.j2
+    dest: "/etc/systemd/system/{{ server_rclone_music_service }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart rclone music mount
+    - Restart rootless Navidrome
+  when: server_atlas_music_enabled | bool
+
+- name: Enable and start rclone music mount
+  tags: [services, rclone, navidrome]
+  ansible.builtin.systemd:
+    name: "{{ server_rclone_music_service }}"
+    enabled: true
+    state: started
+    daemon_reload: true
+  when:
+    - server_atlas_music_enabled | bool
+    - not ansible_check_mode