Document Atlas backend phase one and WireGuard deployment

ansible/roles/profile_atlas/defaults/main.yml

@@ -23,23 +23,29 @@ atlas_firewalld_zone: public
 atlas_zfs_pool: CHANGEME_ZFS_POOL
 atlas_zfs_dataset_work: work
 atlas_zfs_dataset_archive: archive
+atlas_zfs_dataset_app_data: archive/app_data
+atlas_zfs_dataset_navidrome: archive/app_data/navidrome
+atlas_zfs_dataset_syncthing: archive/app_data/syncthing
+atlas_zfs_dataset_media: media
 atlas_zfs_dataset_music: media/music
-atlas_zfs_dataset_syncthing: syncthing
 atlas_zfs_dataset_backup_prometheus: backup_prometheus
-atlas_zfs_dataset_icloud_photos: media/icloud_photos
+atlas_zfs_dataset_photobook: media/photobook
+atlas_zfs_dataset_backups: backups
 atlas_zfs_dataset_service_backups: backups/services
 atlas_zfs_service_backups_refreservation: 500G
 atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT
 
 atlas_archive_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_archive }}"
+atlas_app_data_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
+atlas_navidrome_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"
+atlas_syncthing_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
+atlas_media_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_media }}"
 atlas_music_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
 atlas_work_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_work }}"
-atlas_syncthing_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
 atlas_backup_prometheus_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_backup_prometheus }}"
-atlas_icloud_photos_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_icloud_photos }}"
+atlas_photobook_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_photobook }}"
+atlas_backups_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_backups }}"
 atlas_service_backups_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_service_backups }}"
-atlas_syncthing_config_dir: "{{ atlas_admin_home }}/.local/state/syncthing"
-atlas_syncthing_default_dir: "{{ atlas_syncthing_mountpoint }}/Sync"
 
 atlas_45drives_repo_url: https://repo.45drives.com/repofiles/rocky/45drives-enterprise.repo
 atlas_45drives_repo_file: /etc/yum.repos.d/45drives-enterprise.repo
@@ -51,7 +57,7 @@ atlas_45drives_packages:
   - cockpit-scheduler
 
 atlas_nfs_exports:
-  - path: "{{ atlas_icloud_photos_mountpoint }}"
+  - path: "{{ atlas_photobook_mountpoint }}"
     client: "{{ atlas_aegis_ip }}"
     options:
       - rw

ansible/roles/profile_atlas/handlers/main.yml

@@ -28,11 +28,6 @@
     name: smb
     state: restarted
 
-- name: Restart Atlas Syncthing service
-  ansible.builtin.systemd:
-    name: atlas-syncthing
-    state: restarted
-
 - name: Restart Atlas media Quadlets
   ansible.builtin.systemd:
     name: "{{ item }}"

ansible/roles/profile_atlas/tasks/main.yml

@@ -13,6 +13,3 @@
 
 - name: Import Atlas media-container tasks
   ansible.builtin.import_tasks: containers.yml
-
-- name: Import Atlas Syncthing tasks
-  ansible.builtin.import_tasks: syncthing.yml

ansible/roles/profile_atlas/tasks/storage.yml

@@ -16,13 +16,20 @@
         properties:
           compression: zstd
           mountpoint: "{{ atlas_archive_mountpoint }}"
-      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
-        mountpoint: "{{ atlas_music_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_app_data }}"
+        mountpoint: "{{ atlas_app_data_mountpoint }}"
         owner: "{{ atlas_admin_username }}"
         group: "{{ atlas_admin_group }}"
         properties:
-          compression: lz4
-          mountpoint: "{{ atlas_music_mountpoint }}"
+          compression: zstd
+          mountpoint: "{{ atlas_app_data_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_navidrome }}"
+        mountpoint: "{{ atlas_navidrome_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: zstd
+          mountpoint: "{{ atlas_navidrome_mountpoint }}"
       - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_syncthing }}"
         mountpoint: "{{ atlas_syncthing_mountpoint }}"
         owner: "{{ atlas_admin_username }}"
@@ -30,19 +37,40 @@
         properties:
           compression: lz4
           mountpoint: "{{ atlas_syncthing_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_media }}"
+        mountpoint: "{{ atlas_media_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_media_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
+        mountpoint: "{{ atlas_music_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_music_mountpoint }}"
       - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_backup_prometheus }}"
         mountpoint: "{{ atlas_backup_prometheus_mountpoint }}"
         owner: "{{ atlas_admin_username }}"
         group: "{{ atlas_admin_group }}"
         properties:
           mountpoint: "{{ atlas_backup_prometheus_mountpoint }}"
-      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_icloud_photos }}"
-        mountpoint: "{{ atlas_icloud_photos_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_photobook }}"
+        mountpoint: "{{ atlas_photobook_mountpoint }}"
         owner: "{{ atlas_immich_username }}"
         group: "{{ atlas_immich_group }}"
         properties:
           compression: lz4
-          mountpoint: "{{ atlas_icloud_photos_mountpoint }}"
+          mountpoint: "{{ atlas_photobook_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_backups }}"
+        mountpoint: "{{ atlas_backups_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_backups_mountpoint }}"
       - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_service_backups }}"
         mountpoint: "{{ atlas_service_backups_mountpoint }}"
         owner: "{{ atlas_admin_username }}"

ansible/roles/profile_atlas/tasks/syncthing.yml

@@ -1,40 +0,0 @@
----
-- name: Create Atlas Syncthing configuration directory
-  tags: [atlas, syncthing]
-  ansible.builtin.file:
-    path: "{{ atlas_syncthing_config_dir }}"
-    state: directory
-    owner: "{{ atlas_admin_username }}"
-    group: "{{ atlas_admin_group }}"
-    mode: "0700"
-  when: atlas_manage_storage | bool
-
-- name: Create Atlas Syncthing default data directory
-  tags: [atlas, syncthing]
-  ansible.builtin.file:
-    path: "{{ atlas_syncthing_default_dir }}"
-    state: directory
-    owner: "{{ atlas_admin_username }}"
-    group: "{{ atlas_admin_group }}"
-    mode: "0770"
-  when: atlas_manage_storage | bool
-
-- name: Render Atlas Syncthing systemd service
-  tags: [atlas, syncthing]
-  ansible.builtin.template:
-    src: atlas-syncthing.service.j2
-    dest: /etc/systemd/system/atlas-syncthing.service
-    owner: root
-    group: root
-    mode: "0644"
-  notify: Restart Atlas Syncthing service
-  when: atlas_manage_storage | bool
-
-- name: Enable Atlas Syncthing service
-  tags: [atlas, syncthing]
-  ansible.builtin.systemd:
-    name: atlas-syncthing
-    enabled: true
-    state: started
-    daemon_reload: true
-  when: atlas_manage_storage | bool

ansible/roles/profile_atlas/templates/atlas-immich-server.container.j2

@@ -16,7 +16,7 @@ Network=atlas-media.network
 NetworkAlias=atlas-immich-server
 EnvironmentFile=/etc/immich/immich.env
 Volume={{ atlas_immich_upload_dir }}:/data:Z
-Volume={{ atlas_icloud_photos_mountpoint }}:/external/icloud_photos:ro,Z
+Volume={{ atlas_photobook_mountpoint }}:/external/photobook:ro,Z
 Volume=/etc/localtime:/etc/localtime:ro
 NoNewPrivileges=true
 DropCapability=NET_RAW

ansible/roles/profile_atlas/templates/atlas-syncthing.service.j2

@@ -1,16 +0,0 @@
-[Unit]
-Description=Atlas Syncthing service
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-User={{ atlas_admin_username }}
-Group={{ atlas_admin_group }}
-WorkingDirectory={{ atlas_syncthing_mountpoint }}
-Environment=HOME={{ atlas_syncthing_mountpoint }}
-ExecStart=/usr/local/bin/syncthing serve --no-browser --no-restart --no-upgrade --home={{ atlas_syncthing_config_dir }}
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target

ansible/roles/profile_backend_phase1/defaults/main.yml

@@ -0,0 +1,28 @@
+---
+backend_phase1_enabled: false
+backend_phase1_start_services: false
+backend_phase1_username: "{{ atlas_admin_username }}"
+backend_phase1_user_group: "{{ atlas_admin_group }}"
+backend_phase1_user_home: "{{ atlas_admin_home }}"
+backend_phase1_quadlet_dir: "{{ backend_phase1_user_home }}/.config/containers/systemd"
+backend_phase1_wireguard_interface: wg0
+backend_phase1_wireguard_address: CHANGEME_ATLAS_WIREGUARD_ADDRESS
+backend_phase1_wireguard_firewalld_zone: wireguard
+backend_phase1_music_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
+backend_phase1_app_data_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
+backend_phase1_navidrome_data_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"
+backend_phase1_syncthing_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
+backend_phase1_music_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
+backend_phase1_app_data_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_app_data }}"
+backend_phase1_navidrome_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_navidrome }}"
+backend_phase1_syncthing_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_syncthing }}"
+backend_phase1_navidrome_image: docker.io/deluan/navidrome:0.63.2
+backend_phase1_syncthing_image: docker.io/syncthing/syncthing:2.1.3
+backend_phase1_navidrome_port: 4533
+backend_phase1_syncthing_gui_port: 8384
+backend_phase1_syncthing_transfer_port: 22000
+backend_phase1_syncthing_discovery_port: 21027
+backend_phase1_timezone: Europe/Rome
+backend_phase1_services:
+  - atlas-navidrome.service
+  - atlas-syncthing.service

ansible/roles/profile_backend_phase1/handlers/main.yml

@@ -0,0 +1,32 @@
+---
+- name: Restart Atlas Navidrome Quadlet
+  tags: [backend_phase1, navidrome, podman, services]
+  become_user: "{{ backend_phase1_username }}"
+  ansible.builtin.systemd:
+    name: atlas-navidrome.service
+    scope: user
+    state: restarted
+    daemon_reload: true
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+  when:
+    - backend_phase1_enabled | bool
+    - backend_phase1_start_services | bool
+    - not ansible_check_mode
+
+- name: Restart Atlas Syncthing Quadlet
+  tags: [backend_phase1, syncthing, podman, services]
+  become_user: "{{ backend_phase1_username }}"
+  ansible.builtin.systemd:
+    name: atlas-syncthing.service
+    scope: user
+    state: restarted
+    daemon_reload: true
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+  when:
+    - backend_phase1_enabled | bool
+    - backend_phase1_start_services | bool
+    - not ansible_check_mode

ansible/roles/profile_backend_phase1/tasks/main.yml

@@ -0,0 +1,163 @@
+---
+- name: Configure Atlas phase-one backend services
+  tags: [backend_phase1, podman]
+  when: backend_phase1_enabled | bool
+  block:
+    - name: Validate phase-one backend inputs
+      ansible.builtin.assert:
+        that:
+          - not (atlas_manage_media_stack | bool)
+          - backend_phase1_wireguard_interface in ansible_facts.interfaces
+          - backend_phase1_wireguard_address != 'CHANGEME_ATLAS_WIREGUARD_ADDRESS'
+          - backend_phase1_music_dir.startswith('/')
+          - backend_phase1_app_data_root.startswith('/')
+          - backend_phase1_navidrome_data_dir.startswith(backend_phase1_app_data_root + '/')
+          - backend_phase1_syncthing_root.startswith(backend_phase1_app_data_root + '/')
+        fail_msg: >-
+          Disable the rootful media-stack gate and provide the active
+          WireGuard interface/address and absolute ZFS-backed paths before
+          enabling phase one. This role does not manage Prometheus or migrate
+          Navidrome application data.
+
+    - name: Read the rootless service account
+      ansible.builtin.getent:
+        database: passwd
+        key: "{{ backend_phase1_username }}"
+
+    - name: Record rootless service account IDs
+      ansible.builtin.set_fact:
+        backend_phase1_uid: "{{ ansible_facts['getent_passwd'][backend_phase1_username][1] }}"
+        backend_phase1_gid: "{{ ansible_facts['getent_passwd'][backend_phase1_username][2] }}"
+
+    - name: Read system service state before starting rootless Syncthing
+      ansible.builtin.service_facts:
+
+    - name: Refuse to overlap a system-level Atlas Syncthing service
+      ansible.builtin.assert:
+        that:
+          - >-
+            ansible_facts.services['atlas-syncthing.service'] is not defined
+            or ansible_facts.services['atlas-syncthing.service'].state != 'running'
+        fail_msg: >-
+          Remove or stop the system-level atlas-syncthing.service before
+          enabling the rootless Syncthing Quadlet.
+
+    - name: Inspect required ZFS datasets
+      community.general.zfs_facts:
+        name: "{{ item.dataset }}"
+        properties: name,mounted,mountpoint
+      loop:
+        - dataset: "{{ backend_phase1_music_dataset }}"
+          mountpoint: "{{ backend_phase1_music_dir }}"
+        - dataset: "{{ backend_phase1_app_data_dataset }}"
+          mountpoint: "{{ backend_phase1_app_data_root }}"
+        - dataset: "{{ backend_phase1_navidrome_dataset }}"
+          mountpoint: "{{ backend_phase1_navidrome_data_dir }}"
+        - dataset: "{{ backend_phase1_syncthing_dataset }}"
+          mountpoint: "{{ backend_phase1_syncthing_root }}"
+      loop_control:
+        label: "{{ item.dataset }}"
+      register: backend_phase1_zfs_facts
+
+    - name: Require mounted datasets at the declared paths
+      ansible.builtin.assert:
+        that:
+          - item.ansible_facts.ansible_zfs_datasets | length == 1
+          - item.ansible_facts.ansible_zfs_datasets[0].mounted == 'yes'
+          - item.ansible_facts.ansible_zfs_datasets[0].mountpoint == item.item.mountpoint
+        fail_msg: >-
+          {{ item.item.dataset }} must already be mounted at
+          {{ item.item.mountpoint }}. The phase-one role never creates or
+          imports the pool.
+      loop: "{{ backend_phase1_zfs_facts.results }}"
+      loop_control:
+        label: "{{ item.item.dataset }}"
+
+    - name: Enable lingering for the rootless service account
+      ansible.builtin.command:
+        argv:
+          - loginctl
+          - enable-linger
+          - "{{ backend_phase1_username }}"
+        creates: "/var/lib/systemd/linger/{{ backend_phase1_username }}"
+
+    - name: Start the rootless user systemd manager
+      ansible.builtin.systemd:
+        name: "user@{{ backend_phase1_uid }}.service"
+        state: started
+      when: not ansible_check_mode
+
+    - name: Create rootless Quadlet and application directories
+      ansible.builtin.file:
+        path: "{{ item.path }}"
+        state: directory
+        owner: "{{ backend_phase1_username }}"
+        group: "{{ backend_phase1_user_group }}"
+        mode: "{{ item.mode }}"
+      loop:
+        - path: "{{ backend_phase1_quadlet_dir }}"
+          mode: "0700"
+        - path: "{{ backend_phase1_navidrome_data_dir }}"
+          mode: "0750"
+        - path: "{{ backend_phase1_syncthing_root }}"
+          mode: "0750"
+      loop_control:
+        label: "{{ item.path }}"
+
+    - name: Render the rootless Navidrome Quadlet
+      ansible.builtin.template:
+        src: atlas-navidrome.container.j2
+        dest: "{{ backend_phase1_quadlet_dir }}/atlas-navidrome.container"
+        owner: "{{ backend_phase1_username }}"
+        group: "{{ backend_phase1_user_group }}"
+        mode: "0644"
+      notify: Restart Atlas Navidrome Quadlet
+
+    - name: Render the rootless Syncthing Quadlet
+      ansible.builtin.template:
+        src: atlas-syncthing.container.j2
+        dest: "{{ backend_phase1_quadlet_dir }}/atlas-syncthing.container"
+        owner: "{{ backend_phase1_username }}"
+        group: "{{ backend_phase1_user_group }}"
+        mode: "0644"
+      notify: Restart Atlas Syncthing Quadlet
+
+    - name: Reload the rootless user systemd manager
+      become_user: "{{ backend_phase1_username }}"
+      ansible.builtin.systemd:
+        scope: user
+        daemon_reload: true
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+      when: not ansible_check_mode
+
+    - name: Permit phase-one services only through the WireGuard zone
+      ansible.posix.firewalld:
+        port: "{{ item }}"
+        zone: "{{ backend_phase1_wireguard_firewalld_zone }}"
+        state: enabled
+        permanent: true
+        immediate: true
+      loop:
+        - "{{ backend_phase1_navidrome_port }}/tcp"
+        - "{{ backend_phase1_syncthing_gui_port }}/tcp"
+        - "{{ backend_phase1_syncthing_transfer_port }}/tcp"
+        - "{{ backend_phase1_syncthing_transfer_port }}/udp"
+        - "{{ backend_phase1_syncthing_discovery_port }}/udp"
+
+    - name: Start rootless phase-one Quadlets
+      become_user: "{{ backend_phase1_username }}"
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        scope: user
+        state: started
+        enabled: true
+        daemon_reload: true
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+      loop: "{{ backend_phase1_services }}"
+      when:
+        - backend_phase1_start_services | bool
+        - not ansible_check_mode

ansible/roles/profile_backend_phase1/templates/atlas-navidrome.container.j2

@@ -0,0 +1,28 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas rootless Navidrome backend
+
+[Container]
+ContainerName=atlas-navidrome
+Image={{ backend_phase1_navidrome_image }}
+UserNS=keep-id
+User={{ backend_phase1_uid }}
+Group={{ backend_phase1_gid }}
+PublishPort={{ backend_phase1_wireguard_address }}:{{ backend_phase1_navidrome_port }}:4533
+Environment=ND_LOGLEVEL=info
+Environment=ND_SCANSCHEDULE=1h
+Environment=ND_SESSIONTIMEOUT=24h
+Environment=ND_ENABLETRANSCODING=true
+Environment=TZ={{ backend_phase1_timezone }}
+Volume={{ backend_phase1_navidrome_data_dir }}:/data:Z
+Volume={{ backend_phase1_music_dir }}:/music:ro,z
+NoNewPrivileges=true
+DropCapability=all
+
+[Service]
+Restart=always
+RestartSec=10
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target

ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2

@@ -0,0 +1,27 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas rootless Syncthing backend
+
+[Container]
+ContainerName=atlas-syncthing
+Image={{ backend_phase1_syncthing_image }}
+HostName=atlas-syncthing
+Network=host
+UserNS=keep-id
+User={{ backend_phase1_uid }}
+Group={{ backend_phase1_gid }}
+Environment=HOME=/var/syncthing
+Environment=STHOMEDIR=/var/syncthing/config
+Environment=STGUIADDRESS={{ backend_phase1_wireguard_address }}:{{ backend_phase1_syncthing_gui_port }}
+Environment=TZ={{ backend_phase1_timezone }}
+Volume={{ backend_phase1_syncthing_root }}:/var/syncthing:Z
+NoNewPrivileges=true
+DropCapability=all
+
+[Service]
+Restart=always
+RestartSec=10
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target

ansible/roles/profile_server/handlers/main.yml

@@ -9,29 +9,3 @@
   tags: [services]
   ansible.builtin.systemd:
     daemon_reload: true
-
-- name: Restart rclone music mount
-  tags: [services, rclone, navidrome]
-  ansible.builtin.systemd:
-    name: "{{ server_rclone_music_service }}"
-    state: restarted
-    daemon_reload: true
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode
-
-- name: Restart rootless Navidrome
-  tags: [services, podman, rclone, navidrome]
-  become_user: "{{ server_username }}"
-  ansible.builtin.systemd:
-    name: navidrome.service
-    scope: user
-    state: restarted
-    daemon_reload: true
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}"
-    DBUS_SESSION_BUS_ADDRESS: >-
-      unix:path=/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}/bus
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode

ansible/roles/profile_server/tasks/main.yml

@@ -8,17 +8,6 @@
     fail_msg: >-
       server_firewall_backend must be firewalld for the Rocky server profile.
 
-- name: Require server database secret variables
-  tags: [dotfiles, dotfiles:server, services, navidrome]
-  ansible.builtin.assert:
-    that:
-      - server_navidrome_db_password | length > 0
-      - (vault_postgres_root_password | default('')) | length > 0
-    fail_msg: >-
-      Define vault_navidrome_db_password and vault_postgres_root_password in Vault
-      before rendering the Navidrome database configuration.
-  no_log: true
-
 - name: Configure DuckDNS updater
   tags: [dotfiles, dotfiles:server, duckdns]
   ansible.builtin.import_tasks: duckdns.yml
@@ -72,12 +61,6 @@
   tags: [services, podman]
   ansible.builtin.include_tasks: podman-compose.yml
 
-- name: Configure Atlas music mount
-  ansible.builtin.import_tasks: rclone-music.yml
-
-- name: Configure rootless Navidrome
-  ansible.builtin.import_tasks: navidrome.yml
-
 - name: Disable SSH root login on server
   tags: [services]
   ansible.builtin.lineinfile:

ansible/roles/profile_server/tasks/navidrome.yml

@@ -1,114 +0,0 @@
----
-- name: Read server account details for rootless Navidrome
-  tags: [services, podman, rclone, navidrome]
-  ansible.builtin.getent:
-    database: passwd
-    key: "{{ server_username }}"
-  when: server_atlas_music_enabled | bool
-
-- name: Check for a running legacy rootful Navidrome container
-  tags: [services, podman, navidrome]
-  ansible.builtin.command:
-    argv:
-      - podman
-      - container
-      - inspect
-      - --format
-      - "{{ '{{.State.Running}}' }}"
-      - navidrome
-  register: server_legacy_navidrome_container
-  changed_when: false
-  failed_when: false
-  check_mode: false
-  when: server_atlas_music_enabled | bool
-
-- name: Refuse concurrent legacy and rootless Navidrome
-  tags: [services, podman, navidrome]
-  ansible.builtin.assert:
-    that:
-      - >-
-        server_legacy_navidrome_container.rc != 0
-        or server_legacy_navidrome_container.stdout | trim != 'true'
-    fail_msg: >-
-      Stop the legacy rootful Navidrome container before enabling the rootless Quadlet.
-      The playbook does not remove the old container or its data automatically.
-  when: server_atlas_music_enabled | bool
-
-- name: Enable lingering for rootless Navidrome
-  tags: [services, podman, navidrome]
-  ansible.builtin.command:
-    argv:
-      - loginctl
-      - enable-linger
-      - "{{ server_username }}"
-    creates: "/var/lib/systemd/linger/{{ server_username }}"
-  when: server_atlas_music_enabled | bool
-
-- name: Start server user systemd manager
-  tags: [services, podman, navidrome]
-  ansible.builtin.systemd:
-    name: "user@{{ ansible_facts['getent_passwd'][server_username][1] }}.service"
-    state: started
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode
-
-- name: Create rootless Navidrome Quadlet directory
-  tags: [services, podman, navidrome]
-  ansible.builtin.file:
-    path: "{{ server_navidrome_quadlet_dir }}"
-    state: directory
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0700"
-  when: server_atlas_music_enabled | bool
-
-- name: Create private rootless Navidrome configuration directory
-  tags: [services, podman, navidrome]
-  ansible.builtin.file:
-    path: "{{ server_navidrome_env_dir }}"
-    state: directory
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0700"
-  when: server_atlas_music_enabled | bool
-
-- name: Render Vault-backed rootless Navidrome environment
-  tags: [services, podman, navidrome]
-  ansible.builtin.template:
-    src: navidrome.env.j2
-    dest: "{{ server_navidrome_env_file }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0600"
-  no_log: true
-  diff: false
-  notify: Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
-- name: Render rootless Navidrome Quadlet
-  tags: [services, podman, navidrome]
-  ansible.builtin.template:
-    src: navidrome.container.j2
-    dest: "{{ server_navidrome_quadlet_dir }}/navidrome.container"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0644"
-  notify: Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
-- name: Start rootless Navidrome Quadlet
-  tags: [services, podman, navidrome]
-  become_user: "{{ server_username }}"
-  ansible.builtin.systemd:
-    name: navidrome.service
-    scope: user
-    state: started
-    daemon_reload: true
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}"
-    DBUS_SESSION_BUS_ADDRESS: >-
-      unix:path=/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}/bus
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode

ansible/roles/profile_server/tasks/rclone-music.yml

@@ -1,105 +0,0 @@
----
-- name: Require completed Atlas SFTP mount configuration
-  tags: [services, rclone, navidrome]
-  ansible.builtin.assert:
-    that:
-      - server_atlas_sftp_host != 'CHANGEME_ATLAS_WIREGUARD_IP'
-      - server_atlas_sftp_known_host != 'CHANGEME_ATLAS_SSH_HOST_KEY'
-      - server_atlas_sftp_known_host | length > 0
-      - server_atlas_sftp_private_key | length > 0
-      - server_atlas_sftp_remote_path == '/pool/media/music'
-    fail_msg: >-
-      Define the Atlas WireGuard address, pinned SSH host key and Vault-backed
-      SFTP private key before enabling the music mount.
-  no_log: true
-  when: server_atlas_music_enabled | bool
-
-- name: Create private rclone configuration directory
-  tags: [services, rclone, navidrome]
-  ansible.builtin.file:
-    path: "{{ server_rclone_config_dir }}"
-    state: directory
-    owner: root
-    group: "{{ server_user_group }}"
-    mode: "0750"
-  when: server_atlas_music_enabled | bool
-
-- name: Install Vault-backed Atlas SFTP private key
-  tags: [services, rclone, navidrome]
-  ansible.builtin.copy:
-    content: "{{ server_atlas_sftp_private_key | trim }}\n"
-    dest: "{{ server_atlas_sftp_private_key_file }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0600"
-  no_log: true
-  diff: false
-  notify:
-    - Restart rclone music mount
-    - Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
-- name: Install pinned Atlas SSH host key
-  tags: [services, rclone, navidrome]
-  ansible.builtin.copy:
-    content: "{{ server_atlas_sftp_known_host | trim }}\n"
-    dest: "{{ server_atlas_sftp_known_hosts_file }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0640"
-  notify:
-    - Restart rclone music mount
-    - Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
-- name: Render Atlas SFTP rclone configuration
-  tags: [services, rclone, navidrome]
-  ansible.builtin.template:
-    src: rclone.conf.j2
-    dest: "{{ server_rclone_config_file }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0600"
-  notify:
-    - Restart rclone music mount
-    - Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
-- name: Create rclone music directories
-  tags: [services, rclone, navidrome]
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0750"
-  loop:
-    - "{{ server_rclone_music_mountpoint }}"
-    - "{{ server_rclone_music_cache_dir }}"
-  loop_control:
-    label: "{{ item }}"
-  when: server_atlas_music_enabled | bool
-
-- name: Render rclone music system service
-  tags: [services, rclone, navidrome]
-  ansible.builtin.template:
-    src: rclone-music.service.j2
-    dest: "/etc/systemd/system/{{ server_rclone_music_service }}"
-    owner: root
-    group: root
-    mode: "0644"
-  notify:
-    - Restart rclone music mount
-    - Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
-- name: Enable and start rclone music mount
-  tags: [services, rclone, navidrome]
-  ansible.builtin.systemd:
-    name: "{{ server_rclone_music_service }}"
-    enabled: true
-    state: started
-    daemon_reload: true
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode

ansible/roles/profile_server/templates/navidrome.container.j2

@@ -1,21 +0,0 @@
-# Managed by Ansible. Do not edit manually.
-[Unit]
-Description=Rootless Navidrome music server
-
-[Container]
-ContainerName=navidrome
-Image={{ server_navidrome_image }}
-Network=host
-EnvironmentFile={{ server_navidrome_env_file }}
-Volume={{ server_navidrome_data_dir }}:/data
-Volume={{ server_rclone_music_mountpoint }}:/music:ro
-SecurityLabelDisable=true
-
-[Service]
-ExecStartPre=/usr/bin/mountpoint -q {{ server_rclone_music_mountpoint }}
-Restart=always
-RestartSec=10s
-TimeoutStartSec=900
-
-[Install]
-WantedBy=default.target

ansible/roles/profile_server/templates/navidrome.env.j2

@@ -1,7 +0,0 @@
-# Managed by Ansible. Contains a Vault secret; do not edit or copy.
-ND_DATABASE_URL={{ ('postgres://navidrome:' ~ server_navidrome_db_password ~ '@127.0.0.1:5432/navidrome_db?sslmode=disable') | to_json }}
-ND_PORT={{ server_navidrome_port }}
-ND_SCANSCHEDULE="1h"
-ND_SESSIONTIMEOUT="24h"
-ND_ENABLETRANSCODING="true"
-ND_LOGLEVEL="info"

ansible/roles/profile_server/templates/rclone-music.service.j2

@@ -1,29 +0,0 @@
-[Unit]
-Description=Read-only Atlas music mount via rclone SFTP
-Wants=network-online.target
-After=network-online.target
-{% if server_atlas_wireguard_unit | length > 0 %}
-Wants={{ server_atlas_wireguard_unit }}
-After={{ server_atlas_wireguard_unit }}
-{% endif %}
-
-[Service]
-Type=notify
-User={{ server_username }}
-Group={{ server_user_group }}
-ExecStart=/usr/bin/rclone mount \
-  {{ server_atlas_sftp_remote_name }}:{{ server_atlas_sftp_remote_path }} \
-  {{ server_rclone_music_mountpoint }} \
-  --config {{ server_rclone_config_file }} \
-  --cache-dir {{ server_rclone_music_cache_dir }} \
-  --read-only \
-  --vfs-cache-mode full \
-  --vfs-cache-max-size 15G \
-  --vfs-read-chunk-size 5M \
-  --dir-cache-time 24h
-ExecStop=-/usr/bin/fusermount3 -uz {{ server_rclone_music_mountpoint }}
-Restart=on-failure
-RestartSec=10s
-
-[Install]
-WantedBy=multi-user.target

ansible/roles/profile_server/templates/rclone.conf.j2

@@ -1,9 +0,0 @@
-# Managed by Ansible. Authentication uses the separately deployed Vault-backed key.
-[{{ server_atlas_sftp_remote_name }}]
-type = sftp
-host = {{ server_atlas_sftp_host }}
-user = {{ server_atlas_sftp_username }}
-port = {{ server_atlas_sftp_port }}
-key_file = {{ server_atlas_sftp_private_key_file }}
-known_hosts_file = {{ server_atlas_sftp_known_hosts_file }}
-shell_type = unix

ansible/roles/wireguard_overlay/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+wireguard_overlay_enabled: false
+wireguard_interface: wg0
+wireguard_config_dir: /etc/wireguard
+wireguard_private_key_path: "{{ wireguard_config_dir }}/{{ wireguard_interface }}.key"
+wireguard_config_path: "{{ wireguard_config_dir }}/{{ wireguard_interface }}.conf"
+wireguard_address: CHANGEME_WIREGUARD_ADDRESS
+wireguard_listen_port: 0
+wireguard_mtu: 1420
+wireguard_firewalld_zone: wireguard
+wireguard_public_firewalld_zone: public
+wireguard_enable_ipv4_forwarding: false
+wireguard_peers: []
+wireguard_packages:
+  - wireguard-tools

ansible/roles/wireguard_overlay/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Restart WireGuard interface
+  tags: [wireguard, services]
+  ansible.builtin.systemd:
+    name: "wg-quick@{{ wireguard_interface }}.service"
+    state: restarted
+    daemon_reload: true
+  when:
+    - wireguard_overlay_enabled | bool
+    - not ansible_check_mode

ansible/roles/wireguard_overlay/tasks/main.yml

@@ -0,0 +1,158 @@
+---
+- name: Configure WireGuard overlay
+  tags: [wireguard, services]
+  when: wireguard_overlay_enabled | bool
+  block:
+    - name: Validate WireGuard host configuration
+      ansible.builtin.assert:
+        that:
+          - wireguard_address != 'CHANGEME_WIREGUARD_ADDRESS'
+          - wireguard_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}/[0-9]{1,2}$')
+          - wireguard_peers | length > 0
+          - wireguard_peers | map(attribute='host') | difference(ansible_play_hosts_all) | length == 0
+        fail_msg: >-
+          Configure this host's WireGuard address and peers, and run the first
+          key bootstrap against every peer in the same play.
+
+    - name: Install WireGuard userspace tools
+      ansible.builtin.dnf:
+        name: "{{ wireguard_packages }}"
+        state: present
+
+    - name: Create private WireGuard configuration directory
+      ansible.builtin.file:
+        path: "{{ wireguard_config_dir }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0700"
+
+    - name: Check for an existing WireGuard private key
+      ansible.builtin.stat:
+        path: "{{ wireguard_private_key_path }}"
+      register: wireguard_private_key_stat
+
+    - name: Generate a missing WireGuard private key
+      ansible.builtin.command:
+        argv:
+          - wg
+          - genkey
+      register: wireguard_generated_private_key
+      changed_when: true
+      no_log: true
+      when:
+        - not wireguard_private_key_stat.stat.exists
+        - not ansible_check_mode
+
+    - name: Persist the generated WireGuard private key
+      ansible.builtin.copy:
+        content: "{{ wireguard_generated_private_key.stdout }}\n"
+        dest: "{{ wireguard_private_key_path }}"
+        owner: root
+        group: root
+        mode: "0600"
+      no_log: true
+      when:
+        - not wireguard_private_key_stat.stat.exists
+        - not ansible_check_mode
+
+    - name: Require a private key during check mode
+      ansible.builtin.assert:
+        that:
+          - wireguard_private_key_stat.stat.exists
+        fail_msg: >-
+          The initial WireGuard key generation cannot be simulated safely in
+          check mode. Run the gated WireGuard play once without --check.
+      when: ansible_check_mode
+
+    - name: Read the persisted WireGuard private key
+      ansible.builtin.slurp:
+        src: "{{ wireguard_private_key_path }}"
+      register: wireguard_private_key_material
+      no_log: true
+
+    - name: Derive this host's WireGuard public key
+      ansible.builtin.command:
+        argv:
+          - wg
+          - pubkey
+        stdin: "{{ wireguard_private_key_material.content | b64decode | trim }}"
+      register: wireguard_derived_public_key
+      changed_when: false
+      no_log: true
+
+    - name: Publish this host's WireGuard public key
+      ansible.builtin.set_fact:
+        wireguard_public_key: "{{ wireguard_derived_public_key.stdout }}"
+
+    - name: Require every peer's generated public key
+      ansible.builtin.assert:
+        that:
+          - hostvars[item.host].wireguard_public_key is defined
+          - hostvars[item.host].wireguard_public_key | length > 0
+        fail_msg: >-
+          The public key for {{ item.host }} is unavailable. The first
+          WireGuard run must include every overlay host.
+      loop: "{{ wireguard_peers }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+    - name: Render the private WireGuard interface configuration
+      ansible.builtin.template:
+        src: wg.conf.j2
+        dest: "{{ wireguard_config_path }}"
+        owner: root
+        group: root
+        mode: "0600"
+      diff: false
+      no_log: true
+      notify: Restart WireGuard interface
+
+    - name: Enable IPv4 forwarding for the ingress host
+      ansible.posix.sysctl:
+        name: net.ipv4.ip_forward
+        value: "1"
+        state: present
+        sysctl_set: true
+        reload: true
+      when: wireguard_enable_ipv4_forwarding | bool
+
+    - name: Create the WireGuard firewalld zone
+      ansible.posix.firewalld:
+        zone: "{{ wireguard_firewalld_zone }}"
+        state: present
+        permanent: true
+      register: wireguard_firewalld_zone_result
+
+    - name: Reload firewalld after creating the WireGuard zone
+      ansible.builtin.systemd:
+        name: firewalld.service
+        state: reloaded
+      when:
+        - wireguard_firewalld_zone_result is changed
+        - not ansible_check_mode
+
+    - name: Assign the WireGuard interface to its firewalld zone
+      ansible.posix.firewalld:
+        interface: "{{ wireguard_interface }}"
+        zone: "{{ wireguard_firewalld_zone }}"
+        state: enabled
+        permanent: true
+        immediate: true
+
+    - name: Permit this host's public WireGuard listener
+      ansible.posix.firewalld:
+        port: "{{ wireguard_listen_port }}/udp"
+        zone: "{{ wireguard_public_firewalld_zone }}"
+        state: enabled
+        permanent: true
+        immediate: true
+      when: wireguard_listen_port | int > 0
+
+    - name: Enable the WireGuard interface
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ wireguard_interface }}.service"
+        enabled: true
+        state: started
+        daemon_reload: true
+      when: not ansible_check_mode

ansible/roles/wireguard_overlay/templates/wg.conf.j2

@@ -0,0 +1,25 @@
+# Managed by Ansible. Do not edit manually.
+[Interface]
+Address = {{ wireguard_address }}
+PrivateKey = {{ wireguard_private_key_material.content | b64decode | trim }}
+MTU = {{ wireguard_mtu }}
+SaveConfig = false
+{% if wireguard_listen_port | int > 0 %}
+ListenPort = {{ wireguard_listen_port }}
+{% endif %}
+
+{% for peer in wireguard_peers %}
+[Peer]
+# {{ peer.name }}
+PublicKey = {{ hostvars[peer.host].wireguard_public_key }}
+AllowedIPs = {{ peer.allowed_ips | join(', ') }}
+{% if peer.endpoint is defined %}
+Endpoint = {{ peer.endpoint }}
+{% endif %}
+{% if peer.persistent_keepalive | default(0) | int > 0 %}
+PersistentKeepalive = {{ peer.persistent_keepalive }}
+{% endif %}
+{% if not loop.last %}
+
+{% endif %}
+{% endfor %}