Move temporary Navidrome and Syncthing services to Atlas

ansible/inventory/group_vars/rocky_server.yml

@@ -40,4 +40,3 @@ server_firewalld_services:
 server_firewalld_ports: []
 server_sshd_service_name: sshd
 server_compose_selinux_mount_option: Z
-server_syncthing_enabled: false

ansible/inventory/group_vars/server.yml

@@ -75,21 +75,6 @@ server_directories:
     group: root
     mode: "0755"
 
-server_syncthing_enabled: true
-server_syncthing_directories:
-  - path: /opt/syncthing/config
-    owner: root
-    group: root
-    mode: "0755"
-  - path: /srv/syncthing
-    owner: root
-    group: root
-    mode: "0755"
-  - path: /srv/syncthing/data
-    owner: "1000"
-    group: "1000"
-    mode: "0755"
-
 server_sshd_settings:
   PermitRootLogin: "no"
 

ansible/inventory/host_vars/atlas.yml

@@ -52,9 +52,14 @@ atlas_manage_storage: true
 atlas_manage_sharing: true
 atlas_manage_media_stack: false
 
-# Atlas is a NAS-only host. WireGuard is retired manually on the host and is
-# intentionally no longer managed here.
-backend_phase1_enabled: false
+# WireGuard is retired on Atlas. These rootless services are a temporary home
+# until Uranus replaces them.
+backend_phase1_enabled: true
+backend_phase1_start_services: true
+backend_phase1_bind_address: "{{ ansible_host }}"
+backend_phase1_firewalld_zone: "{{ atlas_firewalld_zone }}"
+backend_phase1_npm_source_ip: "{{ atlas_aegis_ip }}"
+backend_phase1_syncthing_native_subnet: "{{ atlas_lan_subnet }}"
 
 rocky_manage_openzfs_repo: true
 rocky_manage_syncthing_binary: false

ansible/roles/profile_backend_phase1/defaults/main.yml

@@ -5,9 +5,10 @@ backend_phase1_username: "{{ atlas_admin_username }}"
 backend_phase1_user_group: "{{ atlas_admin_group }}"
 backend_phase1_user_home: "{{ atlas_admin_home }}"
 backend_phase1_quadlet_dir: "{{ backend_phase1_user_home }}/.config/containers/systemd"
-backend_phase1_wireguard_interface: wg0
-backend_phase1_wireguard_address: CHANGEME_ATLAS_WIREGUARD_ADDRESS
-backend_phase1_wireguard_firewalld_zone: wireguard
+backend_phase1_bind_address: CHANGEME_ATLAS_BIND_ADDRESS
+backend_phase1_firewalld_zone: public
+backend_phase1_npm_source_ip: CHANGEME_AEGIS_IP
+backend_phase1_syncthing_native_subnet: CHANGEME_LAN_SUBNET
 backend_phase1_music_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
 backend_phase1_app_data_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
 backend_phase1_navidrome_data_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"

ansible/roles/profile_backend_phase1/tasks/main.yml

@@ -7,17 +7,20 @@
       ansible.builtin.assert:
         that:
           - not (atlas_manage_media_stack | bool)
-          - backend_phase1_wireguard_interface in ansible_facts.interfaces
-          - backend_phase1_wireguard_address != 'CHANGEME_ATLAS_WIREGUARD_ADDRESS'
+          - backend_phase1_bind_address != 'CHANGEME_ATLAS_BIND_ADDRESS'
+          - backend_phase1_bind_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}$')
+          - backend_phase1_firewalld_zone | length > 0
+          - backend_phase1_npm_source_ip != 'CHANGEME_AEGIS_IP'
+          - backend_phase1_syncthing_native_subnet != 'CHANGEME_LAN_SUBNET'
           - backend_phase1_music_dir.startswith('/')
           - backend_phase1_app_data_root.startswith('/')
           - backend_phase1_navidrome_data_dir.startswith(backend_phase1_app_data_root + '/')
           - backend_phase1_syncthing_root.startswith(backend_phase1_app_data_root + '/')
         fail_msg: >-
-          Disable the rootful media-stack gate and provide the active
-          WireGuard interface/address and absolute ZFS-backed paths before
+          Disable the rootful media-stack gate and provide the Atlas LAN bind
+          address, firewall sources, and absolute ZFS-backed paths before
           enabling phase one. This role does not manage Prometheus or migrate
-          Navidrome application data.
+          application data.
 
     - name: Read the rootless service account
       ansible.builtin.getent:
@@ -132,19 +135,35 @@
         DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
       when: not ansible_check_mode
 
-    - name: Permit phase-one services only through the WireGuard zone
+    - name: Permit NPM access to phase-one web interfaces through Aegis
       ansible.posix.firewalld:
-        port: "{{ item }}"
-        zone: "{{ backend_phase1_wireguard_firewalld_zone }}"
+        rich_rule: >-
+          rule family="ipv4" source address="{{ backend_phase1_npm_source_ip }}"
+          port port="{{ item }}" protocol="tcp" accept
+        zone: "{{ backend_phase1_firewalld_zone }}"
         state: enabled
         permanent: true
         immediate: true
       loop:
-        - "{{ backend_phase1_navidrome_port }}/tcp"
-        - "{{ backend_phase1_syncthing_gui_port }}/tcp"
-        - "{{ backend_phase1_syncthing_transfer_port }}/tcp"
-        - "{{ backend_phase1_syncthing_transfer_port }}/udp"
-        - "{{ backend_phase1_syncthing_discovery_port }}/udp"
+        - "{{ backend_phase1_navidrome_port }}"
+        - "{{ backend_phase1_syncthing_gui_port }}"
+
+    - name: Permit native Syncthing traffic from the LAN
+      ansible.posix.firewalld:
+        rich_rule: >-
+          rule family="ipv4" source address="{{ backend_phase1_syncthing_native_subnet }}"
+          port port="{{ item.port }}" protocol="{{ item.protocol }}" accept
+        zone: "{{ backend_phase1_firewalld_zone }}"
+        state: enabled
+        permanent: true
+        immediate: true
+      loop:
+        - port: "{{ backend_phase1_syncthing_transfer_port }}"
+          protocol: tcp
+        - port: "{{ backend_phase1_syncthing_transfer_port }}"
+          protocol: udp
+        - port: "{{ backend_phase1_syncthing_discovery_port }}"
+          protocol: udp
 
     - name: Start rootless phase-one Quadlets
       become_user: "{{ backend_phase1_username }}"

ansible/roles/profile_backend_phase1/templates/atlas-navidrome.container.j2

@@ -8,7 +8,7 @@ Image={{ backend_phase1_navidrome_image }}
 UserNS=keep-id
 User={{ backend_phase1_uid }}
 Group={{ backend_phase1_gid }}
-PublishPort={{ backend_phase1_wireguard_address }}:{{ backend_phase1_navidrome_port }}:4533
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_navidrome_port }}:4533
 Environment=ND_LOGLEVEL=info
 Environment=ND_SCANSCHEDULE=1h
 Environment=ND_SESSIONTIMEOUT=24h

ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2

@@ -9,10 +9,10 @@ HostName=atlas-syncthing
 UserNS=keep-id
 User={{ backend_phase1_uid }}
 Group={{ backend_phase1_gid }}
-PublishPort={{ backend_phase1_wireguard_address }}:{{ backend_phase1_syncthing_gui_port }}:{{ backend_phase1_syncthing_gui_port }}
-PublishPort={{ backend_phase1_wireguard_address }}:{{ backend_phase1_syncthing_transfer_port }}:{{ backend_phase1_syncthing_transfer_port }}
-PublishPort={{ backend_phase1_wireguard_address }}:{{ backend_phase1_syncthing_transfer_port }}:{{ backend_phase1_syncthing_transfer_port }}/udp
-PublishPort={{ backend_phase1_wireguard_address }}:{{ backend_phase1_syncthing_discovery_port }}:{{ backend_phase1_syncthing_discovery_port }}/udp
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_gui_port }}:{{ backend_phase1_syncthing_gui_port }}
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_transfer_port }}:{{ backend_phase1_syncthing_transfer_port }}
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_transfer_port }}:{{ backend_phase1_syncthing_transfer_port }}/udp
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_discovery_port }}:{{ backend_phase1_syncthing_discovery_port }}/udp
 Environment=HOME=/var/syncthing
 Environment=STHOMEDIR=/var/syncthing/config
 Environment=STGUIADDRESS=0.0.0.0:{{ backend_phase1_syncthing_gui_port }}

ansible/roles/profile_server/tasks/main.yml

@@ -20,15 +20,7 @@
     owner: "{{ item.owner }}"
     group: "{{ item.group }}"
     mode: "{{ item.mode }}"
-  loop: >-
-    {{
-      (server_directories | default([]))
-      + (
-          server_syncthing_directories | default([])
-          if server_syncthing_enabled | default(true) | bool
-          else []
-        )
-    }}
+  loop: "{{ server_directories | default([]) }}"
   loop_control:
     label: "{{ item.path }}"
 

ansible/templates/server/docker-compose.yml.j2

@@ -56,24 +56,6 @@ services:
       - "3000:3000"
       - "127.0.0.1:222:22"
 
-{% if server_syncthing_enabled | default(true) | bool %}
-  syncthing:
-    image: docker.io/syncthing/syncthing:2
-    container_name: syncthing
-    hostname: syncthing
-    restart: unless-stopped
-    expose:
-      - "8384"
-    volumes:
-      - "/opt/syncthing/config:/var/syncthing{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
-      - "/srv/syncthing/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
-    ports:
-      - "22000:22000/tcp"
-      - "22000:22000/udp"
-      - "21027:21027/udp"
-    networks:
-      - web
-{% endif %}
 
 networks:
   web: