From 581475c1fa54c8883f638cb34c18fc1f42752fb8 Mon Sep 17 00:00:00 2001
From: Wojciech Kozlowski <wk@wojciechkozlowski.eu>
Date: Wed, 2 Nov 2022 20:03:12 +0100
Subject: [PATCH] Move lrproxy mounts to use _data

---
 .../user/container-lrproxy-nginx.service.j2     | 17 ++++++++++++++++-
 .../systemd/user/rsync-certificates.service.j2  |  6 +++++-
 .../service-user/01-user.d/data/lrproxy.yml     |  8 ++++++++
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/playbooks/filesystem/yggdrasil/var/lib/yggdrasil/home/pod-lrproxy/.config/systemd/user/container-lrproxy-nginx.service.j2 b/playbooks/filesystem/yggdrasil/var/lib/yggdrasil/home/pod-lrproxy/.config/systemd/user/container-lrproxy-nginx.service.j2
index a46220b..7de7ce7 100644
--- a/playbooks/filesystem/yggdrasil/var/lib/yggdrasil/home/pod-lrproxy/.config/systemd/user/container-lrproxy-nginx.service.j2
+++ b/playbooks/filesystem/yggdrasil/var/lib/yggdrasil/home/pod-lrproxy/.config/systemd/user/container-lrproxy-nginx.service.j2
@@ -12,7 +12,22 @@ Environment=PODMAN_SYSTEMD_UNIT=%n
 Restart=on-failure
 TimeoutStopSec=70
 ExecStartPre=/bin/rm -f %t/container-lrproxy-nginx.pid %t/container-lrproxy-nginx.ctr-id
-ExecStart=/usr/bin/podman run --conmon-pidfile %t/container-lrproxy-nginx.pid --cidfile %t/container-lrproxy-nginx.ctr-id --cgroups=no-conmon --pod-id-file %t/pod-lrproxy.pod-id --replace --label "io.containers.autoupdate=image" -dt {{ service_rproxy_hosts }} -v /var/lib/yggdrasil/valkyrie-resolv.conf:/etc/resolv.conf:ro -v ./.config/pod-lrproxy/nginx.conf:/etc/nginx/nginx.conf:ro -v ./.config/pod-lrproxy/nginx-conf.d:/etc/nginx/conf.d:ro -v ./.config/pod-lrproxy/dhparam.pem:/etc/ssl/certs/dhparam.pem:ro -v /var/lib/yggdrasil/data/pod-lrproxy/etc-letsencrypt:/etc/letsencrypt:ro --name=pod-lrproxy-nginx docker.io/library/nginx
+ExecStart=/usr/bin/podman run \
+                          --conmon-pidfile %t/container-lrproxy-nginx.pid \
+                          --cidfile %t/container-lrproxy-nginx.ctr-id \
+                          --cgroups=no-conmon \
+                          --pod-id-file %t/pod-lrproxy.pod-id \
+                          --replace \
+                          --label "io.containers.autoupdate=image" \
+                          -dt \
+                          {{ service_rproxy_hosts }} \
+                          -v /var/lib/yggdrasil/valkyrie-resolv.conf:/etc/resolv.conf:ro \
+                          -v ./.config/pod-lrproxy/nginx.conf:/etc/nginx/nginx.conf:ro \
+                          -v ./.config/pod-lrproxy/nginx-conf.d:/etc/nginx/conf.d:ro \
+                          -v ./.config/pod-lrproxy/dhparam.pem:/etc/ssl/certs/dhparam.pem:ro \
+                          -v /var/lib/yggdrasil/data/pod-lrproxy/etc-letsencrypt/_data:/etc/letsencrypt:ro \
+                          --name=pod-lrproxy-nginx \
+                          docker.io/library/nginx
 ExecStop=/usr/bin/podman stop --ignore --cidfile %t/container-lrproxy-nginx.ctr-id -t 10
 ExecStopPost=/usr/bin/podman rm --ignore -f --cidfile %t/container-lrproxy-nginx.ctr-id
 PIDFile=%t/container-lrproxy-nginx.pid
diff --git a/playbooks/filesystem/yggdrasil/var/lib/yggdrasil/home/pod-lrproxy/.config/systemd/user/rsync-certificates.service.j2 b/playbooks/filesystem/yggdrasil/var/lib/yggdrasil/home/pod-lrproxy/.config/systemd/user/rsync-certificates.service.j2
index acdcc70..a64bccd 100644
--- a/playbooks/filesystem/yggdrasil/var/lib/yggdrasil/home/pod-lrproxy/.config/systemd/user/rsync-certificates.service.j2
+++ b/playbooks/filesystem/yggdrasil/var/lib/yggdrasil/home/pod-lrproxy/.config/systemd/user/rsync-certificates.service.j2
@@ -5,4 +5,8 @@ OnFailure=status-mail@%n.service
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/rsync -e 'ssh -i .ssh/valkyrie-pod-rproxy -l pod-rproxy' -avz {{ vpn_wg0_remote_address }}:/var/lib/valkyrie/data/pod-rproxy/etc-letsencrypt/ /var/lib/yggdrasil/data/pod-lrproxy/etc-letsencrypt
+ExecStart=/usr/bin/rsync -e 'ssh -i .ssh/valkyrie-pod-rproxy -l pod-rproxy' \
+                         -avz \
+                         --delete \
+                         {{ vpn_wg0_remote_address }}:/var/lib/valkyrie/data/pod-rproxy/etc-letsencrypt/ \
+                         /var/lib/yggdrasil/data/pod-lrproxy/etc-letsencrypt
diff --git a/playbooks/tasks/services/b-user/service-user/01-user.d/data/lrproxy.yml b/playbooks/tasks/services/b-user/service-user/01-user.d/data/lrproxy.yml
index 9f93ca6..e440369 100644
--- a/playbooks/tasks/services/b-user/service-user/01-user.d/data/lrproxy.yml
+++ b/playbooks/tasks/services/b-user/service-user/01-user.d/data/lrproxy.yml
@@ -13,3 +13,11 @@
     owner: "{{ service_user_name }}"
     group: "{{ service_user_name }}"
     mode: 0755
+
+- name: Create etc-letsencrypt/_data directory for user {{ service_user_name }}
+  file:
+    path: "/var/lib/{{ ansible_hostname }}/data/{{ service_user_name }}/etc-letsencrypt/_data"
+    state: directory
+    owner: "{{ service_user_name }}"
+    group: "{{ service_user_name }}"
+    mode: 0755