1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# https://docs.gotosocial.org/en/latest/getting_started/installation/container/

- name: Set up GoToSocial
  hosts: lotus-land-story
  vars:
    version: "{{ versions.gotosocial }}"
  tasks:

    - name: Create working directory
      ansible.builtin.file:
        path: /mnt/lotus-land-story/gotosocial
        state: directory
        mode: "0755"

    - name: Create data directory
      ansible.builtin.file:
        path: /mnt/lotus-land-story/gotosocial/data
        state: directory
        owner: 1000
        group: 1000
        mode: "0755"

    # TODO back this up using restic
    - name: Back up gotosocial if needed
      block:
        - name: Get current version
          ansible.builtin.command: >
            docker inspect
            --format '{{ '{{' }} index .Config.Labels "org.opencontainers.image.version"}}'
            gotosocial
          register: gotosocial_version
          changed_when: false

        - name: Stop and backup gotosocial
          when: gotosocial_version.stdout | trim != version
          block:
            - name: Stop gotosocial
              community.docker.docker_container:
                name: gotosocial
                state: stopped
            - name: Install sqlite3
              ansible.builtin.apt:
                pkg:
                  - sqlite3
                state: present
            - name: Vacuum and analyze db
              ansible.builtin.command:
                cmd: >
                  sqlite3 /mnt/lotus-land-story/gotosocial/data/sqlite.db
                  'VACUUM; ANALYZE;'
              changed_when: true
            # `.backup` goes through SQLite instead of copying the file, so it
            # picks up writes still sitting in the -wal sidecar.
            - name: Backup db
              ansible.builtin.command:
                cmd: >
                  sqlite3 /mnt/lotus-land-story/gotosocial/data/sqlite.db
                  '.backup /mnt/lotus-land-story/gotosocial/sqlite.db.bak'
              changed_when: true
            - name: Restrict backup permissions
              ansible.builtin.file:
                path: /mnt/lotus-land-story/gotosocial/sqlite.db.bak
                mode: "0400"

    - name: Get docker network for trusted proxies
      community.docker.docker_network:
        name: lotus_land_story
      register: docker_network

    # https://raw.githubusercontent.com/superseriousbusiness/gotosocial/main/example/docker-compose/docker-compose.yaml
    - name: Run GoToSocial
      community.docker.docker_container:
        name: gotosocial
        image: superseriousbusiness/gotosocial:{{ version }}
        restart: true
        restart_policy: unless-stopped
        env:
          GTS_HOST: hey.kejadlen.dev
          GTS_TRUSTED_PROXIES: "{{ docker_network.network.IPAM.Config[0].Subnet }}"
          GTS_LANDING_PAGE_USER: alpha
          GTS_DB_TYPE: sqlite
          GTS_DB_ADDRESS: /gotosocial/storage/sqlite.db
          GTS_OIDC_ENABLED: "true"
          GTS_OIDC_IDP_NAME: "Authelia"
          GTS_OIDC_ISSUER: https://auth.kejadlen.dev
          GTS_OIDC_CLIENT_ID: gotosocial
          GTS_OIDC_CLIENT_SECRET: "{{ gotosocial.oidc_client_secret }}"
          GTS_OIDC_ADMIN_GROUPS: admin
          GTS_METRICS_ENABLED: "true"
          # Tailscale's default CGNAT range, exempted from rate limiting.
          GTS_ADVANCED_RATE_LIMIT_EXCEPTIONS: "100.64.0.0/10"
          GTS_STATUSES_CLEANUP_REMOTE_OLDER_THAN: 1 year
          OTEL_METRICS_PRODUCERS: prometheus
          OTEL_METRICS_EXPORTER: prometheus
          OTEL_EXPORTER_PROMETHEUS_HOST: gotosocial
          TZ: UTC
        volumes:
          - /mnt/lotus-land-story/gotosocial/data:/gotosocial/storage
        networks:
          - name: lotus_land_story
      no_log: true

  handlers:
    - name: Import restarts
      ansible.builtin.import_tasks: restarts.yml

# vim: ft=yaml.ansible