Photon Traefik integration and tests

Co-authored-by: 33Fraise33 <33Fraise33@users.noreply.github.com>

Author: opencode-agent[bot]

molecule/dawarich/converge.yml

@@ -13,8 +13,8 @@
     dawarich_postgres_image: imresamu/postgis
     dawarich_services_network: molecule-services
     dawarich_dns_servers: []
-    dawarich_photon_api_host: molecule-photon
-    dawarich_photon_api_port: "2322"
-    dawarich_photon_api_use_https: "false"
+    dawarich_photon_api_host: photon.frai.se
+    dawarich_photon_api_port: "443"
+    dawarich_photon_api_use_https: "true"
   roles:
     - role: dawarich

molecule/dawarich/verify.yml

@@ -43,7 +43,7 @@
     - name: Assert Dawarich Photon configuration
       ansible.builtin.assert:
         that:
-          - item.container.Config.Env is contains('PHOTON_API_HOST=molecule-photon')
-          - item.container.Config.Env is contains('PHOTON_API_PORT=2322')
-          - item.container.Config.Env is contains('PHOTON_API_USE_HTTPS=false')
+          - item.container.Config.Env is contains('PHOTON_API_HOST=photon.frai.se')
+          - item.container.Config.Env is contains('PHOTON_API_PORT=443')
+          - item.container.Config.Env is contains('PHOTON_API_USE_HTTPS=true')
       loop: "{{ dawarich_photon_containers.results }}"

molecule/photon/cleanup.yml

@@ -12,3 +12,8 @@
       ansible.builtin.file:
         path: /tmp/molecule-photon-data
         state: absent
+
+    - name: Remove shared Traefik test network
+      community.docker.docker_network:
+        name: molecule-traefik
+        state: absent

molecule/photon/converge.yml

@@ -11,7 +11,23 @@
       - http.server
       - "2322"
     photon_database_path: /tmp/molecule-photon-data
-    photon_port: 12322
+    photon_hostname: photon.test
+    photon_network: molecule-traefik
+    photon_healthcheck:
+      test:
+        - CMD-SHELL
+        - >-
+          python -c "from urllib.request import urlopen;
+          assert urlopen('http://127.0.0.1:2322/').status == 200"
+      interval: 5s
+      timeout: 5s
+      retries: 3
+      start_period: 1s
+  pre_tasks:
+    - name: Create shared Traefik test network
+      community.docker.docker_network:
+        name: molecule-traefik
+        driver: bridge
   roles:
     - role: photon
   tasks:

molecule/photon/verify.yml

@@ -4,6 +4,7 @@
   gather_facts: false
   vars:
     photon_database_path: /tmp/molecule-photon-data
+    photon_network: molecule-traefik
   tasks:
     - name: Inspect Photon container
       community.docker.docker_container_info:
@@ -14,11 +15,13 @@
       ansible.builtin.assert:
         that:
           - photon_container.container.State.Status == 'running'
+          - photon_container.container.State.Health.Status == 'healthy'
           - photon_container.container.Config.Image == 'python:3.13-alpine'
           - photon_container.container.HostConfig.RestartPolicy.Name == 'always'
           - >-
-            photon_container.container.HostConfig.PortBindings['2322/tcp'][0].HostPort
-            == '12322'
+            photon_container.container.HostConfig.PortBindings is none or
+            photon_container.container.HostConfig.PortBindings | length == 0
+          - photon_network in photon_container.container.NetworkSettings.Networks
           - >-
             photon_container.container.Mounts | selectattr('Destination', 'equalto',
             '/photon/photon_data') | list | length == 1
@@ -28,6 +31,12 @@
             map(attribute='Source') | first) == photon_database_path
           - photon_container.container.Config.Env is contains('PHOTON_UPDATE_STRATEGY=CONTINUOUS')
           - photon_container.container.Config.Env is contains('PHOTON_UPDATE_INTERVAL=3600')
+          - photon_container.container.Config.Labels['traefik.enable'] == 'true'
+          - photon_container.container.Config.Labels['traefik.docker.network'] == photon_network
+          - photon_container.container.Config.Labels['traefik.http.routers.photon.rule'] == 'Host(`photon.test`)'
+          - photon_container.container.Config.Labels['traefik.http.routers.photon.tls'] == 'true'
+          - photon_container.container.Config.Labels['traefik.http.routers.photon.tls.certresolver'] == 'le'
+          - photon_container.container.Config.Labels['traefik.http.services.photon.loadbalancer.server.port'] == '2322'
 
     - name: Check Photon API endpoint from the container
       community.docker.docker_container_exec:

playbooks/group_vars/all.yml

@@ -186,8 +186,12 @@ domain:
       answer: "{{ traefik.dco.ipv6 }}"
     - domain: time.unitix.be
       answer: "{{ traefik.dco.ip }}"
-    # MEDIA
-    - domain: "autobrr.frai.se"
+    # MEDIA
+    - domain: photon.frai.se
+      answer: "{{ traefik.media.ipv6 }}"
+    - domain: photon.frai.se
+      answer: "{{ traefik.media.ip }}"
+    - domain: "autobrr.frai.se"
       answer: "{{ traefik.media.ip }}"
     - domain: "autobrr.frai.se"
       answer: "{{ traefik.media.ipv6 }}"
@@ -565,4 +569,4 @@ authelia_oidc_clients:
       39306330636537383462656131366662643835663530316537626235636639373636316638303539
       33656462653730306433623231646663353136363534313365353236623636643335323761666632
       61663765396237356639333531353239316538383531356562643733346134316638366164326132
-      61393833386366363732
+      61393833386366363732

playbooks/host_vars/beokpdcovm01.yml

@@ -1,7 +1,7 @@
 ---
-dawarich_photon_api_host: 10.10.48.35
-dawarich_photon_api_port: "2322"
-dawarich_photon_api_use_https: "false"
+dawarich_photon_api_host: photon.frai.se
+dawarich_photon_api_port: "443"
+dawarich_photon_api_use_https: "true"
 
 cloudflared:
   docker_network: services

playbooks/host_vars/beokpdcovm02.yml

@@ -1,20 +1,13 @@
 ---
 photon_database_path: /media/photon
+photon_network: media
 
 firewall_filter_input_host:
   - comment: "Allow portainer_agent"
     destination:
       port: 9001
       protocol: tcp
     counter: true
-  - comment: "Allow Photon from VM01"
-    source:
-      ip: "@VM01"
-    destination:
-      port: 2322
-      protocol: tcp
-    counter: true
-
 firewall:
   sets: "{{ firewall_sets_all + firewall_sets_internal }}"
   filter:

roles/dawarich/README.md

@@ -11,6 +11,8 @@ Supply `dawarich_database_password` and `dawarich_secret_key_base` through Ansib
 Reverse geocoding defaults to the public Photon service. Set
 `dawarich_photon_api_host`, `dawarich_photon_api_port`, and
 `dawarich_photon_api_use_https` to use a self-hosted Photon instance.
+In production Photon is exposed by media Traefik at `photon.frai.se:443` over
+HTTPS; Photon itself is managed separately on the media host.
 
 Before deployment, define these variables in the target host or CI secret injection. Do not commit plaintext values:
 

roles/photon/README.md

@@ -3,6 +3,11 @@
 Deploys [Photon](https://photon.komoot.io/) as a reverse-geocoding service for
 Dawarich.
 
+Photon joins the media host's existing Traefik Docker network, configured by
+`photon_network` (the media network on VM02). It has no host-port publication
+and does not depend on the services VLAN. Traefik exposes the API as HTTPS at
+`photon_hostname` (`photon.frai.se`) and forwards requests to port 2322.
+
 `photon_database_path` controls the host directory mounted at
 `/photon/photon_data`. Photon downloads and stores a large OpenStreetMap
 database there on its first start. Place this directory on storage that is not
@@ -11,5 +16,5 @@ disk space while applying updates.
 
 The container uses Photon’s recommended continuous update configuration:
 `PHOTON_UPDATE_STRATEGY=CONTINUOUS` and a `PHOTON_UPDATE_INTERVAL` of 3600
-seconds. Its API is published on `photon_port` (2322 by default); restrict
-network access with the host firewall.
+seconds. The pre-existing Traefik network must be available before deploying
+this role.