Merge pull request #2 from 33Fraise33/feature/add-dawarich-role

Feature/add dawarich role

Author: 33Fraise33

.ansible-lint

@@ -0,0 +1,13 @@
+---
+profile: production
+skip_list:
+  - fqcn[action-core]
+  - jinja[spacing]
+  - name[missing]
+  - no-handler
+  - package-latest
+  - var-naming[no-role-prefix]
+  - yaml
+exclude_paths:
+  - .ansible/
+  - .venv/

.github/workflows/ansible.yml

@@ -0,0 +1,31 @@
+---
+name: Ansible validation
+
+on:
+  pull_request: true
+  push:
+    branches:
+      - main
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+      - name: Install Ansible tooling
+        run: python -m pip install --requirement requirements.txt molecule molecule-docker
+      - name: Install Ansible collections
+        run: ansible-galaxy collection install --requirements-file requirements.yml
+      - name: Lint YAML
+        run: yamllint .
+      - name: Lint Ansible
+        run: ansible-lint
+      - name: Syntax check Dawarich playbook
+        run: ansible-playbook --syntax-check playbooks/dawarich.yml
+      - name: Test Dawarich role
+        env:
+          ANSIBLE_ALLOW_BROKEN_CONDITIONALS: 'true'
+        run: molecule test --scenario-name dawarich

.gitignore

@@ -1,3 +1,5 @@
 *.pem
 .venv/
 .ansible
+__pycache__/
+*.py[cod]

.yamllint

@@ -0,0 +1,16 @@
+---
+extends: relaxed
+rules:
+  comments:
+    min-spaces-from-content: 1
+  empty-lines:
+    level: warning
+  line-length: disable
+  new-line-at-end-of-file:
+    level: warning
+  new-lines: disable
+  octal-values:
+    forbid-explicit-octal: true
+    forbid-implicit-octal: true
+  trailing-spaces:
+    level: warning

AGENTS.md

@@ -26,10 +26,15 @@
 - New roles use the Galaxy layout: `defaults/main.yml`, `tasks/main.yml`, `handlers/main.yml`, `templates/`, `meta/main.yml`, and `README.md`. Put configurable image tags and ports in `defaults`; use `tasks/main.yml` to compose task files.
 - Use `community.docker` modules for Docker containers, networks, and volumes instead of raw Docker shell commands. Make tasks idempotent and declare container state, restart policy, and other intended configuration explicitly.
 - Keep secrets, passwords, and API keys in variables for Vault or CI injection, never literals. Generate container config with `.j2` templates and bind-mount it into the container.
+- Prefer sane non-critical defaults with Jinja's `default` modifier instead of populating `defaults/main.yml` broadly. Only define critical variables in `defaults/main.yml`; values such as a database name or role-specific username may safely default to the role name, but passwords and other secrets must always be provided explicitly.
+- Prefer application image versions in this order: first, use a major version tag such as `v3` where possible and configure WUD to update within that major version, preventing beta or other incompatible releases; second, use the `latest` tag without setting WUD configuration on the container; third, use a fixed image version tag only when explicitly requested by the owner.
 
 ## Testing And CI
 
 - New roles must include Molecule scaffolding using the Docker driver (`molecule init scenario -d docker`). Its scenario must converge the role, verify idempotency, and assert that the managed container is running and correctly configured.
+- Molecule scenarios must pause after convergence so the agent can inspect the deployed containers' logs for runtime errors and warnings. A container being running or reporting healthy is not sufficient; investigate and address warnings as well as failures before considering the scenario successful.
+- Where possible, Molecule scenarios must include basic application-level tests in addition to idempotency and container configuration checks.
+- During local Molecule debugging, temporarily override container `state: healthy` with `state: started` so convergence returns quickly and container logs can be inspected before adapting the role. Restore health-state assertions before merging.
 - Run `yamllint` and `ansible-lint` for changed Ansible and YAML files; use two-space YAML indentation and no trailing whitespace.
 - CI changes must lint modified roles, run `ansible-playbook --syntax-check` for playbooks using the modified role, and run `molecule test` in an ephemeral environment. Require a green pipeline before merging to `master`.
 - Since no CI configuration exists, add the required pipeline configuration as part of feature work that introduces or changes a role.

molecule/dawarich/cleanup.yml

@@ -0,0 +1,30 @@
+---
+- name: Cleanup Dawarich test dependencies
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Remove Dawarich test containers
+      community.docker.docker_container:
+        name: "{{ item }}"
+        state: absent
+      loop:
+        - dawarich_app
+        - dawarich_db
+        - dawarich_sidekiq
+        - valkey
+
+    - name: Remove Dawarich test network
+      community.docker.docker_network:
+        name: molecule-services
+        state: absent
+
+    - name: Remove Dawarich test volumes
+      community.docker.docker_volume:
+        name: "{{ item }}"
+        state: absent
+      loop:
+        - data_dawarich_db
+        - data_dawarich_shared
+        - data_dawarich_public
+        - data_dawarich_watched
+        - data_dawarich_storage

molecule/dawarich/converge.yml

@@ -0,0 +1,17 @@
+---
+- name: Converge Dawarich role
+  hosts: all
+  gather_facts: false
+  vars:
+    dawarich_database_password: molecule-dawarich-password
+    dawarich_secret_key_base: molecule-dawarich-secret-key
+    authelia_oidc_clients:
+      dawarich:
+        client_id: dawarich
+        client_secret: molecule-dawarich-client-secret
+    dawarich_container_state: "{{ lookup('env', 'DAWARICH_CONTAINER_STATE') | default('healthy', true) }}"
+    dawarich_postgres_image: imresamu/postgis
+    dawarich_services_network: molecule-services
+    dawarich_dns_servers: []
+  roles:
+    - role: dawarich

molecule/dawarich/molecule.yml

@@ -0,0 +1,35 @@
+---
+driver:
+  name: docker
+
+scenario:
+  test_sequence:
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - cleanup
+    - destroy
+
+platforms:
+  - name: dawarich-instance
+    image: geerlingguy/docker-debian12-ansible:latest
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: prepare.yml
+  inventory:
+    host_vars:
+      dawarich-instance:
+        ansible_python_interpreter: /usr/bin/python3
+
+verifier:
+  name: ansible

molecule/dawarich/prepare.yml

@@ -0,0 +1,27 @@
+---
+- name: Prepare Dawarich dependencies
+  hosts: all
+  gather_facts: false
+  become: true
+  vars:
+    molecule_services_network: molecule-services
+  tasks:
+    - name: Install Docker SDK dependencies
+      ansible.builtin.apt:
+        name:
+          - python3-docker
+          - python3-requests
+        state: present
+        update_cache: true
+
+    - name: Create shared services network
+      community.docker.docker_network:
+        name: "{{ molecule_services_network }}"
+
+    - name: Start shared Valkey
+      community.docker.docker_container:
+        name: valkey
+        image: ghcr.io/valkey-io/valkey:alpine
+        networks:
+          - name: "{{ molecule_services_network }}"
+        state: started

molecule/dawarich/verify.yml

@@ -0,0 +1,33 @@
+---
+- name: Verify Dawarich deployment
+  hosts: all
+  gather_facts: false
+  vars:
+    dawarich_container_state: "{{ lookup('env', 'DAWARICH_CONTAINER_STATE') | default('healthy', true) }}"
+  tasks:
+    - name: Inspect Dawarich containers
+      community.docker.docker_container_info:
+        name: "{{ item }}"
+      loop:
+        - dawarich_db
+        - dawarich_app
+        - dawarich_sidekiq
+      register: dawarich_containers
+
+    - name: Assert Dawarich containers are running
+      ansible.builtin.assert:
+        that:
+          - item.container.State.Status == 'running'
+          - >-
+            dawarich_container_state == 'started' or
+            item.container.State.Health.Status == 'healthy'
+      loop: "{{ dawarich_containers.results }}"
+
+    - name: Inspect shared Valkey
+      community.docker.docker_container_info:
+        name: valkey
+      register: valkey_container
+
+    - name: Assert shared Valkey is running
+      ansible.builtin.assert:
+        that: valkey_container.container.State.Status == 'running'