Photon deploy, firewall & tests

Co-authored-by: 33Fraise33 <33Fraise33@users.noreply.github.com>

Author: opencode-agent[bot]

molecule/dawarich/converge.yml

@@ -13,5 +13,8 @@
     dawarich_postgres_image: imresamu/postgis
     dawarich_services_network: molecule-services
     dawarich_dns_servers: []
+    dawarich_photon_api_host: molecule-photon
+    dawarich_photon_api_port: "2322"
+    dawarich_photon_api_use_https: "false"
   roles:
     - role: dawarich

molecule/dawarich/verify.yml

@@ -31,3 +31,19 @@
     - name: Assert shared Valkey is running
       ansible.builtin.assert:
         that: valkey_container.container.State.Status == 'running'
+
+    - name: Inspect Dawarich containers using Photon
+      community.docker.docker_container_info:
+        name: "{{ item }}"
+      loop:
+        - dawarich_app
+        - dawarich_sidekiq
+      register: dawarich_photon_containers
+
+    - name: Assert Dawarich Photon configuration
+      ansible.builtin.assert:
+        that:
+          - item.container.Config.Env is contains('PHOTON_API_HOST=molecule-photon')
+          - item.container.Config.Env is contains('PHOTON_API_PORT=2322')
+          - item.container.Config.Env is contains('PHOTON_API_USE_HTTPS=false')
+      loop: "{{ dawarich_photon_containers.results }}"

molecule/photon/cleanup.yml

@@ -0,0 +1,14 @@
+---
+- name: Cleanup Photon test dependencies
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Remove Photon test container
+      community.docker.docker_container:
+        name: photon
+        state: absent
+
+    - name: Remove Photon test database directory
+      ansible.builtin.file:
+        path: /tmp/molecule-photon-data
+        state: absent

molecule/photon/converge.yml

@@ -0,0 +1,20 @@
+---
+- name: Converge Photon role
+  hosts: all
+  gather_facts: false
+  vars:
+    photon_image: python
+    photon_version: 3.13-alpine
+    photon_command:
+      - python
+      - -m
+      - http.server
+      - "2322"
+    photon_database_path: /tmp/molecule-photon-data
+    photon_port: 12322
+  roles:
+    - role: photon
+  tasks:
+    - name: Pause for Photon runtime inspection
+      ansible.builtin.pause:
+        seconds: 5

molecule/photon/molecule.yml

@@ -0,0 +1,40 @@
+---
+driver:
+  name: docker
+
+ansible:
+  cfg:
+    defaults:
+      roles_path: ${MOLECULE_PROJECT_DIRECTORY}/roles
+
+scenario:
+  test_sequence:
+    - destroy
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - cleanup
+    - destroy
+
+platforms:
+  - name: photon-instance
+    image: geerlingguy/docker-debian12-ansible:latest
+    pre_build_image: true
+    privileged: true
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+
+provisioner:
+  name: ansible
+  playbooks:
+    prepare: prepare.yml
+  inventory:
+    host_vars:
+      photon-instance:
+        ansible_python_interpreter: /usr/bin/python3
+
+verifier:
+  name: ansible

molecule/photon/prepare.yml

@@ -0,0 +1,13 @@
+---
+- name: Prepare Photon dependencies
+  hosts: all
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Install Docker SDK dependencies
+      ansible.builtin.apt:
+        name:
+          - python3-docker
+          - python3-requests
+        state: present
+        update_cache: true

molecule/photon/verify.yml

@@ -0,0 +1,43 @@
+---
+- name: Verify Photon deployment
+  hosts: all
+  gather_facts: false
+  vars:
+    photon_database_path: /tmp/molecule-photon-data
+  tasks:
+    - name: Inspect Photon container
+      community.docker.docker_container_info:
+        name: photon
+      register: photon_container
+
+    - name: Assert Photon container configuration
+      ansible.builtin.assert:
+        that:
+          - photon_container.container.State.Status == 'running'
+          - photon_container.container.Config.Image == 'python:3.13-alpine'
+          - photon_container.container.HostConfig.RestartPolicy.Name == 'always'
+          - >-
+            photon_container.container.HostConfig.PortBindings['2322/tcp'][0].HostPort
+            == '12322'
+          - >-
+            photon_container.container.Mounts | selectattr('Destination', 'equalto',
+            '/photon/photon_data') | list | length == 1
+          - >-
+            (photon_container.container.Mounts |
+            selectattr('Destination', 'equalto', '/photon/photon_data') |
+            map(attribute='Source') | first) == photon_database_path
+          - photon_container.container.Config.Env is contains('PHOTON_UPDATE_STRATEGY=CONTINUOUS')
+          - photon_container.container.Config.Env is contains('PHOTON_UPDATE_INTERVAL=3600')
+
+    - name: Check Photon API endpoint from the container
+      community.docker.docker_container_exec:
+        container: photon
+        command: >-
+          python -c "from urllib.request import urlopen;
+          assert urlopen('http://127.0.0.1:2322/').status == 200"
+      register: photon_api_check
+      changed_when: false
+
+    - name: Assert Photon API endpoint succeeded
+      ansible.builtin.assert:
+        that: photon_api_check.rc == 0

playbooks/dawarich.yml

@@ -1,4 +1,12 @@
 ---
+- name: Setup Photon reverse geocoding service
+  hosts: BEOKPDCOVM02
+  connection: ssh
+  become: true
+  roles:
+    - role: photon
+      tags: photon
+
 - name: Setup shared Valkey and Dawarich
   hosts: BEOKPDCOVM01
   connection: ssh

playbooks/host_vars/beokpdcovm01.yml

@@ -1,4 +1,8 @@
 ---
+dawarich_photon_api_host: 10.10.48.35
+dawarich_photon_api_port: "2322"
+dawarich_photon_api_use_https: "false"
+
 cloudflared:
   docker_network: services
   service_token: !vault |

playbooks/host_vars/beokpdcovm02.yml

@@ -1,10 +1,19 @@
 ---
+photon_database_path: /media/photon
+
 firewall_filter_input_host:
   - comment: "Allow portainer_agent"
     destination:
       port: 9001
       protocol: tcp
     counter: true
+  - comment: "Allow Photon from VM01"
+    source:
+      ip: "@VM01"
+    destination:
+      port: 2322
+      protocol: tcp
+    counter: true
 
 firewall:
   sets: "{{ firewall_sets_all + firewall_sets_internal }}"