Photon deploy, firewall & tests

[opencode-agent]

Implemented Photon deployment, Dawarich Photon integration, media-host firewall access, and Molecule coverage for both Photon and Dawarich environment configuration.

Closes #10

github run

[33Fraise33]

/oc plan look into https://github.com/33Fraise33/media-ansible & https://github.com/33Fraise33/AS211184
As the network for this setup is not correct. media-ansible has all the playbooks that run on BEOKPDCOVM02, AS211184 is my networking playbook for the router that connects all of it.
Implement changes to bring the photon service in line with the higher level architecture

[opencode-agent]

Findings

The current PR deploys Photon from personal-ansible onto VM02’s management address (10.10.48.35) and opens VM02’s host-input firewall. This conflicts with the stated ownership model:

• media-ansible should own services running on BEOKPDCOVM02.
• Photon should use the media service network (10.10.48.128/27), not VM02’s management address.
• AS211184 should own the inter-VLAN policy between Dawarich on VM01 and Photon.
• personal-ansible should only configure Dawarich to consume Photon.

Implementation plan

1. Move Photon deployment ownership to media-ansible

   • Add Photon using the repository’s existing VM02 service/playbook pattern.
   • Reuse its existing media Docker network and address allocation rather than publishing 2322 on 10.10.48.35.
   • Allocate Photon a dedicated media-network address from the established allocation source.
   • Persist /photon/photon_data on /media/photon.
   • Declare restart policy, update environment, health check, image update labels, and container state consistently with comparable media services.
   • Keep Photon private; do not expose it through the management interface or public Traefik unless that is the established pattern for internal APIs.
   • Add Molecule/configuration assertions and an HTTP reverse-geocoding API check.

2. Implement routing policy in AS211184

   • Add Photon’s dedicated IPv4—and IPv6, if allocated—to the appropriate service set.
   • Add a narrowly scoped forwarding rule:
     • source: BEOKPDCOVM01
     • destination: Photon’s media-network address
     • protocol/port: TCP 2322
   • Place the rule before terminal drop/logging rules.
   • Avoid granting VM01 unrestricted access to the entire media subnet.
   • Verify the rendered router configuration with the repository’s existing syntax/test mechanism.

3. Remove misplaced Photon management from this repository

   • Delete roles/photon/.
   • Delete molecule/photon/.
   • Remove the VM02 Photon play from playbooks/dawarich.yml; retain only Valkey and Dawarich on VM01.
   • In playbooks/host_vars/beokpdcovm02.yml, remove:
     • photon_database_path
     • the "Allow Photon from VM01" host-input rule
   • Preserve the existing Portainer-agent rule and firewall composition.

4. Point Dawarich at the service-network endpoint

   • In playbooks/host_vars/beokpdcovm01.yml, replace 10.10.48.35 with Photon’s dedicated address or canonical internal DNS name from media-ansible.
   • Keep port 2322 and HTTP when connecting directly.
   • If the established media architecture instead fronts internal services through HTTPS Traefik, use the canonical Photon hostname, port 443, and HTTPS rather than introducing a direct host-port publication.

5. Retain and strengthen Dawarich integration

   • Keep the PHOTON_API_HOST, PHOTON_API_PORT, and PHOTON_API_USE_HTTPS environment settings for both dawarich_app and dawarich_sidekiq.
   • Update roles/dawarich/README.md to state that Photon is externally managed by media-ansible and that routing is controlled by AS211184.
   • Keep the Molecule assertions in molecule/dawarich/verify.yml, using a neutral test endpoint to confirm both containers receive the complete Photon configuration.

6. Validation

   • Run secret-free linting and syntax checks from each repository root.
   • Run the Dawarich Molecule scenario here, including idempotency and container-log inspection.
   • Run the Photon scenario in media-ansible, checking persistence, network attachment, health, API response, idempotency, and logs.
   • Validate the AS211184 firewall output and confirm the new rule is ordered before deny rules.
   • Require all three repositories’ CI pipelines to pass before merging their coordinated changes.

github run

[33Fraise33]

/oc plan also keep in mind the media server has a traefik container, please use that to expose the service. You can put the role in the personal-ansible folder, not in the media folder

[opencode-agent]

Repository findings

Photon currently publishes TCP 2322 on VM02’s management address and explicitly disables Traefik. Dawarich therefore bypasses the media service network and Traefik. The repository already defines the media Traefik addresses as 10.10.48.151 and 2001:678:1080:1103::151, with internal DNS records following the *.frai.se convention.

Implementation plan

1. Expose Photon through media Traefik

   • Update roles/photon/tasks/main.yml to:
     • Attach Photon to the existing configurable services Docker network.
     • Remove the host ports publication for 2322.
     • Enable Traefik with labels for photon.frai.se.
     • Configure TLS using the le resolver and route to container port 2322.
     • Explicitly set traefik.docker.network.
     • Add an HTTP health check and use the configurable healthy container state.
     • Retain /photon/photon_data, continuous updates, restart policy, and the latest image policy without WUD labels.

2. Define Photon routing variables

   • Update roles/photon/defaults/main.yml with critical routing defaults such as:
     • photon_hostname: photon.frai.se
     • photon_network: services
     • Internal service port 2322
   • Remove or repurpose photon_port, since Photon will no longer publish a host port.

3. Add internal DNS

   • Add IPv4 and IPv6 entries for photon.frai.se in the MEDIA section of playbooks/group_vars/all.yml.
   • Point them to traefik.media.ip and traefik.media.ipv6.

4. Remove direct VM02 access

   • In playbooks/host_vars/beokpdcovm02.yml, retain photon_database_path: /media/photon.
   • Remove the "Allow Photon from VM01" TCP 2322 input rule.
   • Preserve the Portainer-agent rule and existing firewall composition.

5. Configure Dawarich to use Traefik

   • Change playbooks/host_vars/beokpdcovm01.yml to:
     • dawarich_photon_api_host: photon.frai.se
     • dawarich_photon_api_port: "443"
     • dawarich_photon_api_use_https: "true"
   • Keep the Photon variables applied to both dawarich_app and dawarich_sidekiq.
   • No direct management-network or host-port access will remain.

6. Keep deployment ownership here

   • Retain the Photon play targeting BEOKPDCOVM02 in playbooks/dawarich.yml.
   • Retain roles/photon/ and molecule/photon/; no Photon role will be moved into the media repository.

7. Update documentation

   • Revise roles/photon/README.md to document:
     • Traefik-based HTTPS exposure.
     • The required existing Docker network.
     • No direct host-port publication.
     • Persistent storage and initial database requirements.
   • Update roles/dawarich/README.md with the production photon.frai.se:443 HTTPS integration.

8. Strengthen Molecule coverage

   • Update molecule/photon/converge.yml to create a disposable Traefik-compatible network and override the health check for the lightweight test image.
   • Update molecule/photon/verify.yml to assert:
     • Healthy/running state and restart policy.
     • Correct network attachment.
     • No host port binding.
     • Correct Traefik host, TLS, resolver, network, and backend-port labels.
     • Persistent mount and Photon update environment.
     • Successful HTTP API access to the backend.
   • Preserve the post-convergence pause and add container-log inspection for errors or warnings.
   • Update the Dawarich scenario to assert photon.frai.se, port 443, and HTTPS in both application containers.

9. Validation

   • Run pre-commit run --all-files, yamllint, and ansible-lint.
   • Run a secret-free syntax check of playbooks/dawarich.yml.
   • Run molecule test -s photon and molecule test -s dawarich, including idempotency, health, API, configuration, and log checks.

github run

[33Fraise33]

/oc plan one last remark, the services vlan is not available on the media host, BEOKPDCOVM02.

[opencode-agent]

Revised implementation plan

The services VLAN must not be referenced on BEOKPDCOVM02. Photon should share the media host’s existing Traefik Docker network while clients reach it through the media Traefik address.

1. Photon container networking

   • Update roles/photon/tasks/main.yml to remove the 2322 host-port publication.
   • Attach Photon to a configurable photon_network.
   • Configure photon_network on VM02 to the same existing Docker network used by its Traefik container—not a network backed by the unavailable services VLAN.
   • Do not create or address a services-VLAN network in this role.

2. Traefik exposure

   • Add labels for photon.frai.se, TLS, the le certificate resolver, and backend port 2322.
   • Set traefik.docker.network to photon_network.
   • Retain persistence at /media/photon, continuous database updates, restart policy, and health checks.

3. DNS and Dawarich

   • Add photon.frai.se internal A/AAAA records pointing to traefik.media.ip and traefik.media.ipv6.
   • Configure VM01 with:
     • host: photon.frai.se
     • port: 443
     • HTTPS: true
   • This routes Dawarich to the media VLAN’s Traefik endpoint without requiring the media host to access the services VLAN.

4. Firewall

   • Remove VM02’s direct TCP 2322 input rule.
   • Preserve its Portainer-agent rule and firewall composition.
   • Any inter-VLAN router policy should permit VM01 to the media Traefik addresses on TCP 443, rather than to VM02 management or Photon on 2322.

5. Documentation

   • Document that Photon requires the media host’s pre-existing Traefik Docker network.
   • State explicitly that it has no host-port publication and no services-VLAN dependency.

6. Molecule coverage

   • Create a disposable bridge network representing the shared Traefik network.
   • Assert Photon joins that network, has no published ports, and carries the correct HTTPS router/backend labels.
   • Update Dawarich assertions to expect photon.frai.se:443 with HTTPS.
   • Retain persistence, health, API, idempotency, pause, and log-inspection checks.

github run

[33Fraise33]

/oc build implement the above changes

[opencode-agent]

Implemented Photon’s Traefik-based HTTPS exposure, media DNS records, Dawarich HTTPS integration, firewall cleanup, documentation, and updated Molecule assertions for networking, labels, health, persistence, and no host port binding.

github run

[33Fraise33]

/oc plan there are some small remarks to look into, please check the review

[33Fraise33]

/oc plan look into the required review items

[33Fraise33]

/oc plan look into the required review items

[opencode-agent]

Findings

• Photon is used for background reverse-geocoding work, which Dawarich processes through Sidekiq. The web container does not need the Photon environment variables.
• The review comment on roles/photon/defaults/main.yml:14 concerns the default health check. It is a sane implementation default and should live beside the container task while remaining overridable for Molecule.

Implementation plan

1. Limit Photon configuration to Sidekiq

   • Remove PHOTON_API_HOST, PHOTON_API_PORT, and PHOTON_API_USE_HTTPS from dawarich_app.
   • Retain all three variables on dawarich_sidekiq.
   • Keep Sidekiq’s network access required to reach photon.frai.se.

2. Update Dawarich tests and documentation

   • Change molecule/dawarich/verify.yml to assert the Photon configuration only on dawarich_sidekiq.
   • Add an assertion that the web container does not receive the Photon variables.
   • Clarify in roles/dawarich/README.md that the Sidekiq worker performs reverse geocoding through Photon.

3. Inline Photon’s default health check

   • Remove photon_healthcheck from roles/photon/defaults/main.yml.
   • In roles/photon/tasks/main.yml, use the current curl-based health check as an inline default(...) value for photon_healthcheck.
   • Preserve the variable override so Molecule can continue substituting the Python-compatible health check used by its lightweight test image.

4. Validation

   • Run YAML and Ansible linting on the affected files.
   • Run the Dawarich and Photon Molecule scenarios, including idempotency, configuration assertions, runtime checks, pauses, and log inspection.
   • Run a secret-free syntax check for playbooks/dawarich.yml.

github run

[33Fraise33]

/oc build make those changes

[opencode-agent]

Implemented review updates:

• Photon variables now apply only to Sidekiq.
• Dawarich Molecule verifies Sidekiq configuration and absence on web.
• Photon health-check default moved into its task.
• Dawarich README clarifies Sidekiq handles reverse geocoding.

github run