Ensure all foreman.target services stop before the target

Add After=foreman.target to every service and timer that is
PartOf=foreman.target. The reversed stop ordering (each service stops
before foreman.target) means systemctl stop foreman.target now blocks
until all constituent services have fully stopped, rather than returning
the moment the target meta-unit transitions to inactive.

Without this, a rapid stop+start of foreman.target can call systemctl
start while services are still in the process of stopping, leading to
container conflicts and races on the subsequent start.

Author: pablomh

src/roles/candlepin/tasks/main.yml

@@ -97,7 +97,7 @@
         [Unit]
         PartOf=foreman.target
         Wants=redis.service postgresql.service
-        After=redis.service postgresql.service
+        After=foreman.target redis.service postgresql.service
         [Service]
         TimeoutStartSec=300
     healthcheck: curl --fail --insecure https://localhost:23443/candlepin/status

src/roles/foreman/tasks/main.yaml

@@ -127,7 +127,7 @@
         [Unit]
         PartOf=foreman.target
         Wants=redis.service postgresql.service
-        After=redis.service postgresql.service
+        After=foreman.target redis.service postgresql.service
   notify: Restart foreman
 
 - name: Deploy Dynflow Container
@@ -162,7 +162,7 @@
         [Unit]
         PartOf=foreman.target
         Wants=redis.service postgresql.service
-        After=redis.service postgresql.service
+        After=foreman.target redis.service postgresql.service
       - |
         [Service]
         Restart=on-failure
@@ -207,6 +207,7 @@
       - |
         [Unit]
         PartOf=foreman.target
+        After=foreman.target
         StartLimitIntervalSec=0
       - |
         [Service]

src/roles/foreman/templates/foreman-recurring@.timer.j2

@@ -1,6 +1,7 @@
 [Unit]
 Description=Timer for Foreman recurring: {{ item.rake }}
 PartOf=foreman.target
+After=foreman.target
 
 [Timer]
 Unit=foreman-recurring@{{ item.instance }}.service

src/roles/foreman_proxy/tasks/main.yaml

@@ -35,6 +35,7 @@
         WantedBy=default.target foreman.target
         [Unit]
         PartOf=foreman.target
+        After=foreman.target
   notify: Restart Foreman Proxy
 
 - name: Run daemon reload to make Quadlet create the service files

src/roles/postgresql/tasks/main.yml

@@ -43,6 +43,7 @@
         WantedBy=default.target foreman.target
         [Unit]
         PartOf=foreman.target
+        After=foreman.target
 
 - name: Configure SSL certificates
   when:

src/roles/pulp/tasks/main.yaml

@@ -119,7 +119,7 @@
         [Unit]
         PartOf=foreman.target
         Wants=redis.service postgresql.service
-        After=redis.service postgresql.service
+        After=foreman.target redis.service postgresql.service
         [Service]
         Restart=always
         RestartSec=3
@@ -150,7 +150,7 @@
         [Unit]
         PartOf=foreman.target
         Wants=redis.service postgresql.service
-        After=redis.service postgresql.service
+        After=foreman.target redis.service postgresql.service
         [Service]
         Restart=always
         RestartSec=3
@@ -181,7 +181,7 @@
         [Unit]
         PartOf=pulp-worker.target foreman.target
         Wants=redis.service postgresql.service
-        After=redis.service postgresql.service
+        After=foreman.target redis.service postgresql.service
         [Service]
         Restart=always
         RestartSec=3

src/roles/redis/tasks/main.yaml

@@ -31,6 +31,7 @@
         WantedBy=default.target foreman.target
         [Unit]
         PartOf=foreman.target
+        After=foreman.target
 
 - name: Run daemon reload
   ansible.builtin.systemd: