Initialise repository structure and placeholder files. Generic functionality works i guess, need to come up with a better solution for compose templates

roles/docker_app/README.md

@@ -0,0 +1,10 @@
+# docker_app
+
+Shared implementation role for single-container Docker Compose applications.
+Application roles set `docker_app_*` variables and include this role.
+
+It supports direct host-port publishing with UFW rules or Traefik routing via
+labels and a shared Docker network.
+
+Tags: `docker_app`, `docker`, `config`, `compose`, `firewall`.
+

roles/docker_app/defaults/main.yml

@@ -0,0 +1,32 @@
+---
+docker_app_name: app
+docker_app_dir: "/srv/docker/{{ docker_app_name }}"
+docker_app_image: ""
+docker_app_restart: unless-stopped
+docker_app_command: ""
+docker_app_user: ""
+docker_app_network_mode: ""
+docker_app_privileged: false
+docker_app_pull: missing
+docker_app_env: {}
+docker_app_volumes: []
+docker_app_ports: []
+docker_app_devices: []
+docker_app_cap_add: []
+docker_app_group_add: []
+docker_app_extra_hosts: []
+docker_app_depends_on: []
+docker_app_directories:
+  - "{{ docker_app_dir }}"
+docker_app_routing_mode: "{{ nbops_service_routing_mode }}"
+docker_app_domain: "{{ docker_app_name }}.{{ nbops_service_domain_suffix }}"
+docker_app_service_port: null
+docker_app_traefik_network: "{{ nbops_proxy_network }}"
+docker_app_traefik_entrypoint: "{{ nbops_traefik_entrypoint }}"
+docker_app_traefik_tls: "{{ nbops_traefik_tls }}"
+docker_app_traefik_middlewares: []
+docker_app_traefik_rule: "Host(`{{ docker_app_domain }}`)"
+docker_app_labels: {}
+docker_app_ufw_ports: "{{ docker_app_ports }}"
+docker_app_env_template_src: env.j2
+docker_app_compose_template_src: compose.yaml.j2

roles/docker_app/files/.gitkeep

@@ -0,0 +1 @@
+

roles/docker_app/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart docker app
+  community.docker.docker_compose_v2:
+    project_src: "{{ docker_app_dir }}"
+    state: restarted
+

roles/docker_app/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+- name: Validate Docker app image is configured
+  ansible.builtin.assert:
+    that:
+      - docker_app_image | length > 0
+    fail_msg: "docker_app_image must be configured for {{ docker_app_name }}."
+  tags: [docker_app]
+
+- name: Create Docker app directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop: "{{ docker_app_directories }}"
+  tags: [docker_app]
+
+- name: Ensure proxy network exists
+  community.docker.docker_network:
+    name: "{{ docker_app_traefik_network }}"
+    state: present
+  when:
+    - docker_app_routing_mode == "traefik"
+    - docker_app_network_mode | length == 0
+  tags: [docker_app, docker]
+
+- name: Render Docker app environment
+  ansible.builtin.template:
+    src: "{{ docker_app_env_template_src }}"
+    dest: "{{ docker_app_dir }}/.env"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  tags: [docker_app, config]
+
+- name: Render Docker app Compose file
+  ansible.builtin.template:
+    src: "{{ docker_app_compose_template_src }}"
+    dest: "{{ docker_app_dir }}/compose.yaml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart docker app
+  tags: [docker_app, compose]
+
+- name: Allow Docker app host ports
+  community.general.ufw:
+    rule: allow
+    port: "{{ item.host | default(item.container) }}"
+    proto: "{{ item.protocol | default('tcp') }}"
+  loop: "{{ docker_app_ufw_ports }}"
+  when: docker_app_routing_mode == "host"
+  tags: [docker_app, firewall]
+
+- name: Start Docker app
+  community.docker.docker_compose_v2:
+    project_src: "{{ docker_app_dir }}"
+    state: present
+    pull: "{{ docker_app_pull }}"
+  tags: [docker_app, compose]

roles/docker_app/templates/compose.yaml.j2

@@ -0,0 +1,90 @@
+services:
+  {{ docker_app_name }}:
+    image: {{ docker_app_image }}
+    restart: {{ docker_app_restart }}
+{% if docker_app_command | length > 0 %}
+    command: {{ docker_app_command | to_json }}
+{% endif %}
+{% if docker_app_user | length > 0 %}
+    user: "{{ docker_app_user }}"
+{% endif %}
+{% if docker_app_network_mode | length > 0 %}
+    network_mode: {{ docker_app_network_mode }}
+{% endif %}
+{% if docker_app_privileged | bool %}
+    privileged: true
+{% endif %}
+{% if docker_app_env | length > 0 %}
+    env_file: .env
+{% endif %}
+{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+    ports:
+{% for port in docker_app_ports %}
+      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+{% endfor %}
+{% endif %}
+{% if docker_app_routing_mode == "traefik" and docker_app_service_port %}
+    # internal service port: {{ docker_app_service_port }}; not published on the Docker host
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.{{ docker_app_name }}.rule={{ docker_app_traefik_rule }}
+      - traefik.http.routers.{{ docker_app_name }}.entrypoints={{ docker_app_traefik_entrypoint }}
+      - traefik.http.routers.{{ docker_app_name }}.tls={{ docker_app_traefik_tls | bool | ternary('true', 'false') }}
+{% if docker_app_traefik_middlewares | length > 0 %}
+      - traefik.http.routers.{{ docker_app_name }}.middlewares={{ docker_app_traefik_middlewares | join(',') }}
+{% endif %}
+      - traefik.http.services.{{ docker_app_name }}.loadbalancer.server.port={{ docker_app_service_port }}
+{% for key, value in docker_app_labels.items() %}
+      - {{ key }}={{ value }}
+{% endfor %}
+{% elif docker_app_labels | length > 0 %}
+    labels:
+{% for key, value in docker_app_labels.items() %}
+      - {{ key }}={{ value }}
+{% endfor %}
+{% endif %}
+{% if docker_app_volumes | length > 0 %}
+    volumes:
+{% for volume in docker_app_volumes %}
+      - {{ volume }}
+{% endfor %}
+{% endif %}
+{% if docker_app_devices | length > 0 %}
+    devices:
+{% for device in docker_app_devices %}
+      - {{ device }}
+{% endfor %}
+{% endif %}
+{% if docker_app_cap_add | length > 0 %}
+    cap_add:
+{% for capability in docker_app_cap_add %}
+      - {{ capability }}
+{% endfor %}
+{% endif %}
+{% if docker_app_group_add | length > 0 %}
+    group_add:
+{% for group in docker_app_group_add %}
+      - "{{ group }}"
+{% endfor %}
+{% endif %}
+{% if docker_app_extra_hosts | length > 0 %}
+    extra_hosts:
+{% for host in docker_app_extra_hosts %}
+      - {{ host }}
+{% endfor %}
+{% endif %}
+{% if docker_app_depends_on | length > 0 %}
+    depends_on:
+{% for dependency in docker_app_depends_on %}
+      - {{ dependency }}
+{% endfor %}
+{% endif %}
+{% if docker_app_routing_mode == "traefik" and docker_app_network_mode | length == 0 %}
+    networks:
+      - {{ docker_app_traefik_network }}
+{% endif %}
+{% if docker_app_routing_mode == "traefik" and docker_app_network_mode | length == 0 %}
+networks:
+  {{ docker_app_traefik_network }}:
+    external: true
+{% endif %}

roles/docker_app/templates/env.j2

@@ -0,0 +1,4 @@
+{% for key, value in docker_app_env.items() %}
+{{ key }}={{ value }}
+{% endfor %}
+