implemented compose by url, parse, local yaml.

roles/alloy/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/alloy/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/alloy/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/alloy/templates/compose.override.yaml.j2"
     docker_app_name: "{{ alloy_name }}"
     docker_app_dir: "{{ alloy_dir }}"
     docker_app_image: "{{ alloy_image }}"

roles/alloy/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/alloy/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/alloy/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `alloy` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/alloy/upstream/docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+  grafana-alloy:
+    image: grafana/alloy:latest
+    container_name: grafana-alloy
+    ports:
+      - '12345:12345'
+    volumes:
+      # mount config file
+      - './grafana/alloy/config.alloy:/etc/alloy/config.alloy'
+      # give access to running docker containers for discovery.docker
+      - /var/run/docker.sock:/var/run/docker.sock
+      # give access to docker's log files directory (optional)
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+    environment:
+      # pass environment variables for config.alloy
+      GRAFANA_LOKI_URL: ${GRAFANA_LOKI_URL}
+      GRAFANA_LOKI_USERNAME: ${GRAFANA_LOKI_USERNAME}
+#      GRAFANA_CLOUD_API_KEY: ${GRAFANA_CLOUD_API_KEY}
+    command:
+      - run
+      - --server.http.listen-addr=0.0.0.0:12345
+      - --storage.path=/var/lib/alloy/data
+      - /etc/alloy/config.alloy

roles/arr/handlers/.gitkeep

@@ -0,0 +1 @@
+

roles/arr/handlers/main.yml

@@ -1,6 +0,0 @@
----
-- name: restart arr
-  community.docker.docker_compose_v2:
-    project_src: "{{ arr_dir }}"
-    state: restarted
-

roles/arr/tasks/main.yml

@@ -23,43 +23,22 @@
   loop: "{{ arr_services | dict2items }}"
   tags: [arr, config]
 
-- name: Render Arr environment
-  ansible.builtin.template:
-    src: env.j2
-    dest: "{{ arr_dir }}/.env"
-    owner: root
-    group: root
-    mode: "0644"
-  tags: [arr, config]
-
-- name: Ensure Arr proxy network exists
-  community.docker.docker_network:
-    name: "{{ arr_traefik_network }}"
-    state: present
-  when: arr_routing_mode == "traefik"
-  tags: [arr, docker]
-
-- name: Render Arr Compose file
-  ansible.builtin.template:
-    src: compose.yaml.j2
-    dest: "{{ arr_dir }}/compose.yaml"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart arr
-  tags: [arr, compose]
-
-- name: Allow Arr ports
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-  loop: "{{ arr_tcp_ports }}"
-  when: arr_routing_mode == "host"
-  tags: [arr, firewall]
-
-- name: Start Arr stack
-  community.docker.docker_compose_v2:
-    project_src: "{{ arr_dir }}"
-    state: present
-  tags: [arr, compose]
+- name: Deploy Arr Compose project
+  ansible.builtin.include_role:
+    name: compose_project
+  vars:
+    compose_project_dir: "{{ arr_dir }}"
+    compose_project_directories:
+      - "{{ arr_dir }}"
+      - "{{ arr_config_root }}"
+      - "{{ arr_media_root }}"
+      - "{{ arr_downloads_root }}"
+    compose_project_env_template_src: "{{ playbook_dir }}/../roles/arr/templates/env.j2"
+    compose_project_env_mode: "0644"
+    compose_project_compose_template_src: "{{ playbook_dir }}/../roles/arr/templates/compose.yaml.j2"
+    compose_project_override_template_src: "{{ playbook_dir }}/../roles/arr/templates/compose.override.yaml.j2"
+    compose_project_create_proxy_network: "{{ arr_routing_mode == 'traefik' }}"
+    compose_project_proxy_network: "{{ arr_traefik_network }}"
+    compose_project_firewall_ports: "{{ arr_tcp_ports }}"
+    compose_project_firewall_enabled: "{{ arr_routing_mode in ['host', 'traefik_file'] }}"
+  tags: [arr]

roles/arr/templates/compose.override.yaml.j2

@@ -0,0 +1,5 @@
+services:
+{% for name, service in arr_services.items() %}
+  {{ name }}: {}
+{% endfor %}
+

roles/arr/templates/compose.yaml.j2

@@ -4,9 +4,9 @@ services:
     image: {{ service.image }}
     restart: unless-stopped
     env_file: .env
-{% if arr_routing_mode == "host" %}
+{% if arr_routing_mode in ["host", "traefik_file"] %}
     ports:
-      - "{{ service.port }}:{{ service.port }}"
+      - "{{ nbops_traefik_file_bind_address if arr_routing_mode == 'traefik_file' else '0.0.0.0' }}:{{ service.port }}:{{ service.port }}"
 {% endif %}
 {% if arr_routing_mode == "traefik" %}
     # internal service port: {{ service.port }}; not published on the Docker host

roles/arr/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `arr` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/authentik/handlers/.gitkeep

@@ -0,0 +1 @@
+

roles/authentik/handlers/main.yml

@@ -1,6 +0,0 @@
----
-- name: restart authentik
-  community.docker.docker_compose_v2:
-    project_src: "{{ authentik_dir }}"
-    state: restarted
-

roles/authentik/tasks/main.yml

@@ -8,44 +8,18 @@
     mode: "0755"
   tags: [authentik]
 
-- name: Render authentik environment
-  ansible.builtin.template:
-    src: env.j2
-    dest: "{{ authentik_dir }}/.env"
-    owner: root
-    group: root
-    mode: "0600"
-  no_log: true
-  tags: [authentik, config]
-
-- name: Ensure authentik proxy network exists
-  community.docker.docker_network:
-    name: "{{ authentik_traefik_network }}"
-    state: present
-  when: authentik_routing_mode == "traefik"
-  tags: [authentik, docker]
-
-- name: Render authentik Compose file
-  ansible.builtin.template:
-    src: compose.yaml.j2
-    dest: "{{ authentik_dir }}/compose.yaml"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart authentik
-  tags: [authentik, compose]
-
-- name: Allow authentik ports
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-  loop: "{{ authentik_tcp_ports }}"
-  when: authentik_routing_mode == "host"
-  tags: [authentik, firewall]
-
-- name: Start authentik
-  community.docker.docker_compose_v2:
-    project_src: "{{ authentik_dir }}"
-    state: present
-  tags: [authentik, compose]
+- name: Deploy authentik Compose project
+  ansible.builtin.include_role:
+    name: compose_project
+  vars:
+    compose_project_dir: "{{ authentik_dir }}"
+    compose_project_directories:
+      - "{{ authentik_dir }}"
+    compose_project_env_template_src: "{{ playbook_dir }}/../roles/authentik/templates/env.j2"
+    compose_project_compose_template_src: "{{ playbook_dir }}/../roles/authentik/templates/compose.yaml.j2"
+    compose_project_override_template_src: "{{ playbook_dir }}/../roles/authentik/templates/compose.override.yaml.j2"
+    compose_project_create_proxy_network: "{{ authentik_routing_mode == 'traefik' }}"
+    compose_project_proxy_network: "{{ authentik_traefik_network }}"
+    compose_project_firewall_ports: "{{ authentik_tcp_ports }}"
+    compose_project_firewall_enabled: "{{ authentik_routing_mode in ['host', 'traefik_file'] }}"
+  tags: [authentik]

roles/authentik/templates/compose.override.yaml.j2

@@ -0,0 +1,6 @@
+services:
+  postgresql: {}
+  redis: {}
+  server: {}
+  worker: {}
+

roles/authentik/templates/compose.yaml.j2

@@ -16,10 +16,10 @@ services:
     restart: unless-stopped
     command: server
     env_file: .env
-{% if authentik_routing_mode == "host" %}
+{% if authentik_routing_mode in ["host", "traefik_file"] %}
     ports:
-      - "{{ authentik_http_port }}:9000"
-      - "{{ authentik_https_port }}:9443"
+      - "{{ nbops_traefik_file_bind_address if authentik_routing_mode == 'traefik_file' else '0.0.0.0' }}:{{ authentik_http_port }}:9000"
+      - "{{ nbops_traefik_file_bind_address if authentik_routing_mode == 'traefik_file' else '0.0.0.0' }}:{{ authentik_https_port }}:9443"
 {% endif %}
 {% if authentik_routing_mode == "traefik" %}
     # internal HTTP service port: 9000; not published on the Docker host

roles/authentik/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `authentik` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/authentik_ldap/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/authentik_ldap/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/authentik_ldap/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/authentik_ldap/templates/compose.override.yaml.j2"
     docker_app_name: "{{ authentik_ldap_name }}"
     docker_app_dir: "{{ authentik_ldap_dir }}"
     docker_app_image: "{{ authentik_ldap_image }}"

roles/authentik_ldap/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/authentik_ldap/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/authentik_ldap/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `authentik_ldap` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/authentik_proxy/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/authentik_proxy/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/authentik_proxy/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/authentik_proxy/templates/compose.override.yaml.j2"
     docker_app_name: "{{ authentik_proxy_name }}"
     docker_app_dir: "{{ authentik_proxy_dir }}"
     docker_app_image: "{{ authentik_proxy_image }}"

roles/authentik_proxy/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/authentik_proxy/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/authentik_proxy/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `authentik_proxy` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/authentik_rac/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/authentik_rac/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/authentik_rac/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/authentik_rac/templates/compose.override.yaml.j2"
     docker_app_name: "{{ authentik_rac_name }}"
     docker_app_dir: "{{ authentik_rac_dir }}"
     docker_app_image: "{{ authentik_rac_image }}"

roles/authentik_rac/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/authentik_rac/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/authentik_rac/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `authentik_rac` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/cleanuparr/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/cleanuparr/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/cleanuparr/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/cleanuparr/templates/compose.override.yaml.j2"
     docker_app_name: "{{ cleanuparr_name }}"
     docker_app_dir: "{{ cleanuparr_dir }}"
     docker_app_image: "{{ cleanuparr_image }}"

roles/cleanuparr/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/cleanuparr/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/cleanuparr/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `cleanuparr` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/code_server/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/code_server/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/code_server/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/code_server/templates/compose.override.yaml.j2"
     docker_app_name: "{{ code_server_name }}"
     docker_app_dir: "{{ code_server_dir }}"
     docker_app_image: "{{ code_server_image }}"

roles/code_server/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/code_server/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/code_server/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `code_server` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/compose_project/README.md

@@ -0,0 +1,11 @@
+# compose_project
+
+Normalizes Docker Compose project deployment for all Compose-backed roles.
+
+This role renders `.env`, `compose.yaml`, and optional `compose.override.yaml`,
+creates required directories and proxy networks, opens declared UFW ports, and
+starts the Compose project.
+
+Application roles should provide their own templates and call this role instead
+of duplicating Compose lifecycle tasks.
+

roles/compose_project/defaults/main.yml

@@ -0,0 +1,20 @@
+---
+compose_project_dir: ""
+compose_project_directories:
+  - "{{ compose_project_dir }}"
+compose_project_env_template_src: ""
+compose_project_compose_template_src: ""
+compose_project_override_template_src: ""
+compose_project_env_dest: "{{ compose_project_dir }}/.env"
+compose_project_compose_dest: "{{ compose_project_dir }}/compose.yaml"
+compose_project_override_dest: "{{ compose_project_dir }}/compose.override.yaml"
+compose_project_env_mode: "0600"
+compose_project_compose_mode: "0644"
+compose_project_override_mode: "0644"
+compose_project_proxy_network: ""
+compose_project_create_proxy_network: false
+compose_project_firewall_ports: []
+compose_project_firewall_enabled: false
+compose_project_state: present
+compose_project_pull: missing
+

roles/compose_project/files/.gitkeep

@@ -0,0 +1 @@
+

roles/compose_project/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart compose project
+  community.docker.docker_compose_v2:
+    project_src: "{{ compose_project_dir }}"
+    state: restarted
+

roles/compose_project/tasks/main.yml

@@ -0,0 +1,75 @@
+---
+- name: Validate Compose project directory is configured
+  ansible.builtin.assert:
+    that:
+      - compose_project_dir | length > 0
+      - compose_project_compose_template_src | length > 0
+    fail_msg: "compose_project_dir and compose_project_compose_template_src are required."
+  tags: [compose_project]
+
+- name: Create Compose project directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop: "{{ compose_project_directories }}"
+  tags: [compose_project, directories]
+
+- name: Ensure Compose project proxy network exists
+  community.docker.docker_network:
+    name: "{{ compose_project_proxy_network }}"
+    state: present
+  when:
+    - compose_project_create_proxy_network | bool
+    - compose_project_proxy_network | length > 0
+  tags: [compose_project, docker]
+
+- name: Render Compose project environment file
+  ansible.builtin.template:
+    src: "{{ compose_project_env_template_src }}"
+    dest: "{{ compose_project_env_dest }}"
+    owner: root
+    group: root
+    mode: "{{ compose_project_env_mode }}"
+  when: compose_project_env_template_src | length > 0
+  no_log: true
+  tags: [compose_project, config]
+
+- name: Render Compose project file
+  ansible.builtin.template:
+    src: "{{ compose_project_compose_template_src }}"
+    dest: "{{ compose_project_compose_dest }}"
+    owner: root
+    group: root
+    mode: "{{ compose_project_compose_mode }}"
+  notify: restart compose project
+  tags: [compose_project, compose]
+
+- name: Render Compose project override file
+  ansible.builtin.template:
+    src: "{{ compose_project_override_template_src }}"
+    dest: "{{ compose_project_override_dest }}"
+    owner: root
+    group: root
+    mode: "{{ compose_project_override_mode }}"
+  when: compose_project_override_template_src | length > 0
+  notify: restart compose project
+  tags: [compose_project, compose]
+
+- name: Allow Compose project firewall ports
+  community.general.ufw:
+    rule: allow
+    port: "{{ item.port | default(item.host | default(item.container | default(item))) }}"
+    proto: "{{ item.proto | default(item.protocol | default('tcp')) }}"
+  loop: "{{ compose_project_firewall_ports }}"
+  when: compose_project_firewall_enabled | bool
+  tags: [compose_project, firewall]
+
+- name: Start Compose project
+  community.docker.docker_compose_v2:
+    project_src: "{{ compose_project_dir }}"
+    state: "{{ compose_project_state }}"
+    pull: "{{ compose_project_pull }}"
+  tags: [compose_project, compose]

roles/compose_project/templates/.gitkeep

@@ -0,0 +1 @@
+

roles/docker_app/README.md

@@ -1,10 +1,12 @@
 # docker_app
 
-Shared implementation role for single-container Docker Compose applications.
+Shared adapter role for single-container Docker Compose applications.
 Application roles set `docker_app_*` variables and include this role.
 
+`docker_app` validates single-container app inputs and delegates the common
+Compose lifecycle to `compose_project`.
+
 It supports direct host-port publishing with UFW rules or Traefik routing via
 labels and a shared Docker network.
 
 Tags: `docker_app`, `docker`, `config`, `compose`, `firewall`.
-

roles/docker_app/defaults/main.yml

@@ -26,7 +26,9 @@ docker_app_traefik_entrypoint: "{{ nbops_traefik_entrypoint }}"
 docker_app_traefik_tls: "{{ nbops_traefik_tls }}"
 docker_app_traefik_middlewares: []
 docker_app_traefik_rule: "Host(`{{ docker_app_domain }}`)"
+docker_app_traefik_file_bind_address: "{{ nbops_traefik_file_bind_address }}"
 docker_app_labels: {}
 docker_app_ufw_ports: "{{ docker_app_ports }}"
 docker_app_env_template_src: env.j2
 docker_app_compose_template_src: compose.yaml.j2
+docker_app_compose_override_template_src: ""

roles/docker_app/handlers/.gitkeep

@@ -0,0 +1 @@
+

roles/docker_app/handlers/main.yml

@@ -1,6 +0,0 @@
----
-- name: restart docker app
-  community.docker.docker_compose_v2:
-    project_src: "{{ docker_app_dir }}"
-    state: restarted
-

roles/docker_app/tasks/main.yml

@@ -5,58 +5,18 @@
       - docker_app_image | length > 0
     fail_msg: "docker_app_image must be configured for {{ docker_app_name }}."
   tags: [docker_app]
-
-- name: Create Docker app directories
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"
-  loop: "{{ docker_app_directories }}"
+- name: Deploy Docker app Compose project
+  ansible.builtin.include_role:
+    name: compose_project
+  vars:
+    compose_project_dir: "{{ docker_app_dir }}"
+    compose_project_directories: "{{ docker_app_directories }}"
+    compose_project_env_template_src: "{{ docker_app_env_template_src }}"
+    compose_project_compose_template_src: "{{ docker_app_compose_template_src }}"
+    compose_project_override_template_src: "{{ docker_app_compose_override_template_src }}"
+    compose_project_create_proxy_network: "{{ docker_app_routing_mode == 'traefik' and docker_app_network_mode | length == 0 }}"
+    compose_project_proxy_network: "{{ docker_app_traefik_network }}"
+    compose_project_firewall_ports: "{{ docker_app_ufw_ports }}"
+    compose_project_firewall_enabled: "{{ docker_app_routing_mode in ['host', 'traefik_file'] }}"
+    compose_project_pull: "{{ docker_app_pull }}"
   tags: [docker_app]
-
-- name: Ensure proxy network exists
-  community.docker.docker_network:
-    name: "{{ docker_app_traefik_network }}"
-    state: present
-  when:
-    - docker_app_routing_mode == "traefik"
-    - docker_app_network_mode | length == 0
-  tags: [docker_app, docker]
-
-- name: Render Docker app environment
-  ansible.builtin.template:
-    src: "{{ docker_app_env_template_src }}"
-    dest: "{{ docker_app_dir }}/.env"
-    owner: root
-    group: root
-    mode: "0600"
-  no_log: true
-  tags: [docker_app, config]
-
-- name: Render Docker app Compose file
-  ansible.builtin.template:
-    src: "{{ docker_app_compose_template_src }}"
-    dest: "{{ docker_app_dir }}/compose.yaml"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart docker app
-  tags: [docker_app, compose]
-
-- name: Allow Docker app host ports
-  community.general.ufw:
-    rule: allow
-    port: "{{ item.host | default(item.container) }}"
-    proto: "{{ item.protocol | default('tcp') }}"
-  loop: "{{ docker_app_ufw_ports }}"
-  when: docker_app_routing_mode == "host"
-  tags: [docker_app, firewall]
-
-- name: Start Docker app
-  community.docker.docker_compose_v2:
-    project_src: "{{ docker_app_dir }}"
-    state: present
-    pull: "{{ docker_app_pull }}"
-  tags: [docker_app, compose]

roles/docker_app/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/docker_app/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/filebrowser_quantum/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/filebrowser_quantum/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/filebrowser_quantum/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/filebrowser_quantum/templates/compose.override.yaml.j2"
     docker_app_name: "{{ filebrowser_quantum_name }}"
     docker_app_dir: "{{ filebrowser_quantum_dir }}"
     docker_app_image: "{{ filebrowser_quantum_image }}"

roles/filebrowser_quantum/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/filebrowser_quantum/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/filebrowser_quantum/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `filebrowser_quantum` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/fiveetools/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/fiveetools/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/fiveetools/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/fiveetools/templates/compose.override.yaml.j2"
     docker_app_name: "{{ fiveetools_name }}"
     docker_app_dir: "{{ fiveetools_dir }}"
     docker_app_image: "{{ fiveetools_image }}"

roles/fiveetools/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/fiveetools/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/fiveetools/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `fiveetools` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/fiveetools/upstream/docker-compose.yml

@@ -0,0 +1,13 @@
+services:
+  5etools:
+    container_name: 5etools
+    image: jafner/5etools-docker
+    volumes:
+      - ./5etools-docker/htdocs:/usr/local/apache2/htdocs
+    ports:
+     - 5370:80/tcp
+    environment:
+     - IMG=TRUE # Set to TRUE to pull images from https://github.com/5etools-mirror-2/5etools-img (as a Git submodule)
+#     - OFFLINE_MODE=TRUE # Optional. Expects "TRUE" or "FALSE". Disables checking for new updates.
+     - DL_LINK=https://github.com/5etools-mirror-3/5etools-src.git
+     - IMG_LINK=https://github.com/5etools-mirror-3/5etools-img.git

roles/flaresolverr/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/flaresolverr/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/flaresolverr/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/flaresolverr/templates/compose.override.yaml.j2"
     docker_app_name: "{{ flaresolverr_name }}"
     docker_app_dir: "{{ flaresolverr_dir }}"
     docker_app_image: "{{ flaresolverr_image }}"

roles/flaresolverr/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/flaresolverr/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/flaresolverr/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `flaresolverr` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/gitea/handlers/.gitkeep

@@ -0,0 +1 @@
+

roles/gitea/handlers/main.yml

@@ -1,6 +0,0 @@
----
-- name: restart gitea
-  community.docker.docker_compose_v2:
-    project_src: "{{ gitea_dir }}"
-    state: restarted
-

roles/gitea/tasks/main.yml

@@ -8,41 +8,21 @@
     mode: "0755"
   tags: [gitea]
 
-- name: Render Gitea environment
-  ansible.builtin.template:
-    src: env.j2
-    dest: "{{ gitea_dir }}/.env"
-    owner: root
-    group: root
-    mode: "0600"
-  no_log: true
-  tags: [gitea, config]
-
-- name: Ensure Gitea proxy network exists
-  community.docker.docker_network:
-    name: "{{ gitea_traefik_network }}"
-    state: present
-  when: gitea_routing_mode == "traefik"
-  tags: [gitea, docker]
-
-- name: Render Gitea Compose file
-  ansible.builtin.template:
-    src: compose.yaml.j2
-    dest: "{{ gitea_dir }}/compose.yaml"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart gitea
-  tags: [gitea, compose]
-
-- name: Allow Gitea ports
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-  loop: "{{ gitea_tcp_ports }}"
-  when: gitea_routing_mode == "host"
-  tags: [gitea, firewall]
+- name: Deploy Gitea Compose project
+  ansible.builtin.include_role:
+    name: compose_project
+  vars:
+    compose_project_dir: "{{ gitea_dir }}"
+    compose_project_directories:
+      - "{{ gitea_dir }}"
+    compose_project_env_template_src: "{{ playbook_dir }}/../roles/gitea/templates/env.j2"
+    compose_project_compose_template_src: "{{ playbook_dir }}/../roles/gitea/templates/compose.yaml.j2"
+    compose_project_override_template_src: "{{ playbook_dir }}/../roles/gitea/templates/compose.override.yaml.j2"
+    compose_project_create_proxy_network: "{{ gitea_routing_mode == 'traefik' }}"
+    compose_project_proxy_network: "{{ gitea_traefik_network }}"
+    compose_project_firewall_ports: "{{ gitea_tcp_ports }}"
+    compose_project_firewall_enabled: "{{ gitea_routing_mode in ['host', 'traefik_file'] }}"
+  tags: [gitea]
 
 - name: Allow Gitea SSH port when published behind Traefik
   community.general.ufw:
@@ -53,9 +33,3 @@
     - gitea_routing_mode == "traefik"
     - gitea_publish_ssh | bool
   tags: [gitea, firewall]
-
-- name: Start Gitea
-  community.docker.docker_compose_v2:
-    project_src: "{{ gitea_dir }}"
-    state: present
-  tags: [gitea, compose]

roles/gitea/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  gitea: {}
+

roles/gitea/templates/compose.yaml.j2

@@ -3,10 +3,10 @@ services:
     image: {{ gitea_image }}
     restart: unless-stopped
     env_file: .env
-{% if gitea_routing_mode == "host" or gitea_publish_ssh | bool %}
+{% if gitea_routing_mode in ["host", "traefik_file"] or gitea_publish_ssh | bool %}
     ports:
-{% if gitea_routing_mode == "host" %}
-      - "{{ gitea_http_port }}:3000"
+{% if gitea_routing_mode in ["host", "traefik_file"] %}
+      - "{{ nbops_traefik_file_bind_address if gitea_routing_mode == 'traefik_file' else '0.0.0.0' }}:{{ gitea_http_port }}:3000"
 {% endif %}
 {% if gitea_publish_ssh | bool %}
       - "{{ gitea_ssh_port }}:22"

roles/gitea/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `gitea` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/gitea_act_runner/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/gitea_act_runner/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/gitea_act_runner/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/gitea_act_runner/templates/compose.override.yaml.j2"
     docker_app_name: "{{ gitea_act_runner_name }}"
     docker_app_dir: "{{ gitea_act_runner_dir }}"
     docker_app_image: "{{ gitea_act_runner_image }}"

roles/gitea_act_runner/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/gitea_act_runner/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/gitea_act_runner/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `gitea_act_runner` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/grafana/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/grafana/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/grafana/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/grafana/templates/compose.override.yaml.j2"
     docker_app_name: "{{ grafana_name }}"
     docker_app_dir: "{{ grafana_dir }}"
     docker_app_image: "{{ grafana_image }}"

roles/grafana/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/grafana/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/grafana/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `grafana` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/grafana_renderer/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/grafana_renderer/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/grafana_renderer/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/grafana_renderer/templates/compose.override.yaml.j2"
     docker_app_name: "{{ grafana_renderer_name }}"
     docker_app_dir: "{{ grafana_renderer_dir }}"
     docker_app_image: "{{ grafana_renderer_image }}"

roles/grafana_renderer/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/grafana_renderer/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/grafana_renderer/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `grafana_renderer` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/grafana_renderer/upstream/docker-compose.yml

@@ -0,0 +1,5 @@
+services:
+  renderer:
+    container_name: grafana-renderer
+    image: grafana/grafana-image-renderer:latest
+    restart: unless-stopped

roles/homarr/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/homarr/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/homarr/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/homarr/templates/compose.override.yaml.j2"
     docker_app_name: "{{ homarr_name }}"
     docker_app_dir: "{{ homarr_dir }}"
     docker_app_image: "{{ homarr_image }}"

roles/homarr/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/homarr/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/homarr/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `homarr` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/immich/handlers/.gitkeep

@@ -0,0 +1 @@
+

roles/immich/handlers/main.yml

@@ -1,6 +0,0 @@
----
-- name: restart immich
-  community.docker.docker_compose_v2:
-    project_src: "{{ immich_dir }}"
-    state: restarted
-

roles/immich/tasks/main.yml

@@ -11,44 +11,19 @@
     - "{{ immich_upload_location }}"
   tags: [immich]
 
-- name: Render Immich environment
-  ansible.builtin.template:
-    src: env.j2
-    dest: "{{ immich_dir }}/.env"
-    owner: root
-    group: root
-    mode: "0600"
-  no_log: true
-  tags: [immich, config]
-
-- name: Ensure Immich proxy network exists
-  community.docker.docker_network:
-    name: "{{ immich_traefik_network }}"
-    state: present
-  when: immich_routing_mode == "traefik"
-  tags: [immich, docker]
-
-- name: Render Immich Compose file
-  ansible.builtin.template:
-    src: compose.yaml.j2
-    dest: "{{ immich_dir }}/compose.yaml"
-    owner: root
-    group: root
-    mode: "0644"
-  notify: restart immich
-  tags: [immich, compose]
-
-- name: Allow Immich ports
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-  loop: "{{ immich_tcp_ports }}"
-  when: immich_routing_mode == "host"
-  tags: [immich, firewall]
-
-- name: Start Immich
-  community.docker.docker_compose_v2:
-    project_src: "{{ immich_dir }}"
-    state: present
-  tags: [immich, compose]
+- name: Deploy Immich Compose project
+  ansible.builtin.include_role:
+    name: compose_project
+  vars:
+    compose_project_dir: "{{ immich_dir }}"
+    compose_project_directories:
+      - "{{ immich_dir }}"
+      - "{{ immich_upload_location }}"
+    compose_project_env_template_src: "{{ playbook_dir }}/../roles/immich/templates/env.j2"
+    compose_project_compose_template_src: "{{ playbook_dir }}/../roles/immich/templates/compose.yaml.j2"
+    compose_project_override_template_src: "{{ playbook_dir }}/../roles/immich/templates/compose.override.yaml.j2"
+    compose_project_create_proxy_network: "{{ immich_routing_mode == 'traefik' }}"
+    compose_project_proxy_network: "{{ immich_traefik_network }}"
+    compose_project_firewall_ports: "{{ immich_tcp_ports }}"
+    compose_project_firewall_enabled: "{{ immich_routing_mode in ['host', 'traefik_file'] }}"
+  tags: [immich]

roles/immich/templates/compose.override.yaml.j2

@@ -0,0 +1,6 @@
+services:
+  immich-server: {}
+  immich-machine-learning: {}
+  redis: {}
+  database: {}
+

roles/immich/templates/compose.yaml.j2

@@ -3,9 +3,9 @@ services:
     image: {{ immich_server_image }}
     restart: unless-stopped
     env_file: .env
-{% if immich_routing_mode == "host" %}
+{% if immich_routing_mode in ["host", "traefik_file"] %}
     ports:
-      - "{{ immich_http_port }}:2283"
+      - "{{ nbops_traefik_file_bind_address if immich_routing_mode == 'traefik_file' else '0.0.0.0' }}:{{ immich_http_port }}:2283"
 {% endif %}
 {% if immich_routing_mode == "traefik" %}
     # internal HTTP service port: 2283; not published on the Docker host

roles/immich/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `immich` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/ipv6nat/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/ipv6nat/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/ipv6nat/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/ipv6nat/templates/compose.override.yaml.j2"
     docker_app_name: "{{ ipv6nat_name }}"
     docker_app_dir: "{{ ipv6nat_dir }}"
     docker_app_image: "{{ ipv6nat_image }}"

roles/ipv6nat/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/ipv6nat/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/ipv6nat/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `ipv6nat` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.

roles/jellyfin/tasks/main.yml

@@ -5,6 +5,7 @@
   vars:
     docker_app_env_template_src: "{{ playbook_dir }}/../roles/jellyfin/templates/env.j2"
     docker_app_compose_template_src: "{{ playbook_dir }}/../roles/jellyfin/templates/compose.yaml.j2"
+    docker_app_compose_override_template_src: "{{ playbook_dir }}/../roles/jellyfin/templates/compose.override.yaml.j2"
     docker_app_name: "{{ jellyfin_name }}"
     docker_app_dir: "{{ jellyfin_dir }}"
     docker_app_image: "{{ jellyfin_image }}"

roles/jellyfin/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  {{ docker_app_name }}: {}
+

roles/jellyfin/templates/compose.yaml.j2

@@ -17,10 +17,10 @@ services:
 {% if docker_app_env | length > 0 %}
     env_file: .env
 {% endif %}
-{% if docker_app_routing_mode == "host" and docker_app_ports | length > 0 %}
+{% if docker_app_routing_mode in ["host", "traefik_file"] and docker_app_ports | length > 0 %}
     ports:
 {% for port in docker_app_ports %}
-      - "{{ port.bind | default('0.0.0.0') }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
+      - "{{ port.bind | default((docker_app_traefik_file_bind_address if docker_app_routing_mode == 'traefik_file' else '0.0.0.0')) }}:{{ port.host | default(port.container) }}:{{ port.container }}{% if port.protocol | default('tcp') != 'tcp' %}/{{ port.protocol }}{% endif %}"
 {% endfor %}
 {% endif %}
 {% if docker_app_routing_mode == "traefik" and docker_app_service_port %}

roles/jellyfin/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `jellyfin` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.