init

ansible/roles/comentario/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+install_dir: /opt/comentario
+port: 8060
+ssl_cert: /etc/letsencrypt/live/tiararodney.com/fullchain.pem
+ssl_key: /etc/letsencrypt/live/tiararodney.com/privkey.pem

ansible/roles/comentario/meta/main.yml

@@ -0,0 +1,6 @@
+---
+dependencies:
+    -
+        role: docker
+    -
+        role: apache

ansible/roles/comentario/tasks/deploy-comentario.yml

@@ -0,0 +1,52 @@
+---
+-
+    name: Ensure install directory exists
+    file:
+        path: "{{ install_dir }}"
+        state: directory
+        mode: "0755"
+
+-
+    name: Deploy secrets file
+    template:
+        src: secrets.yaml.j2
+        dest: "{{ install_dir }}/secrets.yaml"
+        mode: "0600"
+
+-
+    name: Deploy docker-compose file
+    template:
+        src: docker-compose.yml.j2
+        dest: "{{ install_dir }}/docker-compose.yml"
+
+-
+    name: Start comentario stack
+    include_role:
+        name: docker
+        tasks_from: start-compose
+    vars:
+        compose_project_dir: "{{ install_dir }}"
+
+-
+    name: Deploy comentario vhost
+    include_role:
+        name: apache
+        tasks_from: deploy-reverse-proxy
+    vars:
+        vhost_name: comentario
+        server_name: "{{ domain }}"
+        backend_port: "{{ port }}"
+
+-
+    name: Deploy comentario backup script
+    include_role:
+        name: docker
+        tasks_from: deploy-backup
+    vars:
+        backup_name: comentario
+        backup_hook_dir: /etc/restic/pre-backup.d
+        backup_volumes:
+            - comentario_comentario_postgres_data
+        backup_files:
+            - "{{ install_dir }}/docker-compose.yml"
+            - "{{ install_dir }}/secrets.yaml"

ansible/roles/comentario/tasks/main.yml

@@ -0,0 +1,4 @@
+---
+-
+    name: Deploy comentario
+    ansible.builtin.include_tasks: deploy-comentario.yml

ansible/roles/comentario/tasks/restore.yml

@@ -0,0 +1,41 @@
+---
+-
+    name: Set backup staging directory
+    set_fact:
+        _comentario_backup_dir: "{{ backup_staging_dir | default('/var/backups') }}/comentario"
+
+-
+    name: Stop comentario stack
+    community.docker.docker_compose_v2:
+        project_src: "{{ install_dir }}"
+        state: absent
+
+-
+    name: Restore docker-compose file
+    copy:
+        src: "{{ _comentario_backup_dir }}/docker-compose.yml"
+        dest: "{{ install_dir }}/docker-compose.yml"
+        remote_src: yes
+        mode: "0600"
+
+-
+    name: Restore secrets file
+    copy:
+        src: "{{ _comentario_backup_dir }}/secrets.yaml"
+        dest: "{{ install_dir }}/secrets.yaml"
+        remote_src: yes
+        mode: "0600"
+
+-
+    name: Restore comentario postgres volume
+    command: >
+        docker run --rm
+        -v comentario_comentario_postgres_data:/data
+        -v {{ _comentario_backup_dir }}:/backup
+        alpine sh -c "rm -rf /data/* && tar xzf /backup/comentario_postgres_data.tar.gz -C /data"
+
+-
+    name: Start comentario stack
+    community.docker.docker_compose_v2:
+        project_src: "{{ install_dir }}"
+        state: present

ansible/roles/comentario/templates/docker-compose.yml.j2

@@ -0,0 +1,26 @@
+services:
+  postgres:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_DB: comentario
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    restart: unless-stopped
+
+  comentario:
+    image: registry.gitlab.com/comentario/comentario:{{ version }}
+    ports:
+      - "127.0.0.1:{{ port }}:80"
+    environment:
+      BASE_URL: https://{{ domain }}
+      SECRETS_FILE: /secrets.yaml
+    volumes:
+      - ./secrets.yaml:/secrets.yaml:ro
+    depends_on:
+      - postgres
+    restart: unless-stopped
+
+volumes:
+  postgres_data:

ansible/roles/comentario/templates/secrets.yaml.j2

@@ -0,0 +1,27 @@
+postgres:
+  host: postgres
+  port: 5432
+  database: comentario
+  username: postgres
+  password: postgres
+{% if smtp_host is defined %}
+smtp:
+  host: {{ smtp_host }}
+  port: {{ smtp_port | default(587) }}
+  username: {{ smtp_username }}
+  password: {{ smtp_password }}
+  from: {{ smtp_from | default(smtp_username) }}
+{% endif %}
+{% if oauth_client_id is defined %}
+idp:
+  oidc:
+    - id: authentik
+      name: Authentik
+      url: {{ oauth_issuer_url }}
+      key: {{ oauth_client_id }}
+      secret: {{ oauth_client_secret }}
+      scopes:
+        - openid
+        - profile
+        - email
+{% endif %}