Refactor garage role for better stability and defaults

6 files changed, 85 insertions, 54 deletions

diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml
index e747f7cf..aa66bcf5 100644
--- a/host_vars/rpi5.local.yml
+++ b/host_vars/rpi5.local.yml
diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example
index b8a86f63..a4360b37 100644
--- a/host_vars/rpi5.local.yml.example
+++ b/host_vars/rpi5.local.yml.example
@@ -76,13 +76,16 @@ grafana_dashboards:
       - key: "${DS__VICTORIAMETRICS}"
         value: "prometheus"
   - name: "garage"
+    # yamllint disable-line rule:line-length
     url: "https://git.deuxfleurs.fr/Deuxfleurs/garage/raw/branch/main/script/telemetry/grafana-garage-dashboard-prometheus.json"
     datasource_mappings:
       - key: "${DS_prometheus}"
         value: "prometheus"
 
 backup_device: "PARTLABEL=backup"
-
 garage_rpc_secret: "changeme"
 garage_access_key_id: "GK_changeme"
 garage_secret_access_key: "changeme"
+garage_bucket: "restic"
+garage_data_dir: "/backup/garage/data"
+garage_meta_dir: "/backup/garage/meta"
diff --git a/roles/garage/defaults/main.yml b/roles/garage/defaults/main.yml
index 40e7610a..1b1235a0 100644
--- a/roles/garage/defaults/main.yml
+++ b/roles/garage/defaults/main.yml
@@ -1,8 +1,8 @@
 ---
 garage_version: "2.3.0"
 garage_capacity: "100G"
-garage_data_dir: "/backup/garage/data"
-garage_meta_dir: "/backup/garage/meta"
+garage_data_dir: "/var/garage/data"
+garage_meta_dir: "/var/garage/meta"
 garage_rpc_secret: "{{ 'changeme' | hash('sha256') }}"
 garage_s3_port: "3900"
 garage_admin_port: "3903"
diff --git a/roles/garage/tasks/main.yml b/roles/garage/tasks/main.yml
index 087343b8..8427235e 100644
--- a/roles/garage/tasks/main.yml
+++ b/roles/garage/tasks/main.yml
@@ -35,30 +35,35 @@
         shell: "/usr/sbin/nologin"
         create_home: false
 
-    - name: "Create garage directories"
+    - name: "Create garage data and meta directories"
       ansible.builtin.file:
-        path: "{{ item.path }}"
+        path: "{{ item }}"
         state: "directory"
-        owner: "{{ item.owner }}"
+        owner: "garage"
         group: "garage"
         mode: "0750"
       loop:
-        - { path: "/etc/garage", owner: "root" }
-        - { path: "{{ garage_data_dir }}", owner: "garage" }
-        - { path: "{{ garage_meta_dir }}", owner: "garage" }
+        - "{{ garage_data_dir }}"
+        - "{{ garage_meta_dir }}"
 
-    - name: "Configure garage"
+    - name: "Deploy garage configuration"
       ansible.builtin.template:
-        src: "{{ item.src }}"
-        dest: "{{ item.dest }}"
+        src: "garage.toml.j2"
+        dest: "/etc/garage.toml"
         owner: "root"
-        group: "{{ item.group }}"
-        mode: "{{ item.mode }}"
-        no_log: true
-        notify: "Restart garage"
-      loop:
-        - { src: "grage.toml.j2", dest: "/etc/garage/garage.toml", group: "garage", mode: "0640" }
-        - { src: "garage.service.j2", dest: "/etc/systemd/system/garage.service", group: "root", mode: "0644" }
+        group: "garage"
+        mode: "0640"
+      no_log: true
+      notify: "Restart garage"
+
+    - name: "Deploy garage systemd service"
+      ansible.builtin.template:
+        src: "garage.service.j2"
+        dest: "/etc/systemd/system/garage.service"
+        owner: "root"
+        group: "root"
+        mode: "0644"
+      notify: "Restart garage"
 
     - name: "Start and enable garage"
       ansible.builtin.systemd_service:
@@ -67,22 +72,66 @@
         enabled: true
         daemon_reload: true
 
+- name: "Check layout readiness"
+  become: true
+  ansible.builtin.uri:
+    url: "http://127.0.0.1:{{ garage_admin_port }}/health"
+    status_code: [200, 503]
+  register: garage_health
+  changed_when: false
+
+- name: "Provision garage cluster layout"
+  become: true
+  when: garage_health.status != 200
+  block:
+    - name: "Get node id"
+      ansible.builtin.command:
+        cmd: "garage node id -q"
+      register: garage_node_id
+      changed_when: false
+
+    - name: "Assign node to layout"
+      ansible.builtin.command:
+        cmd: >-
+          garage layout assign
+          --zone local --capacity {{ garage_capacity }}
+          {{ garage_node_id.stdout.split('@')[0] }}
+      changed_when: true
+
+    - name: "Apply layout"
+      ansible.builtin.command:
+        cmd: "garage layout apply --version 1"
+      changed_when: true
+
+    - name: "Wait for layout to be ready"
+      ansible.builtin.uri:
+        url: "http://127.0.0.1:{{ garage_admin_port }}/health"
+        status_code: 200
+      register: garage_health_wait
+      until: garage_health_wait.status == 200
+      retries: 30
+      delay: 1
+
 - name: "Provision garage bucket and key"
   become: true
   block:
-    - name: "Deploy provision script"
-      ansible.builtin.template:
-        src: "garage-provision.sh.j2"
-        dest: "/etc/garage/provision.sh"
-        owner: "root"
-        group: "garage"
-        mode: "0750"
+    - name: "Create bucket"
+      ansible.builtin.command:
+        cmd: "garage bucket create {{ garage_bucket }}"
+      register: garage_bucket_create
+      changed_when: garage_bucket_create.rc == 0
+      failed_when: garage_bucket_create.rc != 0 and 'already exists' not in garage_bucket_create.stderr
+
+    - name: "Import key"
+      ansible.builtin.command:
+        cmd: "garage key import --yes -n {{ garage_bucket }} {{ garage_access_key_id }} {{ garage_secret_access_key }}"
+      register: garage_key_import
+      changed_when: garage_key_import.rc == 0
+      failed_when: garage_key_import.rc != 0 and 'already exists' not in garage_key_import.stderr
       no_log: true
 
-    # Script is idempotent via internal state checks but always reports changed
-    - name: "Run provision script"
+    - name: "Allow key on bucket"
       ansible.builtin.command:
-        cmd: "/etc/garage/provision.sh"
-      changed_when: true
-      tags:
-        - molecule-idempotence-notest
+        cmd: "garage bucket allow --read --write --owner --key {{ garage_access_key_id }} {{ garage_bucket }}"
+      changed_when: false
+      no_log: true
diff --git a/roles/garage/templates/garage-provision.sh.j2 b/roles/garage/templates/garage-provision.sh.j2
deleted file mode 100644
index 1360c486..00000000
--- a/roles/garage/templates/garage-provision.sh.j2
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/bash
-set -e
-
-GARAGE="garage -c /etc/garage/garage.toml"
-
-NODE_ID=$($GARAGE node id -q | cut -d@ -f1)
-if ! $GARAGE layout show 2>/dev/null | grep -q "$NODE_ID"; then
-    $GARAGE layout assign --zone dc1 --capacity {{ garage_capacity }} "$NODE_ID"
-    $GARAGE layout apply --version 1
-    curl -sf --retry 30 --retry-delay 1 --retry-all-errors http://127.0.0.1:{{ garage_admin_port }}/health
-fi
-
-if ! $GARAGE bucket list | grep -q "{{ garage_bucket }}"; then
-    $GARAGE bucket create {{ garage_bucket }}
-fi
-
-if ! $GARAGE key list | grep -q "restic"; then
-    $GARAGE key import --yes -n restic {{ garage_access_key_id }} {{ garage_secret_access_key }}
-fi
-
-$GARAGE bucket allow --read --write --owner --key {{ garage_access_key_id }} {{ garage_bucket }}
diff --git a/roles/garage/templates/garage.service.j2 b/roles/garage/templates/garage.service.j2
index f3257e21..01186455 100644
--- a/roles/garage/templates/garage.service.j2
+++ b/roles/garage/templates/garage.service.j2
@@ -5,7 +5,7 @@ After=network-online.target
 
 [Service]
 Type=simple
-ExecStart=/usr/local/bin/garage -c /etc/garage/garage.toml server
+ExecStart=/usr/local/bin/garage server
 User=garage
 Group=garage
 Restart=on-failure