add platform application fizzy

iac/ansible/roles/authentik/templates/docker-compose.yml.j2

@@ -17,7 +17,7 @@ services:
     volumes:
       - /mnt/cephfs/authentik/data/db:/var/lib/postgresql/data
     environment:
-      POSTGRES_PASSWORD: "{{ pg_pass }}"
+      POSTGRES_PASSWORD: "{{ authentik_pg_pass }}"
       POSTGRES_USER: "{{ pg_user | default('authentik') }}"
       POSTGRES_DB: "{{ pg_db | default('authentik') }}"
     networks:
@@ -48,7 +48,7 @@ services:
       AUTHENTIK_POSTGRESQL__HOST: postgresql
       AUTHENTIK_POSTGRESQL__USER: "{{ pg_user | default('authentik') }}"
       AUTHENTIK_POSTGRESQL__NAME: "{{ pg_db | default('authentik') }}"
-      AUTHENTIK_POSTGRESQL__PASSWORD: "{{ pg_pass }}"
+      AUTHENTIK_POSTGRESQL__PASSWORD: "{{ authentik_pg_pass }}"
       AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
     volumes:
       - /mnt/cephfs/authentik/data/media:/media
@@ -83,7 +83,7 @@ services:
       AUTHENTIK_POSTGRESQL__HOST: postgresql
       AUTHENTIK_POSTGRESQL__USER: "{{ pg_user | default('authentik') }}"
       AUTHENTIK_POSTGRESQL__NAME: "{{ pg_db | default('authentik') }}"
-      AUTHENTIK_POSTGRESQL__PASSWORD: "{{ pg_pass }}"
+      AUTHENTIK_POSTGRESQL__PASSWORD: "{{ authentik_pg_pass }}"
     # `user: root` and the docker socket volume are optional.
     # See more for the docker socket integration here:
     # https://goauthentik.io/docs/outposts/integrations/docker

iac/ansible/roles/authentik/vars/main.yml

@@ -1,10 +1,8 @@
 ---
 authentik_image: "ghcr.io/goauthentik/server"
 authentik_tag: "2025.6.3"
-authentik_secret_key: ""
 
 pg_user: "authentik"
-pg_pass: ""
 pg_db: "authentik"
 
 traefik_net: "traefik_public"

iac/ansible/roles/fizzy/defaults/main.yml

@@ -0,0 +1,6 @@
+fizzy_secret_key_base: ""
+
+fizzy_from_address: "system@avicenna.hamburg"
+fizzy_smtp_address: "smtp.postmarkapp.com"
+fizzy_smtp_username: ""
+fizzy_smtp_password: ""

iac/ansible/roles/fizzy/tasks/main.yml

@@ -0,0 +1,42 @@
+- name: FIZZY | Ensure data directories
+  ansible.builtin.file:
+    path: '{{ data_dir }}/{{ item.path }}'
+    state: directory
+    owner: 1000
+    group: 1000
+    mode: '0750'
+    recurse: no
+  loop:
+    - { path: 'data' }
+    - { path: 'data/storage'}
+  delegate_to: "{{ groups['managers'][0] }}"
+  run_once: true
+
+# - name: FIZZY | Ensure DB data directories
+#   ansible.builtin.file:
+#     path: "{{ data_dir }}/data/db"
+#     state: directory
+#     # Postgres Alpine nutzt UID 70 (postgres). 
+#     # Bei Debian-Images wäre es 999.
+#     owner: 70 
+#     group: 70
+#     mode: '0700'
+#     recurse: no
+#   delegate_to: "{{ groups['managers'][0] }}"
+
+- name: FIZZY | Generate Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: '{{ data_dir }}/fizzy.yml'
+    mode: 0644
+  run_once: true
+  delegate_to: "{{ groups['managers'][0] }}"
+
+- name: FIZZY | Deploy stack
+  community.docker.docker_stack:
+    state: present
+    name: fizzy
+    compose:
+      - '{{ data_dir }}/fizzy.yml'
+  delegate_to: "{{ groups['managers'][0] }}"
+  run_once: true

iac/ansible/roles/fizzy/templates/docker-compose.yml.j2

@@ -0,0 +1,32 @@
+networks:
+  {{ traefik_public_net }}:
+    external: true
+
+services:
+  web:
+    image: ghcr.io/basecamp/fizzy:main
+    restart: unless-stopped
+    environment:
+      - SECRET_KEY_BASE=abcdefabcdef
+      # - TLS_DOMAIN={{ fizzy_domain }}
+      - BASE_URL=https://{{ fizzy_domain }}
+      - MAILER_FROM_ADDRESS={{ fizzy_from_address }}
+      - SMTP_ADDRESS={{ fizzy_smtp_address }}
+      - SMTP_USERNAME={{ fizzy_smtp_username }}
+      - SMTP_PASSWORD={{ fizzy_smtp_password }}
+      - VAPID_PRIVATE_KEY=myvapidprivatekey
+      - VAPID_PUBLIC_KEY=myvapidpublickey
+    volumes:
+      - {{ data_dir }}/data/storage:/rails/storage
+    networks:
+      - {{ traefik_public_net }}
+    deploy:
+      mode: replicated
+      replicas: 1
+      labels:
+        - "traefik.enable=true"
+        - "traefik.docker.network={{ traefik_public_net }}"
+        - "traefik.http.routers.fizzy.rule=Host(`{{ fizzy_domain }}`)"
+        - "traefik.http.routers.fizzy.entrypoints=https"
+        - "traefik.http.routers.fizzy.tls.certresolver=main"
+        - "traefik.http.services.fizzy.loadbalancer.server.port=80"

iac/ansible/roles/fizzy/vars/main.yml

@@ -0,0 +1,3 @@
+data_dir: "{{ ceph_volume }}/fizzy"
+subdomain: fizzy
+fizzy_domain: "{{ subdomain }}.{{ main_domain }}"