Add podman quadlet installation method (#602)
Signed-off-by: Lukas Zapletal <lzap+git@redhat.com>
This commit is contained in:
Lukáš Zapletal
GitHub
parent
a5b8d053c7
commit
28af281af9
|
|
@ -99,3 +99,113 @@ loginctl enable-linger
|
||||||
podman auto-update
|
podman auto-update
|
||||||
podman image prune -f
|
podman image prune -f
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## Podman via systemd
|
||||||
|
|
||||||
|
This method is suitable for systems which come with Podman version 5.x or higher and systemd (e.g. Fedora, CentOS Stream 9 or clones). Instructions are written for root-less mode, do not run the commands as root since paths are different. Ensure that SELinux is in enforcing mode for maximum security.
|
||||||
|
|
||||||
|
Create a new volume for database:
|
||||||
|
|
||||||
|
podman volume create invidious-db
|
||||||
|
|
||||||
|
Start a temporary container:
|
||||||
|
|
||||||
|
podman run --rm -it --name invidious-init -v invidious-db:/var/lib/postgresql/data:Z -p 5432:5432 -e POSTGRES_DB=invidious -e POSTGRES_USER=kemal -e POSTGRES_PASSWORD=kemal docker.io/library/postgres:14
|
||||||
|
|
||||||
|
In another terminal, migrate the database:
|
||||||
|
|
||||||
|
export PGPASSWORD=kemal
|
||||||
|
for F in channels videos channel_videos users session_ids nonces annotations playlists playlist_videos; do
|
||||||
|
curl -s https://raw.githubusercontent.com/iv-org/invidious/refs/heads/master/config/sql/$F.sql | \
|
||||||
|
psql -h localhost -p 5432 -U kemal invidious
|
||||||
|
done
|
||||||
|
|
||||||
|
Shutdown the temporary container, it is no longer needed. Create a database volume unit:
|
||||||
|
|
||||||
|
cat > ~/.config/containers/systemd/invidious-db.volume <<EOF
|
||||||
|
[Volume]
|
||||||
|
VolumeName=invidious-db
|
||||||
|
EOF
|
||||||
|
|
||||||
|
And a database container:
|
||||||
|
|
||||||
|
cat > ~/.config/containers/systemd/invidious-db.container <<EOF
|
||||||
|
[Container]
|
||||||
|
ContainerName=invidious-db
|
||||||
|
Environment=POSTGRES_DB=invidious POSTGRES_USER=kemal POSTGRES_PASSWORD=kemal
|
||||||
|
Image=docker.io/library/postgres:14
|
||||||
|
HealthCmd=pg_isready -h localhost -p 5432 -U kemal -d invidious
|
||||||
|
Notify=healthy
|
||||||
|
Pod=invidious.pod
|
||||||
|
Volume=invidious-db.volume:/var/lib/postgresql/data:Z
|
||||||
|
EOF
|
||||||
|
|
||||||
|
Create a helper container:
|
||||||
|
|
||||||
|
cat > ~/.config/containers/systemd/invidious-sig-helper.container <<EOF
|
||||||
|
[Container]
|
||||||
|
ContainerName=invidious-sig-helper
|
||||||
|
Environment=RUST_LOG=info
|
||||||
|
Image=quay.io/invidious/inv-sig-helper:latest
|
||||||
|
Exec=--tcp 0.0.0.0:12999
|
||||||
|
Pod=invidious.pod
|
||||||
|
EOF
|
||||||
|
|
||||||
|
Generate your `VISITOR_DATA` an `PO_TOKEN` secrets. For more information about these, read the information dialog above.
|
||||||
|
|
||||||
|
podman run quay.io/invidious/youtube-trusted-session-generator
|
||||||
|
|
||||||
|
Set those secrets as temporary environmental variables, also generate a random string for HMAC secret:
|
||||||
|
|
||||||
|
HMAC=$(openssl rand -base64 21)
|
||||||
|
VISITOR_DATA="ABCDEF%3D%3D" # notsecret
|
||||||
|
PO_TOKEN="MpOIfiljfsdljds-Lljfsdk-ojrdjXVs==" # notsecret
|
||||||
|
|
||||||
|
In the same terminal where you defined the environmental variables, create new environmental config file:
|
||||||
|
|
||||||
|
cat > ~/.config/containers/systemd/invidious.env <<EOF
|
||||||
|
INVIDIOUS_DATABASE_URL="postgres://kemal:kemal@invidious-db:5432/invidious"
|
||||||
|
#INVIDIOUS_CHECK_TABLES=true
|
||||||
|
#INVIDIOUS_DOMAIN="inv.example.com"
|
||||||
|
INVIDIOUS_SIGNATURE_SERVER="invidious-sig-helper:12999"
|
||||||
|
INVIDIOUS_VISITOR_DATA="$VISITOR_DATA"
|
||||||
|
INVIDIOUS_PO_TOKEN="$PO_TOKEN"
|
||||||
|
INVIDIOUS_HMAC_KEY="$HMAC"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
From now on, if you need to change configuration just edit the generated file `~/.config/containers/systemd/invidious.env`. Now, create invidious container unit:
|
||||||
|
|
||||||
|
cat > ~/.config/containers/systemd/invidious.container <<EOF
|
||||||
|
[Container]
|
||||||
|
ContainerName=invidious
|
||||||
|
EnvironmentFile=%h/.config/containers/systemd/invidious.env
|
||||||
|
Image=quay.io/invidious/invidious:latest
|
||||||
|
Pod=invidious.pod
|
||||||
|
[Unit]
|
||||||
|
After=invidious-db.service
|
||||||
|
EOF
|
||||||
|
|
||||||
|
And finally, create pod unit. Note only port 3000 is exposed, do not expose other ports!
|
||||||
|
|
||||||
|
cat > ~/.config/containers/systemd/invidious.pod <<EOF
|
||||||
|
[Pod]
|
||||||
|
PodName=invidious
|
||||||
|
PublishPort=3000:3000
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target default.target
|
||||||
|
EOF
|
||||||
|
|
||||||
|
Systemd units are generated on-the-fly during `daemon-reload` command, but before that let's check syntax with quadlet generator. Note, you need Podman version 5.0 or higher, older versions will not work:
|
||||||
|
|
||||||
|
/usr/libexec/podman/quadlet -dryrun -user
|
||||||
|
|
||||||
|
Reload systemd daemon. Keep in mind you need to do this command every time you change a unit file, you can change the environmental file freely tho.
|
||||||
|
|
||||||
|
systemctl --user daemon-reload
|
||||||
|
|
||||||
|
And the whole application can be now started:
|
||||||
|
|
||||||
|
systemctl --user start invidious-pod
|
||||||
|
|
||||||
|
Keep in mind that generated units cannot be enabled using `systemctl enable`, the main pod will be enabled automatically. If you do not like this behavior, remove the `WantedBy` line from `invidious.pod`.
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue