add container_rabbitmq

active/container_rabbitmq/compose/README.md

@@ -0,0 +1,3 @@
+# Compose
+
+Put your compose.yaml here.

active/container_rabbitmq/compose/compose.yaml

@@ -0,0 +1,11 @@
+services:
+  rabbitmq:
+    container_name: rabbitmq
+    restart: always
+    image: docker.io/rabbitmq:3-management
+    ports:
+      - 15672:15672
+      - 5672:5672
+    env_file: /home/rabbitmq/rabbitmq.env
+    volumes:
+      - /home/rabbitmq/data:/var/lib/rabbitmq

active/container_rabbitmq/example.env

@@ -0,0 +1,2 @@
+RABBITMQ_DEFAULT_USER=user
+RABBITMQ_DEFAULT_PASS=password

active/container_rabbitmq/foobar.md

@@ -0,0 +1,196 @@
+# Podman rabbitmq
+
+- [Podman rabbitmq](#podman-rabbitmq)
+  - [Setup rabbitmq Project](#setup-rabbitmq-project)
+  - [Install rabbitmq](#install-rabbitmq)
+    - [Create the rabbitmq user](#create-the-rabbitmq-user)
+    - [Generate the rabbitmq tls certs](#generate-the-rabbitmq-tls-certs)
+    - [Write the rabbitmq compose spec](#write-the-rabbitmq-compose-spec)
+      - [A Note on Volumes](#a-note-on-volumes)
+    - [Convert rabbitmq compose spec to quadlets](#convert-rabbitmq-compose-spec-to-quadlets)
+    - [Create any container-mounted directories](#create-any-container-mounted-directories)
+    - [Start and enable your systemd quadlet](#start-and-enable-your-systemd-quadlet)
+    - [Alias rabbitmqctl](#alias-rabbitmqctl)
+    - [Expose rabbitmq](#expose-rabbitmq)
+      - [firewalld](#firewalld)
+  - [Backup rabbitmq](#backup-rabbitmq)
+  - [Upgrade rabbitmq](#upgrade-rabbitmq)
+    - [Upgrade Quadlets](#upgrade-quadlets)
+  - [Uninstall](#uninstall)
+  - [Notes](#notes)
+    - [SELinux](#selinux)
+
+## Setup rabbitmq Project
+
+- [x] Copy and rename this folder to active/container_rabbitmq
+- [x] Find and replace rabbitmq with the name of the service.
+- [ ] Create the rootless user to run the podman containers
+- [ ] Write the compose.yaml spec for your service
+- [ ] Convert the compose.yaml spec to a quadlet
+- [ ] Install the quadlet on the podman server
+- [ ] Expose the quadlet service
+- [ ] Install a backup service and timer
+
+## Install rabbitmq
+
+### Create the rabbitmq user
+
+```bash
+# SSH into your podman server as root
+useradd rabbitmq
+loginctl enable-linger $(id -u rabbitmq)
+systemctl --user --machine=rabbitmq@.host enable podman-restart
+systemctl --user --machine=rabbitmq@.host enable --now podman.socket
+mkdir -p /home/rabbitmq/.config/containers/systemd
+```
+
+### Generate the rabbitmq tls certs
+
+We'll use tls authentication to ensure encryption between our servers and clients.
+
+<https://www.rabbitmq.com/docs/ssl#automated-certificate-generation-transcript>
+
+```bash
+ssh rabbitmq
+git clone https://github.com/rabbitmq/tls-gen tls-gen
+cd tls-gen/basic
+# private key password
+make PASSWORD=bunnies
+make verify
+make info
+ls -l ./result
+```
+
+### Write the rabbitmq compose spec
+
+Edit the compose.yaml at active/container_rabbitmq/compose/compose.yaml
+
+#### A Note on Volumes
+
+Named volumes are stored at `/home/rabbitmq/.local/share/containers/storage/volumes/`.
+
+### Convert rabbitmq compose spec to quadlets
+
+Run the following to convert a compose.yaml into the various `.container` files for systemd:
+
+```bash
+# Generate the systemd service
+podman run \
+--security-opt label=disable \
+--rm \
+-v $(pwd)/active/container_rabbitmq/compose:/compose \
+-v $(pwd)/active/container_rabbitmq/quadlets:/quadlets \
+quay.io/k9withabone/podlet \
+-f /quadlets \
+-i \
+--overwrite \
+compose /compose/compose.yaml
+
+# Copy the files to the server
+export PODMAN_SERVER=rabbitmq
+scp -r active/container_rabbitmq/quadlets/. $PODMAN_SERVER:/home/rabbitmq/.config/containers/systemd/
+ssh $PODMAN_SERVER chown -R rabbitmq:rabbitmq /home/rabbitmq/.config/containers/systemd/
+```
+
+### Create any container-mounted directories
+
+SSH into your podman server as root:
+
+```bash
+machinectl shell rabbitmq@
+podman unshare
+# /var/lib/rabbitmq
+mkdir data
+# Chown to the namespaced user with UID 1000
+# This will be some really obscure UID outside the namespace
+# This will also solve most permission denied errors
+chown -R 1000:1000 some_volume
+```
+
+### Start and enable your systemd quadlet
+
+SSH into your podman server as root:
+
+```bash
+machinectl shell rabbitmq@
+systemctl --user daemon-reload
+systemctl --user restart rabbitmq
+# Enable auto-update service which will pull new container images automatically every day
+systemctl --user enable --now podman-auto-update.timer
+```
+
+### Alias rabbitmqctl
+
+We'll use containers to run rabbitmqctl, so we'll add an alias to our `.bashrc`
+to make things easier:
+
+```bash
+alias rabbitmqctl='podman exec -it rabbitmq rabbitmqctl'
+```
+
+### Expose rabbitmq
+
+1. If you need a domain, follow the [DDNS instructions](/active/container_ddns/ddns.md#install-a-new-ddns-service)
+2. For a web service, follow the [Caddy instructions](/active/container_caddy/caddy.md#adding-a-new-caddy-record)
+3. Finally, follow your OS's guide for opening ports via its firewall service.
+
+#### firewalld
+
+```bash
+# command to get current active zone and default zone
+firewall-cmd --get-active-zones
+firewall-cmd --get-default-zone
+
+# command to open 443 on tcp
+firewall-cmd --permanent --zone=<zone> --add-port=443/tcp
+
+# command to open 80 and 443 on tcp and udp
+firewall-cmd --permanent --zone=<zone> --add-port={80,443}/{tcp,udp}
+
+# command to list available services and then open http and https
+firewall-cmd --get-services
+firewall-cmd --permanent --zone=<zone> --add-service={http,https}
+```
+
+## Backup rabbitmq
+
+Follow the [Borg Backup instructions](/active/systemd_borg/borg.md#set-up-a-client-for-backup)
+
+## Upgrade rabbitmq
+
+### Upgrade Quadlets
+
+Upgrades should be a repeat of [writing the compose spec](#convert-rabbitmq-compose-spec-to-quadlets) and [installing the quadlets](#start-and-enable-your-systemd-quadlet)
+
+```bash
+export PODMAN_SERVER=
+scp -r quadlets/. $PODMAN_SERVER$:/home/rabbitmq/.config/containers/systemd/
+ssh rabbitmq systemctl --user daemon-reload
+ssh rabbitmq systemctl --user restart rabbitmq
+```
+
+## Uninstall
+
+```bash
+# Stop the user's services
+systemctl --user disable podman-restart
+podman container stop --all
+systemctl --user disable --now podman.socket
+systemctl --user disable --now podman-auto-update.timer
+
+# Delete the user (this won't delete their home directory)
+# userdel might spit out an error like:
+# userdel: user rabbitmq is currently used by process 591255
+# kill those processes and try again
+userdel rabbitmq
+```
+
+## Notes
+
+### SELinux
+
+<https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/>
+
+:z allows a container to share a mounted volume with all other containers.
+
+:Z allows a container to reserve a mounted volume and prevents any other container from accessing.

active/container_rabbitmq/quadlets/README.md

@@ -0,0 +1,3 @@
+# Quadlets
+
+Put your quadlets here.

active/container_rabbitmq/quadlets/rabbitmq.container

@@ -0,0 +1,12 @@
+[Container]
+ContainerName=rabbitmq
+EnvironmentFile=/srv/rabbitmq/rabbitmq.env
+Image=docker.io/rabbitmq:3-management
+PublishPort=15672:15672
+PublishPort=5672:5672
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=default.target

active/container_rabbitmq/rabbitmq.md

@@ -0,0 +1,108 @@
+# Podman rabbitmq
+
+- [Podman rabbitmq](#podman-rabbitmq)
+  - [Setup rabbitmq Project](#setup-rabbitmq-project)
+  - [Install rabbitmq](#install-rabbitmq)
+    - [Expose rabbitmq](#expose-rabbitmq)
+      - [firewalld](#firewalld)
+  - [Backup rabbitmq](#backup-rabbitmq)
+  - [Upgrade rabbitmq](#upgrade-rabbitmq)
+    - [Upgrade Quadlets](#upgrade-quadlets)
+  - [Uninstall](#uninstall)
+  - [Notes](#notes)
+    - [SELinux](#selinux)
+
+## Setup rabbitmq Project
+
+- [x] Copy and rename this folder to active/container_foobar
+- [x] Find and replace rabbitmq with the name of the service.
+- [ ] Create the rootless user to run the podman containers
+- [ ] Write the compose.yaml spec for your service
+- [ ] Convert the compose.yaml spec to a quadlet
+- [ ] Install the quadlet on the podman server
+- [ ] Expose the quadlet service
+- [ ] Install a backup service and timer
+
+## Install rabbitmq
+
+<https://hub.docker.com/_/rabbitmq/>
+
+```bash
+ssh rabbitmq mkdir /srv/rabbitmq
+scp active/container_rabbitmq/example.env rabbitmq:/srv/rabbitmq/rabbitmq.env
+scp active/container_rabbitmq/rabbitmq-compose.yaml rabbitmq:
+ssh rabbitmq docker compose -f rabbitmq-compose.yaml up
+```
+
+List queues
+
+```bash
+docker exec -it rabbitmq rabbitmqctl list_queues
+```
+
+### Expose rabbitmq
+
+1. If you need a domain, follow the [DDNS instructions](/active/container_ddns/ddns.md#install-a-new-ddns-service)
+2. For a web service, follow the [Caddy instructions](/active/container_caddy/caddy.md#adding-a-new-caddy-record)
+3. Finally, follow your OS's guide for opening ports via its firewall service.
+
+#### firewalld
+
+```bash
+# command to get current active zone and default zone
+firewall-cmd --get-active-zones
+firewall-cmd --get-default-zone
+
+# command to open 443 on tcp
+firewall-cmd --permanent --zone=<zone> --add-port=443/tcp
+
+# command to open 80 and 443 on tcp and udp
+firewall-cmd --permanent --zone=<zone> --add-port={80,443}/{tcp,udp}
+
+# command to list available services and then open http and https
+firewall-cmd --get-services
+firewall-cmd --permanent --zone=<zone> --add-service={http,https}
+```
+
+## Backup rabbitmq
+
+Follow the [Borg Backup instructions](/active/systemd_borg/borg.md#set-up-a-client-for-backup)
+
+## Upgrade rabbitmq
+
+### Upgrade Quadlets
+
+Upgrades should be a repeat of [writing the compose spec](#convert-rabbitmq-compose-spec-to-quadlets) and [installing the quadlets](#start-and-enable-your-systemd-quadlet)
+
+```bash
+export PODMAN_SERVER=
+scp -r quadlets/. $PODMAN_SERVER$:/home/rabbitmq/.config/containers/systemd/
+ssh rabbitmq systemctl --user daemon-reload
+ssh rabbitmq systemctl --user restart rabbitmq
+```
+
+## Uninstall
+
+```bash
+# Stop the user's services
+systemctl --user disable podman-restart
+podman container stop --all
+systemctl --user disable --now podman.socket
+systemctl --user disable --now podman-auto-update.timer
+
+# Delete the user (this won't delete their home directory)
+# userdel might spit out an error like:
+# userdel: user rabbitmq is currently used by process 591255
+# kill those processes and try again
+userdel rabbitmq
+```
+
+## Notes
+
+### SELinux
+
+<https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/>
+
+:z allows a container to share a mounted volume with all other containers.
+
+:Z allows a container to reserve a mounted volume and prevents any other container from accessing.