feat: fix gvisor for radicale, add isolated networks for jellyfin / radicale

roles/radicale/files/radicale.container

@@ -6,19 +6,19 @@ ContainerName=radicale
 RunInit=true
 DropCapability=ALL
 AddCapability=SETUID SETGID CHOWN KILL
-Image=docker.io/tomsquest/docker-radicale
-Network=frontend.network
+Image=docker.io/tomsquest/docker-radicale:latest
+Network=radicale.network
 Volume=/srv/radicale/config:/config:Z,ro
 Volume=/srv/radicale/data:/data:Z
-#PodmanArgs=--runtime runsc --security-opt label:disable
-#Label=disable
+PodmanArgs=--runtime runsc --security-opt label:disable
+Label=disable
 AutoUpdate=registry
 
 [Install]
 WantedBy=multi-user.target default.target
 
 [Service]
-TasksMax=50
-MemoryHigh=256M
+TasksMax=100
+MemoryHigh=512M
 Restart=always
 

roles/radicale/files/radicale.network

@@ -0,0 +1,3 @@
+[Network]
+Internal=true
+Options=isolate=true

roles/radicale/tasks/main.yaml

@@ -24,6 +24,14 @@
     group: root
     mode: '0644'
 
+- name: Copy over radicale.network file
+  ansible.builtin.copy:
+    src: ./files/radicale.network
+    dest: /etc/containers/systemd/radicale.network
+    owner: root
+    group: root
+    mode: '0644'
+    
 - name: Copy over radicale config
   ansible.builtin.copy:
     src: ./files/config