feat: fix gvisor for radicale, add isolated networks for jellyfin / radicale

roles/jellyfin/files/jellyfin.container

@@ -3,8 +3,8 @@ Description=jellyfin container
 
 [Container]
 ContainerName=jellyfin
-Image=ghcr.io/jellyfin/jellyfin
+Image=ghcr.io/jellyfin/jellyfin:latest
-Network=frontend.network
+Network=jellyfin.network
 Volume=/srv/jellyfin/config:/config:Z
 Volume=/srv/jellyfin/cache:/cache:Z
 Volume=/srv/jellyfin/media:/media:z,ro

roles/jellyfin/files/jellyfin.network

@@ -0,0 +1,3 @@
+[Network]
+Internal=true
+Options=isolate=true

roles/jellyfin/tasks/main.yaml

@@ -36,6 +36,14 @@
     group: root
     mode: '0644'
 
+- name: Copy over jellyfin.network file
+  ansible.builtin.copy:
+    src: ./files/jellyfin.network
+    dest: /etc/containers/systemd/jellyfin.network
+    owner: root
+    group: root
+    mode: '0644'
+
 - name: Copy over jellyfin nginx config
   ansible.builtin.copy:
     src: ./files/jellyfin.conf

roles/nginx/templates/nginx.container.j2

@@ -9,6 +9,7 @@ Image=ghcr.io/nginxinc/nginx-unprivileged:mainline-alpine-slim
 PublishPort=80:8080
 PublishPort=443:8443
 Network=frontend.network
+Network={{ nginx_dependent_service }}.network
 Volume=/srv/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
 Volume=/srv/nginx/conf.d:/etc/nginx/conf.d:ro
 Volume=/srv/certs:/etc/nginx/ssl:Z

roles/radicale/files/radicale.container

@@ -6,19 +6,19 @@ ContainerName=radicale
 RunInit=true
 DropCapability=ALL
 AddCapability=SETUID SETGID CHOWN KILL
-Image=docker.io/tomsquest/docker-radicale
+Image=docker.io/tomsquest/docker-radicale:latest
-Network=frontend.network
+Network=radicale.network
 Volume=/srv/radicale/config:/config:Z,ro
 Volume=/srv/radicale/data:/data:Z
-#PodmanArgs=--runtime runsc --security-opt label:disable
+PodmanArgs=--runtime runsc --security-opt label:disable
-#Label=disable
+Label=disable
 AutoUpdate=registry
 
 [Install]
 WantedBy=multi-user.target default.target
 
 [Service]
-TasksMax=50
+TasksMax=100
-MemoryHigh=256M
+MemoryHigh=512M
 Restart=always
 

roles/radicale/files/radicale.network

@@ -0,0 +1,3 @@
+[Network]
+Internal=true
+Options=isolate=true

roles/radicale/tasks/main.yaml

@@ -24,6 +24,14 @@
     group: root
     mode: '0644'
 
+- name: Copy over radicale.network file
+  ansible.builtin.copy:
+    src: ./files/radicale.network
+    dest: /etc/containers/systemd/radicale.network
+    owner: root
+    group: root
+    mode: '0644'
+    
 - name: Copy over radicale config
   ansible.builtin.copy:
     src: ./files/config