Initial listmonk role: eom.dev newsletter on Kubernetes

listmonk v6.2.0 with PostgreSQL 17, Dex login for listed admins, delivery through postfix.eom.dev, Catppuccin public pages, Altcha captcha and a double opt-in "eom.dev" list. Database-held settings are converged by an idempotent SQL script, tested against v6.2.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 20:17:30 -05:00
commit 22a7ffe676
15 changed files with 801 additions and 0 deletions
@@ -0,0 +1,90 @@
+# SPDX-License-Identifier: MIT-0
+---
+- name: Validate required secrets
+  ansible.builtin.assert:
+    that:
+      - listmonk_db_password | length >= 16
+      - listmonk_admin_password | length >= 8
+      - listmonk_smtp_password | length > 0
+      - not listmonk_oidc_enabled | bool or listmonk_oidc_client_secret | length > 0
+    fail_msg: >-
+      Set listmonk_db_password (16+ chars), listmonk_admin_password (8+),
+      listmonk_smtp_password and listmonk_oidc_client_secret in Vault.
+    quiet: true
+
+- name: Create namespace
+  kubernetes.core.k8s:
+    kubeconfig: "{{ listmonk_kubeconfig | default(omit, true) }}"
+    context: "{{ listmonk_kube_context | default(omit, true) }}"
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: "{{ listmonk_namespace }}"
+  when: listmonk_create_namespace | bool
+
+- name: Store credentials
+  kubernetes.core.k8s:
+    kubeconfig: "{{ listmonk_kubeconfig | default(omit, true) }}"
+    context: "{{ listmonk_kube_context | default(omit, true) }}"
+    state: present
+    apply: true
+    definition: "{{ lookup('ansible.builtin.template', 'secret.yml.j2') | from_yaml }}"
+  no_log: true
+
+- name: Deploy PostgreSQL
+  kubernetes.core.k8s:
+    kubeconfig: "{{ listmonk_kubeconfig | default(omit, true) }}"
+    context: "{{ listmonk_kube_context | default(omit, true) }}"
+    state: present
+    apply: true
+    definition: "{{ lookup('ansible.builtin.template', 'postgres.yml.j2') | from_yaml_all | list }}"
+    wait: true
+    wait_timeout: "{{ listmonk_wait_timeout }}"
+
+- name: Deploy listmonk
+  kubernetes.core.k8s:
+    kubeconfig: "{{ listmonk_kubeconfig | default(omit, true) }}"
+    context: "{{ listmonk_kube_context | default(omit, true) }}"
+    state: present
+    apply: true
+    definition: "{{ lookup('ansible.builtin.template', 'listmonk.yml.j2') | from_yaml_all | list }}"
+    wait: true
+    wait_timeout: "{{ listmonk_wait_timeout }}"
+
+# Settings, Dex admins and lists live in listmonk's database, not its config.
+- name: Converge database-held configuration
+  kubernetes.core.k8s_exec:
+    kubeconfig: "{{ listmonk_kubeconfig | default(omit, true) }}"
+    context: "{{ listmonk_kube_context | default(omit, true) }}"
+    namespace: "{{ listmonk_namespace }}"
+    pod: "{{ listmonk_name }}-db-0"
+    container: postgres
+    command: >-
+      sh -c 'echo {{ lookup('ansible.builtin.template', 'configure.sql.j2') | b64encode }}
+      | base64 -d | psql -U listmonk -d listmonk -qtA'
+  register: listmonk_configure
+  changed_when: listmonk_configure.stdout_lines | map('int') | sum > 0
+  no_log: true
+
+- name: Restart listmonk to load the new settings
+  kubernetes.core.k8s:
+    kubeconfig: "{{ listmonk_kubeconfig | default(omit, true) }}"
+    context: "{{ listmonk_kube_context | default(omit, true) }}"
+    state: patched
+    kind: Deployment
+    namespace: "{{ listmonk_namespace }}"
+    name: "{{ listmonk_name }}"
+    definition:
+      spec:
+        template:
+          metadata:
+            annotations:
+              kubectl.kubernetes.io/restartedAt: "{{ now(utc=true).isoformat() }}"
+    wait: true
+    wait_condition:
+      type: Available
+      status: "True"
+    wait_timeout: "{{ listmonk_wait_timeout }}"
+  when: listmonk_configure is changed