AlmaLinux/RHEL 9 fixes

examples/vars.yml

@@ -54,3 +54,6 @@ pictrs_safety_env_vars:
   - secret_key: "{{ pictrs_safety_secret }}"
   - SCAN_BYPASS_THRESHOLD: 10
   - MISSING_WORKER_THRESHOLD: 5
+
+# docker-compose default resolver is 127.0.0.11 while podman-compose is 10.89.0.1
+nginx_internal_resolver: "{{ '127.0.0.11' if ansible_facts['os_family'] != 'RedHat' else '10.89.0.1' }}"

lemmy-almalinux.yml

@@ -129,6 +129,15 @@
       tags:
         - firewalld
 
+    - name: Adjust SELinux to allow HTTPD scripts and modules to connect to the network
+      ansible.posix.seboolean:
+        name: httpd_can_network_connect
+        state: true
+        persistent: true
+      tags:
+        - nginx
+        - selinux
+
     - name: Start and enable nginx.service
       ansible.builtin.systemd:
         name: nginx.service

templates/docker-compose.yml

@@ -53,7 +53,7 @@ services:
 {% endfor %}
 {% endif %}
     volumes:
-      - ./volumes/lemmy-ui/extra_themes:/app/extra_themes
+      - ./volumes/lemmy-ui/extra_themes:/app/extra_themes:Z
     depends_on:
       - lemmy
     restart: always
@@ -99,7 +99,7 @@ services:
 {% endif %}
     volumes:
       - ./volumes/postgres:/var/lib/postgresql/data:Z
-      - ./customPostgresql.conf:/etc/postgresql.conf
+      - ./customPostgresql.conf:/etc/postgresql.conf:Z
     restart: always
     command: postgres -c config_file=/etc/postgresql.conf
     shm_size: 1g

templates/nginx_internal.conf

@@ -7,7 +7,7 @@ events {
 http {
     # Docker internal DNS IP so we always get the newer containers without having to 
     # restart/reload the docker container / nginx configuration
-    resolver 127.0.0.11 valid=5s;
+    resolver {{ nginx_internal_resolver }} valid=5s;
     # set the real_ip when from docker internal ranges. Ensuring our internal nginx
     # container can always see the correct ips in the logs
     set_real_ip_from 172.0.0.0/8;