tasks: Regularly clean up leftover containers and outdated images

ansible/aws/README.md

@@ -59,7 +59,8 @@ If you run more than one at a time, set a custom host name with `-e hostname=coc
 
 Webhook setup
 -------------
-AWS runs our primary webhook. Deploy or update it with:
+Our primary webhook runs in CentOS CI. If that goes down, we can bring up a
+fallback in AWS. Deploy or update it with:
 
     ansible-playbook -i inventory aws/launch-webhook.yml
 

ansible/roles/tasks-systemd/cockpituous-janitor.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Clean up cockpituous cruft
+
+[Service]
+Type=oneshot
+# remove leftover containers
+ExecStart=/bin/sh -ec 'podman ps -q --filter status=exited | xargs -r podman rm'
+# remove old task images
+ExecStart=/usr/bin/podman image prune --all --force

ansible/roles/tasks-systemd/cockpituous-janitor.timer

@@ -0,0 +1,7 @@
+[Unit]
+Description=Regularly clean up cockpituous cruft
+
+[Timer]
+OnBootSec=1h
+OnUnitActiveSec=24h
+AccuracySec=15min

ansible/roles/tasks-systemd/tasks/main.yml

@@ -145,6 +145,18 @@
           '--env=COCKPIT_GITHUB_TOKEN_FILE=/run/secrets/github-token',
       ]
 
+- name: Create janitor service
+  copy:
+    src: "{{ role_path }}/cockpituous-janitor.service"
+    dest: /etc/systemd/system/cockpituous-janitor.service
+    mode: preserve
+
+- name: Create janitor timer
+  copy:
+    src: "{{ role_path }}/cockpituous-janitor.timer"
+    dest: /etc/systemd/system/cockpituous-janitor.timer
+    mode: preserve
+
 - name: Set up systemd service for cockpit/tasks
   shell: |
     export INSTANCES={{ instances | default(1) }}

tasks/install-service

@@ -35,6 +35,7 @@ cat <<EOF > /etc/systemd/system/[email protected]
 Description=Cockpit Tasks %i
 Requires=podman.socket
 After=podman.socket
+Wants=cockpituous-janitor.timer
 
 [Service]
 Restart=always