refactor(quadlets): repurpose arcane and oci-proxy from redis placeholders

Replace the placeholder redis deployment in the arcane module with the
ghcr.io/ofkm/arcane image (env-based secrets, haproxy routing, podman
socket mount) and convert oci-proxy into a tecnativa/docker-socket-proxy
container exposing a locked-down subset of the engine API.

quadlets/modules/arcane/main.tf

@@ -12,25 +12,57 @@ variable "ssh_private_key_path" {
   type = string
 }
 
-module "redis" {
+variable "server_domain" {
+  type = string
+}
+
+resource "random_password" "encryption_key" {
+  length  = 32
+  special = false
+}
+
+resource "random_password" "jwt_secret" {
+  length  = 32
+  special = false
+}
+
+module "arcane" {
   source = "../quadlet-app"
   wait_on = var.wait_on
 
   server_ip            = var.server_ip
   ssh_private_key_path = var.ssh_private_key_path
 
-  app_name = "redis"
+  app_name = "arcane"
-  image    = "docker.io/redis:7-alpine"
+  image    = "ghcr.io/ofkm/arcane:latest"
-  ports    = ["6379:6379"]
+  ports    = ["3552:3552"]
-  volumes  = ["/opt/storage/data/redis:/data:Z"]
+  volumes = ["/opt/storage/data/arcane:/app/data:Z", "/run/user/1001/podman/podman.sock:/var/run/docker.sock:Z"]
-  command  = ["redis-server", "--appendonly", "yes"]
+  #volumes = ["/opt/storage/data/arcane:/app/data:Z"]
+
+  environment = {
+    #DOCKER_HOST = "tcp://localhost:2375"
+    APP_URL = "https://${var.server_domain}"
+    ENCRYPTION_KEY = random_password.encryption_key.result
+    JWT_SECRET = random_password.jwt_secret.result
+  }
+
+  haproxy_services = [
+    {
+      name   = "arcane"
+      domain = "${var.server_domain}"
+      port   = "3552"
+      host   = "127.0.0.1"
+      tls    = false
+    },
+  ]
+
 }
 
 output "app_urls" {
-  value = module.redis.app_urls
+  value = module.arcane.app_urls
 }
 
 output "installed" {
   value = true
-  depends_on = [module.redis.installed]
+  depends_on = [module.arcane.installed]
-}
+}

quadlets/modules/oci-proxy/main.tf

@@ -12,25 +12,51 @@ variable "ssh_private_key_path" {
   type = string
 }
 
-module "redis" {
+module "oci-proxy" {
   source = "../quadlet-app"
   wait_on = var.wait_on
 
   server_ip            = var.server_ip
   ssh_private_key_path = var.ssh_private_key_path
 
-  app_name = "redis"
+  app_name = "oci-proxy"
-  image    = "docker.io/redis:7-alpine"
+  image    = "docker.io/tecnativa/docker-socket-proxy"
-  ports    = ["6379:6379"]
+  ports    = ["2375:2375"]
-  volumes  = ["/opt/storage/data/redis:/data:Z"]
+  volumes  = ["/run/user/1001/podman/podman.sock:/var/run/docker.sock:Z"]
-  command  = ["redis-server", "--appendonly", "yes"]
+
+  environment = {
+    LOG_LEVEL = "info"
+    EVENTS = 1
+    PING = 1
+    VERSION = 1
+    AUTH = 0
+    SECRETS = 0
+    POST = 1
+    BUILD = 0
+    COMMIT = 0
+    CONFIGS = 0
+    CONTAINERS = 1
+    DISTRIBUTION = 0
+    EXEC = 0
+    IMAGES = 1
+    INFO = 1
+    NETWORKS = 1
+    NODES = 0
+    PLUGINS = 0
+    SERVICES = 1
+    SESSION = 0
+    SWARM = 0
+    SYSTEM = 0
+    TASKS = 1
+    VOLUMES = 1
+  }
 }
 
 output "app_urls" {
-  value = module.redis.app_urls
+  value = module.oci-proxy.app_urls
 }
 
 output "installed" {
   value = true
-  depends_on = [module.redis.installed]
+  depends_on = [module.oci-proxy.installed]
 }