add line to infra_gateway

Created by: jedmund

Drops line (the SvelteKit start page that will eventually replace Glance) into the existing infra_gateway stack. Lives at line.atelier.house for now; the plan is to move it to the apex atelier.house once it's proven, displacing Glance.

Image is built on the server from a clone of the line repo, mirroring the album_sort pattern. No ghcr push needed.

What's in here

• roles/infra_gateway/defaults/main.yml — new line_* block: port 5180, repo + branch + source path, subdomain line, derived URLs for OIDC issuer + redirect. Also adds line.atelier.house to the DDClient subdomain list.
• roles/infra_gateway/templates/compose.yaml.j2 — new line service mirroring the Glance pattern: on the proxy network, Traefik labels for line.{{ traefik_domain }} with letsencrypt, build: from the server-side clone, bind-mount ./config/line/data to /data for SQLite.
• roles/infra_gateway/templates/env/line.env.j2 — env file: DATABASE_URL=/data/line.db, OIDC_ISSUER from pocketid_app_url, plus the four OIDC_* vars.
• roles/infra_gateway/tasks/main.yml — ./config/line/data added to the dirs loop, line added to the env-files loop, and a new ansible.builtin.git task that pulls the line repo to {{ docker_base_path }}/{{ stack_name }}/source/line. Stack deploy now uses build: always.
• roles/infra_gateway/handlers/main.yml — restart handler also gets build: always so handler-triggered rebuilds use fresh source.
• README.md — documents the two new vault entries (line_oidc_client_id, line_oidc_client_secret), notes the server-side build, and updates the role description.

Before this can deploy, do these two things

1. Register an OIDC client in PocketID at https://id.atelier.house:

   • Redirect URI: https://line.atelier.house/auth/callback (must match exactly)
   • Note the client ID and secret.

2. Add the secrets to vault:

   make edit-vault FILE=group_vars/infra_gateway/vault.yml

   Append:

   line_oidc_client_id: "..."
   line_oidc_client_secret: "..."

Deploy

make deploy-infra-gateway

The git task pulls latest main of the line repo, then build: always rebuilds the image. First run is slow (Docker cache empty); subsequent rebuilds reuse layers. DDClient will pick up line.atelier.house and create the Cloudflare DNS record.

Redeploys the whole gateway stack (Traefik, PocketID, etc.). Compose-v2 is idempotent so existing services aren't disrupted, but blast radius is wider than ideal. Adding --tags line support is separate cleanup.

Notes / decisions

• Server-side build mirrors the album_sort role exactly. To pin to a specific commit/tag instead of main, set line_version in defaults.
• No TinyAuth in front. Line has its own PocketID OIDC integration so the forward-auth proxy isn't needed.
• Glance left alone. When you're ready to swap them, change line_subdomain (or add a second host to the Traefik rule) so line takes over atelier.house and start.atelier.house, then drop the Glance service.