Refactor OpenProject role:

- Add CPU, memory and PID limits to all services in config/main.yml to prevent OOM
- Replace old LDAP admin bootstrap with new 02_admin.yml using OPENPROJECT_ADMINISTRATOR_* vars
- Standardize variable names (uppercase convention)
- Fix HTTPS/HSTS port check (443 instead of 433)
- Allow docker_restart_policy override in base.yml.j2
- Cleanup redundant LDAP admin runner in 01_ldap.yml
See: https://chatgpt.com/share/68d40c6e-ab9c-800f-a4a0-d9338d8c1b32

roles/web-app-openproject/templates/Dockerfile.j2

@@ -1,4 +1,4 @@
-FROM {{ openproject_image }}:{{ openproject_version }}
+FROM {{ OPENPROJECT_IMAGE }}:{{ OPENPROJECT_VERSION }}
 
 # If installing a local plugin (using `path:` in the `Gemfile.plugins` above),
 # you will have to copy the plugin code into the container here and use the

roles/web-app-openproject/templates/docker-compose.yml.j2

@@ -2,20 +2,22 @@
 x-op-app: &app
   logging:
     driver: journald
-  image: {{ openproject_custom_image }}
+  image: {{ OPENPROJECT_CUSTOM_IMAGE }}
   {{ lookup('template', 'roles/docker-container/templates/build.yml.j2') | indent(2) }}
 
 {% include 'roles/docker-compose/templates/base.yml.j2' %}
 
   cache:
-    image: "{{ openproject_cache_image}}:{{ openproject_cache_version }}"
-    container_name: {{ openproject_cache_name }}
+{% set service_name = 'cache' %}
+    image: "{{ OPENPROJECT_CACHE_IMAGE}}:{{ OPENPROJECT_CACHE_VERSION }}"
+    container_name: {{ OPENPROJECT_CACHE_CONTAINER }}
 {% include 'roles/docker-container/templates/base.yml.j2' %}
 
   proxy:
+{% set service_name = 'proxy' %}
 {% include 'roles/docker-container/templates/base.yml.j2' %}
-    image: {{ openproject_custom_image }}
-    container_name: {{ openproject_proxy_name }}
+    image: {{ OPENPROJECT_CUSTOM_IMAGE }}
+    container_name: {{ OPENPROJECT_PROXY_CONTAINER }}
     pull_policy: never
     command: "./docker/prod/proxy"
     ports:
@@ -26,13 +28,14 @@ x-op-app: &app
       - web
     volumes:
       - "data:/var/openproject/assets"
-      - "{{ openproject_dummy_volume }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
+      - "{{ OPENPROJECT_DUMMY_VOLUME }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
 
   web:
     <<: *app
+{% set service_name = 'web' %}
 {% include 'roles/docker-container/templates/base.yml.j2' %}
     command: "./docker/prod/web"
-    container_name: {{ openproject_web_name }}
+    container_name: {{ OPENPROJECT_WEB_CONTAINER }}
 {% include 'roles/docker-container/templates/networks.yml.j2' %}
 {% include 'roles/docker-container/templates/depends_on/dmbs_incl.yml.j2' %}
       cache:
@@ -44,13 +47,14 @@ x-op-app: &app
 {% include 'roles/docker-container/templates/healthcheck/curl.yml.j2' %}
     volumes:
       - "data:/var/openproject/assets"
-      - "{{ openproject_dummy_volume }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
-      
+      - "{{ OPENPROJECT_DUMMY_VOLUME }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
+
+{% set service_name = 'worker' %}
   worker:
     <<: *app
 {% include 'roles/docker-container/templates/base.yml.j2' %}
     command: "./docker/prod/worker"
-    container_name: {{ openproject_worker_name }}
+    container_name: {{ OPENPROJECT_WORKER_CONTAINER }}
 {% include 'roles/docker-container/templates/networks.yml.j2' %}
 {% include 'roles/docker-container/templates/depends_on/dmbs_incl.yml.j2' %}
       cache:
@@ -59,14 +63,14 @@ x-op-app: &app
         condition: service_started
     volumes:
       - "data:/var/openproject/assets"
-      - "{{ openproject_dummy_volume }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
-
+      - "{{ OPENPROJECT_DUMMY_VOLUME }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
 
   cron:
     <<: *app
+{% set service_name = 'cron' %}
 {% include 'roles/docker-container/templates/base.yml.j2' %}
     command: "./docker/prod/cron"
-    container_name: {{ openproject_cron_name }}
+    container_name: {{ OPENPROJECT_CRON_CONTAINER }}
 {% include 'roles/docker-container/templates/networks.yml.j2' %}
 {% include 'roles/docker-container/templates/depends_on/dmbs_incl.yml.j2' %}
       cache:
@@ -75,24 +79,22 @@ x-op-app: &app
         condition: service_started
     volumes:
       - "data:/var/openproject/assets"
-      - "{{ openproject_dummy_volume }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
+      - "{{ OPENPROJECT_DUMMY_VOLUME }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
 
   seeder:
     <<: *app
+{% set service_name = 'seeder' %}
+{% set docker_restart_policy = 'on-failure' %}
+{% include 'roles/docker-container/templates/base.yml.j2' %}
     command: "./docker/prod/seeder"
-    container_name: {{ openproject_seeder_name }}
-    env_file:
-      - "{{ docker_compose.files.env }}"
-    logging:
-      driver: journald
-    restart: on-failure
+    container_name: {{ OPENPROJECT_SEEDER_CONTAINER }}
 {% include 'roles/docker-container/templates/networks.yml.j2' %}
     volumes:
       - "data:/var/openproject/assets"
-      - "{{ openproject_dummy_volume }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
+      - "{{ OPENPROJECT_DUMMY_VOLUME }}:/var/openproject/pgdata" # This mount is unnecessary and just done to prevent anonymous volumes
 
 {% include 'roles/docker-compose/templates/volumes.yml.j2' %}
   data:
-    name: {{ openproject_volume }}
+    name: {{ OPENPROJECT_VOLUME }}
 
 {% include 'roles/docker-compose/templates/networks.yml.j2' %}

roles/web-app-openproject/templates/env.j2

@@ -6,11 +6,11 @@
 # Please refer to our documentation to see all possible variables:
 #   https://www.openproject.org/docs/installation-and-operations/configuration/environment/
 #
-OPENPROJECT_HTTPS={{ WEB_PORT == 433 | string | lower }}
+OPENPROJECT_HTTPS={{ WEB_PORT == 443 | string | lower }}
 OPENPROJECT_HOST__NAME={{ domains | get_domain(application_id) }}
 OPENPROJECT_RAILS__RELATIVE__URL__ROOT=
 IMAP_ENABLED=false
-OPENPROJECT_HSTS={{ WEB_PORT == 433 | string | lower }}
+OPENPROJECT_HSTS={{ WEB_PORT == 443 | string | lower }}
 RAILS_CACHE_STORE: "memcache"
 OPENPROJECT_CACHE__MEMCACHE__SERVER: "cache:11211"
 OPENPROJECT_RAILS__RELATIVE__URL__ROOT: ""