new major update

roles/init-server/tasks/contingent/pkg/podman.yml

@@ -9,19 +9,49 @@
   ansible.builtin.shell:
     cmd: "echo {{ ansible_user }}"
   register: current_user
+- name: Checking if ZFS filesystem is present
+  ansible.builtin.shell:
+    cmd: "findmnt -D | awk '{ print $2 }' | tail -n +2"
+  register: fs_result
+- name: Logging presence of ZFS filesystem
+  when: "'zfs' in fs_result.stdout"
+  ansible.builtin.set_fact:
+    zfs_present: true
+- name: Logging absence of ZFS filesystem
+  when: "'zfs' not in fs_result.stdout"
+  ansible.builtin.set_fact:
+    zfs_present: false
+- name: Configuring ZFS support
+  when: zfs_present
+  block:
+    - name: Getting available pools
+      ansible.builtin.shell:
+        cmd: "zpool list | awk '{ print $1 }' | tail -n +2"
+      register: zpools
+    - name: Turning available pools into list
+      ansible.builtin.set_fact:
+        zpool_list: "{{ zpools | replace('\n', ' ') | split(' ') }}"
+    - name: Allowing choice of zpool
+      ansible.builtin.pause:
+        prompt: "Type preferred zpool from available (i.e., {{ zpool_list | join(', ') }})"
+      register: preferred_zpool
 - name: Ensuring user namespace support is enabled 
   become: true
   ansible.posix.sysctl:
     name: kernel.unprivileged_userns_clone
     value: "1"
+    sysctl_file: /etc/sysctl.d/10-security.conf
     sysctl_set: true
+    reload: true
     state: present
 - name: Ensuring user namespace support is enabled 
   become: true
   ansible.posix.sysctl:
     name: net.ipv4.ip_unprivileged_port_start
-    value: "0"
+    value: "20"
+    sysctl_file: /etc/sysctl.d/10-security.conf
     sysctl_set: true
+    reload: true
     state: present
 - name: Creating container directory
   ansible.builtin.file:
@@ -31,6 +61,24 @@
     group: "{{ ansible_user }}"
     mode: "755"
     state: directory
+- name: Creating a ZFS dataset for container secrets
+  become: true
+  when: zfs_present
+  community.general.zfs:
+    name: "{{ preferred_zpool.user_input }}/container_volumes"
+    state: present
+    extra_zfs_properties:
+      canmount: "on"
+      mountpoint: "{{ ansible_user_home.stdout }}/volumes"
+- name: Configuring container image registries
+  become: true
+  ansible.builtin.file:
+    path: "{{ ansible_user_home.stdout }}/volumes"
+    recurse: true
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "755"
+    state: directory
 - name: Configuring container storage
   become: true
   become_user: "{{ current_user.stdout }}"