113 lines
3.7 KiB
YAML
113 lines
3.7 KiB
YAML
---
|
|
- name: Acquiring home of current user
|
|
when: ansible_facts["system"] == "Linux"
|
|
ansible.builtin.shell:
|
|
cmd: "echo ~{{ ansible_user }}"
|
|
register: ansible_user_home
|
|
- name: Acquiring current user
|
|
when: ansible_facts["system"] == "Linux"
|
|
ansible.builtin.shell:
|
|
cmd: "echo {{ ansible_user }}"
|
|
register: current_user
|
|
- name: Checking if ZFS filesystem is present
|
|
ansible.builtin.shell:
|
|
cmd: "findmnt -D | awk '{ print $2 }' | tail -n +2"
|
|
register: fs_result
|
|
- name: Logging presence of ZFS filesystem
|
|
when: "'zfs' in fs_result.stdout"
|
|
ansible.builtin.set_fact:
|
|
zfs_present: true
|
|
- name: Logging absence of ZFS filesystem
|
|
when: "'zfs' not in fs_result.stdout"
|
|
ansible.builtin.set_fact:
|
|
zfs_present: false
|
|
- name: Configuring ZFS support
|
|
when: zfs_present
|
|
block:
|
|
- name: Getting available pools
|
|
ansible.builtin.shell:
|
|
cmd: "zpool list | awk '{ print $1 }' | tail -n +2"
|
|
register: zpools
|
|
- name: Turning available pools into list
|
|
ansible.builtin.set_fact:
|
|
zpool_list: "{{ zpools | replace('\n', ' ') | split(' ') }}"
|
|
- name: Allowing choice of zpool
|
|
ansible.builtin.pause:
|
|
prompt: "Type preferred zpool from available (i.e., {{ zpool_list | join(', ') }})"
|
|
register: preferred_zpool
|
|
- name: Ensuring user namespace support is enabled
|
|
become: true
|
|
ansible.posix.sysctl:
|
|
name: kernel.unprivileged_userns_clone
|
|
value: "1"
|
|
sysctl_file: /etc/sysctl.d/10-security.conf
|
|
sysctl_set: true
|
|
reload: true
|
|
state: present
|
|
- name: Ensuring user namespace support is enabled
|
|
become: true
|
|
ansible.posix.sysctl:
|
|
name: net.ipv4.ip_unprivileged_port_start
|
|
value: "20"
|
|
sysctl_file: /etc/sysctl.d/10-security.conf
|
|
sysctl_set: true
|
|
reload: true
|
|
state: present
|
|
- name: Creating container directory
|
|
ansible.builtin.file:
|
|
path: "{{ ansible_user_home.stdout }}/.config/containers"
|
|
recurse: true
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "755"
|
|
state: directory
|
|
- name: Creating a ZFS dataset for container secrets
|
|
become: true
|
|
when: zfs_present
|
|
community.general.zfs:
|
|
name: "{{ preferred_zpool.user_input }}/container_volumes"
|
|
state: present
|
|
extra_zfs_properties:
|
|
canmount: "on"
|
|
mountpoint: "{{ ansible_user_home.stdout }}/volumes"
|
|
- name: Configuring container image registries
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ ansible_user_home.stdout }}/volumes"
|
|
recurse: true
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "755"
|
|
state: directory
|
|
- name: Configuring container storage
|
|
become: true
|
|
become_user: "{{ current_user.stdout }}"
|
|
ansible.builtin.template:
|
|
src: user/config/containers/storage.conf.j2
|
|
dest: "{{ ansible_user_home.stdout }}/.config/containers/storage.conf"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "644"
|
|
force: true
|
|
backup: true
|
|
- name: Configuring container image registries
|
|
become: true
|
|
become_user: "{{ current_user.stdout }}"
|
|
ansible.builtin.copy:
|
|
src: user/config/containers/registries.conf
|
|
dest: "{{ ansible_user_home.stdout }}/.config/containers/"
|
|
owner: "{{ ansible_user }}"
|
|
group: "{{ ansible_user }}"
|
|
mode: "644"
|
|
force: true
|
|
backup: true
|
|
# @NOTE https://oneuptime.com/blog/post/2026-01-27-podman-rootless/view#configuring-registries
|
|
# @NOTE https://github.com/podman-container-tools/podman/blob/main/docs/tutorials/rootless_tutorial.md#using-volumes
|
|
# @NOTE https://github.com/containers/podman-compose/issues/166#issuecomment-1550515230
|
|
- name: Enabling and starting SystemD unit service for automatic restart of containers/pods
|
|
become: true
|
|
ansible.builtin.systemd_service:
|
|
name: podman-restart
|
|
scope: system
|
|
enabled: true
|
|
state: started |