a13labs.infra/ansible/tasks/podman.yml

- name: Check if required vars are set
  ansible.builtin.fail:
    msg: "Required variables are not set for Podman setup. Please check your playbook variables.)"
  when:
    - podman_user is not defined
    - podman_group is not defined
    - podman_user_home is not defined

- name: Set fact podman_binary (Debian family)
  when: ansible_os_family == 'Debian'
  ansible.builtin.set_fact:
    podman_binary: /usr/bin/podman

- name: Set fact podman_binary (Red Hat family)
  when: ansible_os_family == 'RedHat'
  ansible.builtin.set_fact:
    podman_binary: /usr/sbin/podman

- name: Install Podman and its dependencies
  become: true
  ansible.builtin.package:
    name:
      - podman
      - acl
    state: present

- name: Create group and user for AI workloads
  become: true
  ansible.builtin.group:
    name: "{{ podman_group }}"
    system: true

- name: Create user and group for AI containers
  become: true
  ansible.builtin.user:
    name: "{{ podman_user }}"
    groups: "{{ podman_group }}"
    shell: /bin/bash
    home: "{{ podman_user_home }}"
    group: "{{ podman_group }}"

- name: Disable password login for AI user
  ansible.builtin.command: passwd -d "{{ podman_user }}"
  become: true
  changed_when: false

- name: SELinux tasks (RedHat only)
  when: ansible_os_family == 'RedHat'
  become: true
  block:
    - name: Persistently set SELinux context for home directories on AI home
      community.general.sefcontext:
        target: "{{ podman_user_home }}(/.*)?"
        setype: user_home_dir_t
        state: present

    - name: Apply SELinux context changes to AI home directories
      ansible.builtin.command: restorecon -Rv {{ podman_user_home }}
      changed_when: false

- name: Create user home
  become: true
  ansible.builtin.file:
    path: "{{ podman_user_home }}"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_group }}"
    mode: "0750"

- name: Create build folders
  become: true
  ansible.builtin.file:
    path: "{{ podman_user_home }}/build"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_group }}"
    mode: "0750"

- name: Create folders
  become: true
  ansible.builtin.file:
    path: "{{ podman_user_home }}/{{ item.name }}"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_group }}"
    mode: "0750"
  loop: "{{ pods }}"

- name: Enable sudo access to podman user (temporary)
  become: true
  ansible.builtin.lineinfile:
    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
    create: true
    mode: "0440"
    line: "{{ ansible_user_id }} ALL=({{ podman_user }}) NOPASSWD: ALL"
    validate: "visudo -cf %s"

- name: Enable lingering for podman user
  become: true
  ansible.builtin.command: loginctl enable-linger {{ podman_user }}
  register: linger_status
  changed_when: >-
    "'created' in linger_status.stdout or
    (linger_status.rc == 0 and not
      ('linger file already exists' in linger_status.stderr or
      'linger file does not exist' in linger_status.stderr))"
  failed_when:
    - linger_status.rc != 0 and not
      ('linger file already exists' in linger_status.stderr)

- name: Get current user's UID
  ansible.builtin.command: id -u {{ podman_user }}
  changed_when: false
  register: uid

- name: Get current user's GID
  ansible.builtin.command: id -g {{ podman_user }}
  changed_when: false
  register: gid

- name: Ensure rootless Podman works with overlay driver on Debian-family systems
  become: true
  vars:
    subuid_range: "100000:65536"
  block:
    - name: Install required packages for rootless Podman overlay support
      ansible.builtin.apt:
        name:
          - uidmap
          - fuse-overlayfs
          - libslirp0
          - slirp4netns
        state: present
        update_cache: true

    - name: Ensure subuid entry exists for the user
      ansible.builtin.lineinfile:
        path: /etc/subuid
        line: "{{ podman_user }}:{{ subuid_range }}"
        create: true
        state: present
        regexp: "^{{ podman_user }}:"
        mode: "0644"

    - name: Ensure subgid entry exists for the user
      ansible.builtin.lineinfile:
        path: /etc/subgid
        line: "{{ podman_user }}:{{ subuid_range }}"
        create: true
        state: present
        regexp: "^{{ podman_user }}:"
        mode: "0644"

    - name: Ensure overlay module is loaded  # noqa no-ignore-errors
      community.general.modprobe:
        name: overlay
        state: present

    - name: Ensure overlay module loads on boot
      ansible.builtin.lineinfile:
        path: /etc/modules
        line: overlay
        create: true
        state: present
        mode: "0644"

- name: Run tasks as podman user
  become: true
  become_user: "{{ podman_user }}"
  block:
    - name: Create a custom Podman network
      when: podman_network_name is defined and podman_network_name != 'none'
      containers.podman.podman_network:
        name: "{{ podman_network_name }}"
        state: present

    - name: Build containers images
      containers.podman.podman_image:
        name: "{{ podman_user }}/{{ item.name }}"
        path: "{{ podman_user_home }}/build"
        build:
          cache: false
          force_rm: true
          container_file: "{{ item.build.dockerfile }}"
          extra_args: "--build-arg UID={{ uid.stdout }} --build-arg GID={{ gid.stdout }} --security-opt=label=disable {{ item.build.args | default('') }}"
        tag: "latest"
        state: present
      loop: "{{ pods }}"
      when: item.build is defined

    - name: Pull the requested images
      containers.podman.podman_image:
        name: "{{ item.repo.image }}"
        tag: "{{ item.repo.tag | default('latest') }}"
        state: present
      loop: "{{ pods }}"
      when: item.repo is defined

    - name: Create pods
      containers.podman.podman_container:
        name: "{{ item.name }}"
        image: "{{ item.repo.image | default(podman_user + '/' + item.name) }}"
        state: started
        device: "{{ item.device | default(omit) }}"
        env: "{{ item.env | default(omit) }}"
        network: "{{ podman_network_name | default(omit) }}"
        ports: "{{ item.ports | default(omit) }}"
        volumes: "{{ item.volumes | default(omit) }}"
        cmd_args:
          - "--userns=keep-id"
          - "--security-opt=label=disable"
      loop: "{{ pods }}"

- name: Create systemd service file for pods
  become: true
  ansible.builtin.template:
    src: podman.service.j2
    dest: "/etc/systemd/system/podman-{{ item.name }}.service"
    owner: root
    group: root
    mode: "0644"
  loop: "{{ pods }}"

- name: Reload systemd daemon
  become: true
  ansible.builtin.systemd:
    daemon_reload: true

- name: Enable containers at boot
  become: true
  ansible.builtin.systemd:
    name: "podman-{{ item.name }}"
    enabled: true
    state: started
  loop: "{{ pods }}"

- name: Remove temporary sudo access
  become: true
  ansible.builtin.file:
    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
    state: absent