feat(comfyui): add Dockerfile, playbook, and Terraform configurations for ComfyUI setup

ansible/tasks/podman.yml

@@ -24,67 +24,9 @@
       - acl
     state: present
 
-- name: Create group and user for workloads
-  become: true
-  ansible.builtin.group:
-    name: "{{ podman_group }}"
-    system: true
-
-- name: Create user and group for containers
-  become: true
-  ansible.builtin.user:
-    name: "{{ podman_user }}"
-    groups: "{{ podman_group }}"
-    shell: /bin/bash
-    home: "{{ podman_user_home }}"
-    group: "{{ podman_group }}"
-
-- name: Disable password login for user
-  ansible.builtin.command: passwd -d "{{ podman_user }}"
-  become: true
-  changed_when: false
-
-- name: SELinux tasks (RedHat only)
-  when: ansible_os_family == 'RedHat'
-  become: true
-  block:
-    - name: Persistently set SELinux context for home directories on AI home
-      community.general.sefcontext:
-        target: "{{ podman_user_home }}(/.*)?"
-        setype: user_home_dir_t
-        state: present
-
-    - name: Apply SELinux context changes to AI home directories
-      ansible.builtin.command: restorecon -Rv {{ podman_user_home }}
-      changed_when: false
-
-- name: Create user home
-  become: true
-  ansible.builtin.file:
-    path: "{{ podman_user_home }}"
-    state: directory
-    owner: "{{ podman_user }}"
-    group: "{{ podman_group }}"
-    mode: "0750"
-
-- name: Create build folders
-  become: true
-  ansible.builtin.file:
-    path: "{{ podman_user_home }}/build"
-    state: directory
-    owner: "{{ podman_user }}"
-    group: "{{ podman_group }}"
-    mode: "0750"
-
-- name: Create folders
-  become: true
-  ansible.builtin.file:
-    path: "{{ podman_user_home }}/{{ item }}"
-    state: directory
-    owner: "{{ podman_user }}"
-    group: "{{ podman_group }}"
-    mode: "0750"
-  loop: "{{ podman_user_folders }}"
+- name: Setup user
+  ansible.builtin.include_tasks:
+    file: podman/user.yml
 
 - name: Enable sudo access to podman user (temporary)
   become: true
@@ -118,53 +60,6 @@
   changed_when: false
   register: gid
 
-- name: Ensure rootless Podman works with overlay driver on Debian-family systems
-  when: ansible_os_family == 'Debian'
-  become: true
-  vars:
-    subuid_range: "100000:65536"
-  block:
-    - name: Install required packages for rootless Podman overlay support
-      ansible.builtin.apt:
-        name:
-          - uidmap
-          - fuse-overlayfs
-          - libslirp0
-          - slirp4netns
-        state: present
-        update_cache: true
-
-    - name: Ensure subuid entry exists for the user
-      ansible.builtin.lineinfile:
-        path: /etc/subuid
-        line: "{{ podman_user }}:{{ subuid_range }}"
-        create: true
-        state: present
-        regexp: "^{{ podman_user }}:"
-        mode: "0644"
-
-    - name: Ensure subgid entry exists for the user
-      ansible.builtin.lineinfile:
-        path: /etc/subgid
-        line: "{{ podman_user }}:{{ subuid_range }}"
-        create: true
-        state: present
-        regexp: "^{{ podman_user }}:"
-        mode: "0644"
-
-    - name: Ensure overlay module is loaded  # noqa no-ignore-errors
-      community.general.modprobe:
-        name: overlay
-        state: present
-
-    - name: Ensure overlay module loads on boot
-      ansible.builtin.lineinfile:
-        path: /etc/modules
-        line: overlay
-        create: true
-        state: present
-        mode: "0644"
-
 - name: Run tasks as podman user
   become: true
   become_user: "{{ podman_user }}"
@@ -175,6 +70,16 @@
         name: "{{ podman_network_name }}"
         state: present
 
+    - name: Copy build files to user home
+      ansible.builtin.copy:
+        src: "{{ item }}"
+        dest: "{{ podman_user_home }}/build/"
+        owner: "{{ podman_user }}"
+        group: "{{ podman_group }}"
+        mode: "0644"
+      loop: "{{ podman_build_files | default([]) }}"
+      when: podman_build_files is defined and podman_build_files | length > 0
+
     - name: Build containers images
       containers.podman.podman_image:
         name: "{{ podman_user }}/{{ item.name }}"
@@ -187,7 +92,7 @@
         tag: "latest"
         state: present
       loop: "{{ pods }}"
-      when: item.build is defined
+      when: item.build is defined and item.build.dockerfile is defined
 
     - name: Pull the requested images
       containers.podman.podman_image:
@@ -195,13 +100,13 @@
         tag: "{{ item.repo.tag | default('latest') }}"
         state: present
       loop: "{{ pods }}"
-      when: item.repo is defined
+      when: item.repo is defined and item.repo.image is defined
 
     - name: Create pods
       containers.podman.podman_container:
         name: "{{ item.name }}"
         image: "{{ item.repo.image | default(podman_user + '/' + item.name) }}"
-        state: started
+        state: "{{ item.state | default('present') }}"
         device: "{{ item.device | default(omit) }}"
         env: "{{ item.env | default(omit) }}"
         network: "{{ podman_network_name | default(omit) }}"
@@ -231,8 +136,8 @@
   become: true
   ansible.builtin.systemd:
     name: "podman-{{ item.name }}"
-    enabled: true
-    state: started
+    enabled: "{{ item.systemd.enabled | default(true) }}"
+    state: "{{ item.systemd.state | default('started') }}"
   loop: "{{ pods }}"
 
 - name: Remove temporary sudo access

ansible/tasks/podman/user.yml

@@ -0,0 +1,84 @@
+- name: Check if required vars are set
+  ansible.builtin.fail:
+    msg: "Required variables are not set for Podman setup. Please check your playbook variables.)"
+  when:
+    - podman_user is not defined
+    - podman_group is not defined
+    - podman_user_home is not defined
+
+- name: Create group
+  become: true
+  ansible.builtin.group:
+    name: "{{ podman_group }}"
+    system: true
+
+- name: Create user
+  become: true
+  ansible.builtin.user:
+    name: "{{ podman_user }}"
+    groups: "{{ podman_extra_groups | default([]) }}"
+    shell: /bin/bash
+    home: "{{ podman_user_home }}"
+    group: "{{ podman_group }}"
+
+- name: Disable password login for user
+  ansible.builtin.command: passwd -d "{{ podman_user }}"
+  become: true
+  changed_when: false
+
+- name: Create user home
+  become: true
+  ansible.builtin.file:
+    path: "{{ podman_user_home }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_group }}"
+    mode: "0750"
+
+- name: Create build folders
+  become: true
+  ansible.builtin.file:
+    path: "{{ podman_user_home }}/build"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_group }}"
+    mode: "0750"
+
+- name: Create folders
+  become: true
+  ansible.builtin.file:
+    path: "{{ podman_user_home }}/{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_group }}"
+    mode: "0750"
+  loop: "{{ podman_user_folders }}"
+
+- name: "Add SSH Authorized key"
+  become: true
+  ansible.posix.authorized_key:
+    user: "{{ podman_user }}"
+    key: "{{ podman_user_pubkey }}"
+    state: "{{ 'present' if podman_user_pubkey is defined else 'absent' }}"
+  when: podman_user_pubkey is defined and podman_user_pubkey != ""
+
+- name: SELinux tasks (RedHat only)
+  when: ansible_os_family == 'RedHat'
+  become: true
+  block:
+    - name: Persistently set SELinux context
+      community.general.sefcontext:
+        target: "{{ podman_user_home }}(/.*)?"
+        setype: user_home_dir_t
+        state: present
+
+    - name: Persistently set SELinux context (ssh authorized keys)
+      community.general.sefcontext:
+        target: "{{ podman_user_home }}/.ssh/authorized_keys"
+        setype: ssh_home_t
+        state: present
+      when: podman_user_pubkey is defined and podman_user_pubkey != ""
+
+    - name: Apply SELinux context
+      ansible.builtin.command: restorecon -Rv {{ podman_user_home }}
+      changed_when: false