feat(vaultwarden): add SMTP configuration options and enhance signup settings

- Introduced SMTP settings for Vaultwarden including host, port, security, and authentication details.
- Added variables for signup verification, 2FA settings, password hints, and logging options.
- Updated Vaultwarden deployment to utilize new SMTP configurations.
- Enhanced Grafana module to support dynamic dashboard and datasource provisioning.
- Added LLM proxy configuration for Open Web UI with necessary environment variables.

ansible/roles/podman/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+# podman defaults
+
+podman_user: ""
+podman_group: ""
+podman_user_home: ""
+podman_extra_groups: []
+podman_user_folders: []
+podman_user_pubkey: ""
+podman_network_name: "none"
+podman_build_files: []
+podman_pods: []
+
+# Binary path - will be set by OS family in tasks
+# podman_binary is set as a fact in tasks/main.yml

ansible/roles/podman/meta/main.yml

@@ -0,0 +1,18 @@
+---
+galaxy_info:
+  author: Alexandre Pires
+  description: Deploy and manage Podman users, pods, and containers
+  company: A13Labs
+  role_name: podman
+  namespace: a13labs
+  license: MIT
+  min_ansible_version: "2.1"
+  platforms:
+    - name: Fedora
+      versions:
+        - "39"
+        - "40"
+        - "41"
+    - name: EL
+      versions:
+        - "9"

ansible/roles/podman/tasks/main.yml

@@ -0,0 +1,206 @@
+---
+- name: Set fact podman_binary (Debian family)
+  ansible.builtin.set_fact:
+    podman_binary: /usr/bin/podman
+  when: ansible_os_family == 'Debian'
+
+- name: Set fact podman_binary (Red Hat family)
+  ansible.builtin.set_fact:
+    podman_binary: /usr/sbin/podman
+  when: ansible_os_family == 'RedHat'
+
+- name: Create group
+  become: true
+  ansible.builtin.group:
+    name: "{{ podman_group }}"
+    system: true
+
+- name: Create user
+  become: true
+  ansible.builtin.user:
+    name: "{{ podman_user }}"
+    groups: "{{ podman_extra_groups | default([]) }}"
+    shell: /bin/bash
+    home: "{{ podman_user_home }}"
+    group: "{{ podman_group }}"
+
+- name: Disable password login for user
+  ansible.builtin.command: passwd -d "{{ podman_user }}"
+  become: true
+  changed_when: false
+
+- name: Create user home
+  become: true
+  ansible.builtin.file:
+    path: "{{ podman_user_home }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_group }}"
+    mode: "0750"
+
+- name: Create build folders
+  become: true
+  ansible.builtin.file:
+    path: "{{ podman_user_home }}/build"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_group }}"
+    mode: "0750"
+
+- name: Create folders
+  become: true
+  ansible.builtin.file:
+    path: "{{ podman_user_home }}/{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_group }}"
+    mode: "0750"
+  loop: "{{ podman_user_folders }}"
+
+- name: "Add SSH Authorized key"
+  become: true
+  ansible.posix.authorized_key:
+    user: "{{ podman_user }}"
+    key: "{{ podman_user_pubkey }}"
+    state: "{{ 'present' if podman_user_pubkey is defined and podman_user_pubkey != '' else 'absent' }}"
+  when: podman_user_pubkey is defined and podman_user_pubkey != ""
+
+- name: SELinux tasks (RedHat only)
+  when: ansible_os_family == 'RedHat'
+  become: true
+  block:
+    - name: Persistently set SELinux context
+      community.general.sefcontext:
+        target: "{{ podman_user_home }}(/.*)?"
+        setype: user_home_dir_t
+        state: present
+
+    - name: Persistently set SELinux context (ssh authorized keys)
+      community.general.sefcontext:
+        target: "{{ podman_user_home }}/.ssh/authorized_keys"
+        setype: ssh_home_t
+        state: present
+      when: podman_user_pubkey is defined and podman_user_pubkey != ""
+
+    - name: Apply SELinux context
+      ansible.builtin.command: restorecon -Rv {{ podman_user_home }}
+      changed_when: false
+
+- name: Enable sudo access to podman user (temporary)
+  become: true
+  ansible.builtin.lineinfile:
+    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
+    create: true
+    mode: "0440"
+    line: "{{ ansible_facts['user_id'] }} ALL=({{ podman_user }}) NOPASSWD: ALL"
+    validate: "visudo -cf %s"
+
+- name: Enable lingering for podman user
+  become: true
+  ansible.builtin.command: loginctl enable-linger {{ podman_user }}
+  register: linger_status
+  changed_when: >-
+    'created' in linger_status.stdout or
+    (linger_status.rc == 0 and not
+      ('linger file already exists' in linger_status.stderr or
+      'linger file does not exist' in linger_status.stderr))
+  failed_when:
+    - linger_status.rc != 0 and not
+      ('linger file already exists' in linger_status.stderr)
+
+- name: Get current user's UID
+  ansible.builtin.command: id -u {{ podman_user }}
+  changed_when: false
+  register: uid
+
+- name: Get current user's GID
+  ansible.builtin.command: id -g {{ podman_user }}
+  changed_when: false
+  register: gid
+
+- name: Run tasks as podman user
+  become: true
+  become_user: "{{ podman_user }}"
+  block:
+    - name: Create a custom Podman network
+      when: podman_network_name is defined and podman_network_name != 'none'
+      containers.podman.podman_network:
+        name: "{{ podman_network_name }}"
+        state: present
+
+    - name: Copy build files to user home
+      ansible.builtin.copy:
+        src: "{{ item }}"
+        dest: "{{ podman_user_home }}/build/"
+        owner: "{{ podman_user }}"
+        group: "{{ podman_group }}"
+        mode: "0644"
+      loop: "{{ podman_build_files | default([]) }}"
+      when: podman_build_files is defined and podman_build_files | length > 0
+
+    - name: Build containers images
+      containers.podman.podman_image:
+        name: "{{ podman_user }}/{{ item.name }}"
+        path: "{{ podman_user_home }}/build"
+        build:
+          cache: false
+          force_rm: true
+          container_file: "{{ item.build.dockerfile }}"
+          extra_args: "--build-arg UID={{ uid.stdout }} --build-arg GID={{ gid.stdout }} --security-opt=label=disable {{ item.build.args | default('') }}"
+        tag: "latest"
+        state: present
+      loop: "{{ podman_pods }}"
+      when: item.build is defined and item.build.dockerfile is defined
+
+    - name: Pull the requested images
+      containers.podman.podman_image:
+        name: "{{ item.repo.image }}"
+        tag: "{{ item.repo.tag | default('latest') }}"
+        state: present
+      loop: "{{ podman_pods }}"
+      when: item.repo is defined and item.repo.image is defined
+
+    - name: Create pods
+      containers.podman.podman_container:
+        name: "{{ item.name }}"
+        image: "{{ item.repo.image | default(podman_user + '/' + item.name) }}"
+        state: "{{ item.state | default('started') }}"
+        device: "{{ item.device | default(omit) }}"
+        env: "{{ item.env | default(omit) }}"
+        network: "{{ podman_network_name | default(omit) }}"
+        ports: "{{ item.ports | default(omit) }}"
+        volumes: "{{ item.volumes | default(omit) }}"
+        command: "{{ item.command | default(omit) }}"
+        cmd_args:
+          - "--userns=keep-id"
+          - "--security-opt=label=disable"
+      loop: "{{ podman_pods }}"
+
+- name: Create systemd service file for pods
+  become: true
+  ansible.builtin.template:
+    src: podman.service.j2
+    dest: "/etc/systemd/system/podman-{{ item.name }}.service"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ podman_pods }}"
+
+- name: Reload systemd daemon
+  become: true
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Enable containers at boot
+  become: true
+  ansible.builtin.systemd:
+    name: "podman-{{ item.name }}"
+    enabled: "{{ item.systemd.enabled | default(true) }}"
+    state: "{{ item.systemd.state | default('started') }}"
+  loop: "{{ podman_pods }}"
+
+- name: Remove temporary sudo access
+  become: true
+  ansible.builtin.file:
+    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
+    state: absent

ansible/roles/podman/templates/podman.service.j2

@@ -0,0 +1,17 @@
+[Unit]
+Description=Podman service for {{ item.name }}
+After=local-fs.target network-online.target
+
+[Service]
+Type=oneshot
+User={{ podman_user }}
+Group={{ podman_group }}
+RemainAfterExit=true
+ExecStart={{ podman_binary }} start {{ item.name }}
+ExecStop={{ podman_binary }} stop {{ item.name }}
+
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target