a13labs.infra/ansible/roles/podman/tasks/main.yml

---
- name: Set fact podman_binary (Debian family)
  ansible.builtin.set_fact:
    podman_binary: /usr/bin/podman
  when: ansible_os_family == 'Debian'

- name: Set fact podman_binary (Red Hat family)
  ansible.builtin.set_fact:
    podman_binary: /usr/sbin/podman
  when: ansible_os_family == 'RedHat'

- name: Create group
  become: true
  ansible.builtin.group:
    name: "{{ podman_group }}"
    system: true

- name: Create user
  become: true
  ansible.builtin.user:
    name: "{{ podman_user }}"
    groups: "{{ podman_extra_groups | default([]) }}"
    shell: /bin/bash
    home: "{{ podman_user_home }}"
    group: "{{ podman_group }}"

- name: Disable password login for user
  ansible.builtin.command: passwd -d "{{ podman_user }}"
  become: true
  changed_when: false

- name: Create user home
  become: true
  ansible.builtin.file:
    path: "{{ podman_user_home }}"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_group }}"
    mode: "0750"

- name: Create build folders
  become: true
  ansible.builtin.file:
    path: "{{ podman_user_home }}/build"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_group }}"
    mode: "0750"

- name: Create folders
  become: true
  ansible.builtin.file:
    path: "{{ podman_user_home }}/{{ item }}"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_group }}"
    mode: "0750"
  loop: "{{ podman_user_folders }}"

- name: "Add SSH Authorized key"
  become: true
  ansible.posix.authorized_key:
    user: "{{ podman_user }}"
    key: "{{ podman_user_pubkey }}"
    state: "{{ 'present' if podman_user_pubkey is defined and podman_user_pubkey != '' else 'absent' }}"
  when: podman_user_pubkey is defined and podman_user_pubkey != ""

- name: SELinux tasks (RedHat only)
  when: ansible_os_family == 'RedHat'
  become: true
  block:
    - name: Persistently set SELinux context
      community.general.sefcontext:
        target: "{{ podman_user_home }}(/.*)?"
        setype: user_home_dir_t
        state: present

    - name: Persistently set SELinux context (ssh authorized keys)
      community.general.sefcontext:
        target: "{{ podman_user_home }}/.ssh/authorized_keys"
        setype: ssh_home_t
        state: present
      when: podman_user_pubkey is defined and podman_user_pubkey != ""

    - name: Apply SELinux context
      ansible.builtin.command: restorecon -Rv {{ podman_user_home }}
      changed_when: false

- name: Enable sudo access to podman user (temporary)
  become: true
  ansible.builtin.lineinfile:
    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
    create: true
    mode: "0440"
    line: "{{ ansible_facts['user_id'] }} ALL=({{ podman_user }}) NOPASSWD: ALL"
    validate: "visudo -cf %s"

- name: Enable lingering for podman user
  become: true
  ansible.builtin.command: loginctl enable-linger {{ podman_user }}
  register: linger_status
  changed_when: >-
    'created' in linger_status.stdout or
    (linger_status.rc == 0 and not
      ('linger file already exists' in linger_status.stderr or
      'linger file does not exist' in linger_status.stderr))
  failed_when:
    - linger_status.rc != 0 and not
      ('linger file already exists' in linger_status.stderr)

- name: Get current user's UID
  ansible.builtin.command: id -u {{ podman_user }}
  changed_when: false
  register: uid

- name: Get current user's GID
  ansible.builtin.command: id -g {{ podman_user }}
  changed_when: false
  register: gid

- name: Run tasks as podman user
  become: true
  become_user: "{{ podman_user }}"
  block:
    - name: Create a custom Podman network
      when: podman_network_name is defined and podman_network_name != 'none'
      containers.podman.podman_network:
        name: "{{ podman_network_name }}"
        state: present

    - name: Copy build files to user home
      ansible.builtin.copy:
        src: "{{ item }}"
        dest: "{{ podman_user_home }}/build/"
        owner: "{{ podman_user }}"
        group: "{{ podman_group }}"
        mode: "0644"
      loop: "{{ podman_build_files | default([]) }}"
      when: podman_build_files is defined and podman_build_files | length > 0

    - name: Build containers images
      containers.podman.podman_image:
        name: "{{ podman_user }}/{{ item.name }}"
        path: "{{ podman_user_home }}/build"
        build:
          cache: false
          force_rm: true
          container_file: "{{ item.build.dockerfile }}"
          extra_args: "--build-arg UID={{ uid.stdout }} --build-arg GID={{ gid.stdout }} --security-opt=label=disable {{ item.build.args | default('') }}"
        tag: "latest"
        state: present
      loop: "{{ podman_pods }}"
      when: item.build is defined and item.build.dockerfile is defined

    - name: Pull the requested images
      containers.podman.podman_image:
        name: "{{ item.repo.image }}"
        tag: "{{ item.repo.tag | default('latest') }}"
        state: present
      loop: "{{ podman_pods }}"
      when: item.repo is defined and item.repo.image is defined

    - name: Create pods
      containers.podman.podman_container:
        name: "{{ item.name }}"
        image: "{{ item.repo.image | default(podman_user + '/' + item.name) }}"
        state: "{{ item.state | default('started') }}"
        device: "{{ item.device | default(omit) }}"
        env: "{{ item.env | default(omit) }}"
        network: "{{ podman_network_name | default(omit) }}"
        ports: "{{ item.ports | default(omit) }}"
        volumes: "{{ item.volumes | default(omit) }}"
        command: "{{ item.command | default(omit) }}"
        cmd_args:
          - "--userns=keep-id"
          - "--security-opt=label=disable"
      loop: "{{ podman_pods }}"

- name: Create systemd service file for pods
  become: true
  ansible.builtin.template:
    src: podman.service.j2
    dest: "/etc/systemd/system/podman-{{ item.name }}.service"
    owner: root
    group: root
    mode: "0644"
  loop: "{{ podman_pods }}"

- name: Reload systemd daemon
  become: true
  ansible.builtin.systemd:
    daemon_reload: true

- name: Enable containers at boot
  become: true
  ansible.builtin.systemd:
    name: "podman-{{ item.name }}"
    enabled: "{{ item.systemd.enabled | default(true) }}"
    state: "{{ item.systemd.state | default('started') }}"
  loop: "{{ podman_pods }}"

- name: Remove temporary sudo access
  become: true
  ansible.builtin.file:
    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
    state: absent