a13labs.infra/ansible/tasks/podman.yml

- name: Check if required vars are set
  ansible.builtin.fail:
    msg: "Required variables are not set for Podman setup. Please check your playbook variables.)"
  when:
    - podman_user is not defined
    - podman_group is not defined
    - podman_user_home is not defined

- name: Set fact podman_binary (Debian family)
  when: ansible_os_family == 'Debian'
  ansible.builtin.set_fact:
    podman_binary: /usr/bin/podman

- name: Set fact podman_binary (Red Hat family)
  when: ansible_os_family == 'RedHat'
  ansible.builtin.set_fact:
    podman_binary: /usr/sbin/podman

- name: Install Podman and its dependencies
  become: true
  ansible.builtin.package:
    name:
      - podman
      - acl
    state: present

- name: Setup user
  ansible.builtin.include_tasks:
    file: podman/user.yml

- name: Enable sudo access to podman user (temporary)
  become: true
  ansible.builtin.lineinfile:
    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
    create: true
    mode: "0440"
    line: "{{ ansible_facts['user_id'] }} ALL=({{ podman_user }}) NOPASSWD: ALL"
    validate: "visudo -cf %s"

- name: Enable lingering for podman user
  become: true
  ansible.builtin.command: loginctl enable-linger {{ podman_user }}
  register: linger_status
  changed_when: >-
    'created' in linger_status.stdout or
    (linger_status.rc == 0 and not
      ('linger file already exists' in linger_status.stderr or
      'linger file does not exist' in linger_status.stderr))
  failed_when:
    - linger_status.rc != 0 and not
      ('linger file already exists' in linger_status.stderr)

- name: Get current user's UID
  ansible.builtin.command: id -u {{ podman_user }}
  changed_when: false
  register: uid

- name: Get current user's GID
  ansible.builtin.command: id -g {{ podman_user }}
  changed_when: false
  register: gid

- name: Run tasks as podman user
  become: true
  become_user: "{{ podman_user }}"
  block:
    - name: Create a custom Podman network
      when: podman_network_name is defined and podman_network_name != 'none'
      containers.podman.podman_network:
        name: "{{ podman_network_name }}"
        state: present

    - name: Copy build files to user home
      ansible.builtin.copy:
        src: "{{ item }}"
        dest: "{{ podman_user_home }}/build/"
        owner: "{{ podman_user }}"
        group: "{{ podman_group }}"
        mode: "0644"
      loop: "{{ podman_build_files | default([]) }}"
      when: podman_build_files is defined and podman_build_files | length > 0

    - name: Build containers images
      containers.podman.podman_image:
        name: "{{ podman_user }}/{{ item.name }}"
        path: "{{ podman_user_home }}/build"
        build:
          cache: false
          force_rm: true
          container_file: "{{ item.build.dockerfile }}"
          extra_args: "--build-arg UID={{ uid.stdout }} --build-arg GID={{ gid.stdout }} --security-opt=label=disable {{ item.build.args | default('') }}"
        tag: "latest"
        state: present
      loop: "{{ pods }}"
      when: item.build is defined and item.build.dockerfile is defined

    - name: Pull the requested images
      containers.podman.podman_image:
        name: "{{ item.repo.image }}"
        tag: "{{ item.repo.tag | default('latest') }}"
        state: present
      loop: "{{ pods }}"
      when: item.repo is defined and item.repo.image is defined

    - name: Create pods
      containers.podman.podman_container:
        name: "{{ item.name }}"
        image: "{{ item.repo.image | default(podman_user + '/' + item.name) }}"
        state: "{{ item.state | default('started') }}"
        device: "{{ item.device | default(omit) }}"
        env: "{{ item.env | default(omit) }}"
        network: "{{ podman_network_name | default(omit) }}"
        ports: "{{ item.ports | default(omit) }}"
        volumes: "{{ item.volumes | default(omit) }}"
        command: "{{ item.command | default(omit) }}"
        cmd_args:
          - "--userns=keep-id"
          - "--security-opt=label=disable"
      loop: "{{ pods }}"

- name: Create systemd service file for pods
  become: true
  ansible.builtin.template:
    src: podman.service.j2
    dest: "/etc/systemd/system/podman-{{ item.name }}.service"
    owner: root
    group: root
    mode: "0644"
  loop: "{{ pods }}"

- name: Reload systemd daemon
  become: true
  ansible.builtin.systemd:
    daemon_reload: true

- name: Enable containers at boot
  become: true
  ansible.builtin.systemd:
    name: "podman-{{ item.name }}"
    enabled: "{{ item.systemd.enabled | default(true) }}"
    state: "{{ item.systemd.state | default('started') }}"
  loop: "{{ pods }}"

- name: Remove temporary sudo access
  become: true
  ansible.builtin.file:
    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
    state: absent