Migrate from Docker on Debian to Podman on Rocky

- Upgrade base OS from Debian 11 to Rocky Linux 9
- Configure 100GB XFS filesystem with auto-expansion
- Replace Docker with rootless Podman for improved security
- Add nginx reverse proxy for non-privileged port handling
- Move the Traefik dashboard from port 8443 to 9443
- Configure SELinux contexts for container operations

roles/common/defaults/main.yml

@@ -1,4 +1,5 @@
-packages:
+common_packages:
   - dnsutils
   - ncdu
   - tree
+  - vim

roles/common/tasks/main.yml

@@ -2,35 +2,87 @@
   ansible.builtin.file:
     path: "~/.ansible/tmp"
     state: directory
-    mode: 0700
+    mode: "755"
+
+- name: Create system user groups
+  ansible.builtin.group:
+    name: "{{ item.key }}"
+    gid: "{{ item.value.gid }}"
+    state: present
+  loop: "{{ users | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: users is defined
+
+- name: Create system users
+  ansible.builtin.user:
+    name: "{{ item.key }}"
+    state: present
+    uid: "{{ item.value.uid }}"
+    group: "{{ item.value.gid }}"
+    groups: "{{ item.value.groups | default([]) }}"
+    shell: "{{ item.value.shell | default('/bin/bash') }}"
+    create_home: "{{ item.value.home | default(false) }}"
+    home: "{{ item.value.homedir | default('/home/' + item.key) }}"
+    system: "{{ item.value.system | default(false) }}"
+  loop: "{{ users | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: users is defined
+
+- name: Create Ansible's temporary remote directory for users
+  ansible.builtin.file:
+    path: "{{ item.value.homedir | default('/home/' + item.key) }}/.ansible/tmp"
+    state: directory
+    mode: "755"
+    owner: "{{ item.key }}"
+    group: "{{ item.value.gid }}"
+  loop: "{{ users | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when:
+    - users is defined
+    - item.value.ansible_temp | default(false)
+
+- name: Install EPEL repository
+  ansible.builtin.dnf:
+    name: epel-release
+    state: present
+    update_cache: true
 
 - name: Install useful software
-  ansible.builtin.apt:
-    name: "{{ packages }}"
+  ansible.builtin.dnf:
+    name: "{{ common_packages }}"
     state: present
     update_cache: true
 
-- name: Install the Uncomplicated Firewall
-  ansible.builtin.apt:
-    name: ufw
+- name: Install firewalld
+  ansible.builtin.dnf:
+    name: firewalld
     state: present
-    update_cache: true
 
-- name: Deny incoming traffic by default
-  community.general.ufw:
-    default: deny
-    direction: incoming
+- name: Start and enable firewalld service
+  ansible.builtin.systemd:
+    name: firewalld
+    state: started
+    enabled: true
 
-- name: Allow outgoing traffic by default
-  community.general.ufw:
-    default: allow
-    direction: outgoing
-
-- name: Allow OpenSSH with rate limiting
-  community.general.ufw:
-    name: ssh
-    rule: limit
-
-- name: Enable firewall
-  community.general.ufw:
+- name: Set default zone to drop (deny incoming by default)
+  ansible.posix.firewalld:
+    zone: drop
     state: enabled
+    permanent: true
+    immediate: true
+
+- name: Allow SSH in drop zone with rate limiting via rich rule
+  ansible.posix.firewalld:
+    zone: drop
+    rich_rule: 'rule service name="ssh" accept limit value="10/m"'
+    permanent: true
+    immediate: true
+    state: enabled
+
+- name: Set drop as the default zone
+  ansible.builtin.command:
+    cmd: firewall-cmd --set-default-zone=drop
+  changed_when: false