Migrate from Docker on Debian to Podman on Rocky

- Upgrade base OS from Debian 11 to Rocky Linux 9
- Configure 100GB XFS filesystem with auto-expansion
- Replace Docker with rootless Podman for improved security
- Add nginx reverse proxy for non-privileged port handling
- Move the Traefik dashboard from port 8443 to 9443
- Configure SELinux contexts for container operations

roles/webserver/files/docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.5'
-
 volumes:
   wordpress:
   nextcloud:
@@ -10,8 +8,10 @@ networks:
 
 services:
   traefik:
-    image: traefik:${TRAEFIK_VERSION:-latest}
+    image: ${TRAEFIK_IMAGE:-docker.io/library/traefik}:${TRAEFIK_VERSION:-latest}
     restart: always
+    security_opt:
+      - label=type:container_runtime_t
     command:
       - --api.dashboard=${TRAEFIK_DASHBOARD:-true}
       - --api.debug=${TRAEFIK_DEBUG:-false}
@@ -20,7 +20,7 @@ services:
       - --providers.docker.exposedbydefault=${TRAEFIK_EXPOSED_DEFAULT:-false}
       - --entrypoints.web.address=:80
       - --entrypoints.websecure.address=:443
-      - --entrypoints.local.address=:8443
+      - --entrypoints.local.address=:9443
       - --entrypoints.web.http.redirections.entrypoint.to=websecure
       - --entrypoints.web.http.redirections.entrypoint.scheme=https
       - --entrypoints.web.http.redirections.entrypoint.permanent=true
@@ -33,11 +33,11 @@ services:
     environment:
       DREAMHOST_API_KEY: ${TRAEFIK_DREAMHOST_APIKEY}
     ports:
-      - 80:80
-      - 443:443
-      - "127.0.0.1:8443:8443"
+      - "${ENTRYWEB:-127.0.0.1:8080}:80"
+      - "${ENTRYSECURE:-127.0.0.1:8443}:443"
+      - "${ENTRYLOCAL:-127.0.0.1:9443}:9443"
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - ${OCI_SOCK:-/run/user/2000/podman/podman.sock}:/var/run/docker.sock:ro,Z
       - ./.acme:/etc/letsencrypt
     labels:
       traefik.http.routers.api.rule: Host(`${TRAEFIK_DOMAIN:-traefik.local.freeitathens.org}`)
@@ -52,7 +52,7 @@ services:
       - traefik
 
   wordpress:
-    image: wordpress:${WORDPRESS_VERSION:-latest}
+    image: ${WORDPRESS_IMAGE:-docker.io/library/wordpress}:${WORDPRESS_VERSION:-latest}
     restart: always
     environment:
       WORDPRESS_DB_HOST: ${WORDPRESS_DB_HOST:-host.docker.internal}
@@ -81,7 +81,7 @@ services:
       - host.docker.internal:host-gateway
 
   nextcloud:
-    image: nextcloud:${NEXTCLOUD_VERSION:-stable}
+    image: ${NEXTCLOUD_IMAGE:-docker.io/library/nextcloud}:${NEXTCLOUD_VERSION:-stable}
     restart: always
     environment:
       MYSQL_HOST: ${NEXTCLOUD_MYSQL_HOST:-host.docker.internal:3306}

roles/webserver/files/nginx.conf

@@ -0,0 +1,22 @@
+user nginx;
+worker_processes auto;
+error_log /var/log/nginx/error.log;
+pid /run/nginx.pid;
+
+include /usr/share/nginx/modules/*.conf;
+
+events {
+    worker_connections 1024;
+}
+
+stream {
+    server {
+        listen 80;
+        proxy_pass 127.0.0.1:8080;
+    }
+
+    server {
+        listen 443;
+        proxy_pass 127.0.0.1:8443;
+    }
+}

roles/webserver/handlers/main.yml

@@ -1,14 +1,38 @@
+- name: Restart nginx
+  ansible.builtin.systemd:
+    name: nginx
+    state: restarted
+
 - name: Restart MariaDB
   ansible.builtin.service:
     name: mariadb
     state: restarted
   listen: restart_mariadb
 
-- name: Compose up on webserver stack
-  ansible.builtin.command: "docker-compose up -d"
-  args:
-    chdir: "{{ webserver_root }}"
-  listen: composeup_webserver
+- name: Start podman compose project
+  ansible.builtin.command:
+    cmd: podman compose up -d
+    chdir: "/home/oci/webserver"
+  notify: Generate systemd service files
+  changed_when: false
+  become_user: oci
+  become: true
+
+- name: Reload systemd user daemon
+  ansible.builtin.systemd:
+    daemon_reload: true
+    scope: user
+  notify: Enable systemd user service
+  become_user: oci
+  become: true
+
+- name: Enable systemd user service
+  ansible.builtin.systemd:
+    name: webserver
+    enabled: true
+    scope: user
+  become_user: oci
+  become: true
 
 - name: Grab Nextcloud container information
   community.docker.docker_container_info:
@@ -23,8 +47,9 @@
   listen: composeup_webserver
 
 - name: Check Nextcloud status
-  ansible.builtin.command: "docker exec --user www-data {{ webserver_root | basename }}_nextcloud_1
-            php occ status"
+  ansible.builtin.command:
+    "docker exec --user www-data {{ webserver_root | basename }}_nextcloud_1
+    php occ status"
   listen: composeup_webserver
   register: nextcloud_status
 
@@ -34,3 +59,12 @@
   when:
     - nextcloud_status.stderr[:26] == "Nextcloud is not installed"
     - nextcloud_autoinstall
+
+- name: Install webserver docker-compose.yml
+  ansible.builtin.copy:
+    src: docker-compose.yml
+    dest: /home/oci/webserver/compose.yml
+    mode: "600"
+    owner: oci
+    group: oci
+  notify: Generate systemd service files

roles/webserver/tasks/main.yml

@@ -1,72 +1,96 @@
 - name: Install MariaDB Server
-  ansible.builtin.apt:
+  ansible.builtin.dnf:
     name: mariadb-server
     state: present
 
 - name: Change the bind-address to allow Docker
   ansible.builtin.lineinfile:
-    path: /etc/mysql/mariadb.conf.d/50-server.cnf
+    path: /etc/my.cnf.d/mariadb-server.cnf
     regex: "^bind-address"
     line: "bind-address            = 0.0.0.0"
   notify: restart_mariadb
 
+- name: Start and enable MariaDB service
+  ansible.builtin.systemd:
+    name: mariadb
+    state: started
+    enabled: true
+
 - name: Install MySQL Support for Python 3
-  ansible.builtin.apt:
-    name: python3-pymysql
+  ansible.builtin.dnf:
+    name: python3-PyMySQL
     state: present
 
 - name: Create MariaDB databases
   community.mysql.mysql_db:
     name: "{{ item.name }}"
     state: present
-    login_unix_socket: /var/run/mysqld/mysqld.sock
+    login_unix_socket: /var/lib/mysql/mysql.sock
   loop: "{{ databases }}"
-  no_log: "{{ item.pass is defined }}"
+  no_log: true
 
 - name: Create MariaDB users
   community.mysql.mysql_user:
     name: "{{ item.name }}"
     password: "{{ item.pass }}"
-    host: '%'
+    host: "%"
     state: present
     priv: "{{ item.name }}.*:ALL"
-    login_unix_socket: /var/run/mysqld/mysqld.sock
+    login_unix_socket: /var/lib/mysql/mysql.sock
   loop: "{{ databases }}"
-  no_log: "{{ item.pass is defined }}"
+  no_log: true
 
-- name: Create webserver docker-compose directory
+- name: Create webserver stack directory
   ansible.builtin.file:
-    path: "{{ webserver_root }}"
+    path: /home/oci/webserver
     state: directory
-    mode: 0600
+    mode: "700"
+    owner: oci
+    group: oci
 
-- name: Install webserver docker-compose.yml
+- name: Install webserver compose file
   ansible.builtin.copy:
     src: docker-compose.yml
-    dest: "{{ webserver_root }}/docker-compose.yml"
-    mode: 0600
-  notify: composeup_webserver
+    dest: /home/oci/webserver/compose.yml
+    mode: "600"
+    owner: oci
+    group: oci
+  notify: Start podman compose project
 
-- name: Install docker-compose .env
+- name: Generate webserver environment configuration
   ansible.builtin.template:
     src: compose-env.j2
-    dest: "{{ webserver_root }}/.env"
-    mode: 0600
-  notify: composeup_webserver
+    dest: /home/oci/webserver/.env
+    mode: "400"
+    owner: oci
+    group: oci
+  notify: Start podman compose project
 
-- name: Allow MariaDB database connections
-  community.general.ufw:
-    rule: allow
-    port: 3306
-    proto: tcp
-    src: "{{ item }}"
-  loop: "{{ mariadb_trust }}"
+- name: Install nginx
+  ansible.builtin.dnf:
+    name: ["nginx", "nginx-mod-stream"]
+    state: present
+    update_cache: true
 
-- name: Add HTTP and HTTPS firewall rule
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
+- name: Deploy nginx proxy config
+  ansible.builtin.copy:
+    src: nginx.conf
+    dest: /etc/nginx/nginx.conf
+    mode: "644"
+  notify: Restart nginx
+
+- name: Allow HTTP and HTTPS in firewall
+  ansible.posix.firewalld:
+    service: "{{ item }}"
+    permanent: true
+    state: enabled
+    immediate: true
   loop:
-    - "80"
-    - "443"
+    - http
+    - https
+
+- name: Start and enable nginx
+  ansible.builtin.systemd:
+    name: nginx
+    state: started
+    enabled: true