Implement Podman-based Docker Compose projects
This commit is contained in:
219
roles/podman/tasks/deploy.yml
Normal file
219
roles/podman/tasks/deploy.yml
Normal file
@@ -0,0 +1,219 @@
|
||||
- name: Get user info for podman compose user
|
||||
ansible.builtin.getent:
|
||||
database: passwd
|
||||
key: "{{ podman_user }}"
|
||||
register: podman_user_info
|
||||
|
||||
- name: Set user-specific variables
|
||||
ansible.builtin.set_fact:
|
||||
podman_rootdir: "{{ podman_compose_config.root }}"
|
||||
podman_userid: "{{ podman_user_info.ansible_facts.getent_passwd[podman_user][1] }}"
|
||||
podman_homedir: "{{ podman_user_info.ansible_facts.getent_passwd[podman_user][4] }}"
|
||||
podman_project: "{{ podman_compose_config.compose }}"
|
||||
podman_repos: "{{ podman_compose_config.root }}/.compose_repos"
|
||||
|
||||
- name: Create docker compose (podman) root directory for user
|
||||
ansible.builtin.file:
|
||||
path: "{{ podman_rootdir }}"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "0700"
|
||||
|
||||
- name: Create user systemd directory
|
||||
ansible.builtin.file:
|
||||
path: "/home/{{ podman_user }}/.config/systemd/user"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Install docker compose (podman) systemd service for user
|
||||
ansible.builtin.template:
|
||||
src: compose.service.j2
|
||||
dest: "/home/{{ podman_user }}/.config/systemd/user/compose@.service"
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "0644"
|
||||
notify: podman_compose_systemd
|
||||
|
||||
- name: Create directories for cloning docker compose (podman) repositories
|
||||
ansible.builtin.file:
|
||||
path: "{{ repo_dir }}"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "0700"
|
||||
loop:
|
||||
- "{{ podman_repos }}"
|
||||
loop_control:
|
||||
loop_var: repo_dir
|
||||
when:
|
||||
- podman_project is defined
|
||||
- podman_project | length > 0
|
||||
|
||||
- name: Create .ssh directory for podman compose user
|
||||
ansible.builtin.file:
|
||||
path: "{{ podman_homedir }}/.ssh"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "0700"
|
||||
when:
|
||||
- podman_project is defined
|
||||
- podman_project | length > 0
|
||||
|
||||
- name: Generate OpenSSH deploy keys for docker compose (podman) clones
|
||||
community.crypto.openssh_keypair:
|
||||
path: "{{ podman_ssh_key_path }}/podman-id_{{ podman_repos_keytype }}"
|
||||
type: "{{ podman_repos_keytype }}"
|
||||
comment: "{{ ansible_hostname }}-{{ podman_user }}-deploy-key"
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "0600"
|
||||
state: present
|
||||
when: podman_project is defined
|
||||
|
||||
- name: Import trusted GPG keys for docker compose (podman) projects
|
||||
ansible.builtin.command:
|
||||
cmd: "gpg --keyserver {{ key.keyserver | default('keys.openpgp.org') }} --recv-key {{ key.id }}"
|
||||
become: true
|
||||
become_user: "{{ podman_user }}"
|
||||
loop: "{{ podman_compose_config.trusted_keys }}"
|
||||
loop_control:
|
||||
loop_var: key
|
||||
label: "{{ key.id }}"
|
||||
changed_when: false
|
||||
when: podman_compose_config.trusted_keys is defined
|
||||
|
||||
- name: Clone external docker compose (podman) projects
|
||||
ansible.builtin.git:
|
||||
repo: "{{ project.url }}"
|
||||
dest: "{{ podman_repos }}/{{ project.name }}"
|
||||
version: "{{ project.version }}"
|
||||
accept_newhostkey: "{{ project.accept_newhostkey | default(false) }}"
|
||||
gpg_allowlist: "{{ (project.trusted_keys |
|
||||
default(podman_compose_config.trusted_keys | default([]))) |
|
||||
map(attribute='id') | list }}"
|
||||
verify_commit: >-
|
||||
{{
|
||||
true if
|
||||
(project.trusted_keys is defined and project.trusted_keys) or
|
||||
(
|
||||
podman_compose_config.trusted_keys is defined and
|
||||
podman_compose_config.trusted_keys
|
||||
)
|
||||
else false
|
||||
}}
|
||||
key_file: "{{ podman_ssh_key_path }}/podman-id_{{ podman_repos_keytype }}"
|
||||
become: true
|
||||
become_user: "{{ podman_user }}"
|
||||
loop: "{{ podman_project }}"
|
||||
loop_control:
|
||||
loop_var: project
|
||||
label: "{{ project.url }}"
|
||||
when:
|
||||
- podman_project is defined
|
||||
- podman_project | length > 0
|
||||
|
||||
- name: Create directories for docker compose (podman) projects
|
||||
ansible.builtin.file:
|
||||
path: "{{ podman_rootdir }}/{{ project.name }}"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "0700"
|
||||
loop: "{{ podman_project }}"
|
||||
loop_control:
|
||||
loop_var: project
|
||||
label: "{{ project.name }}"
|
||||
when:
|
||||
- podman_project is defined
|
||||
- podman_project | length > 0
|
||||
|
||||
- name: Synchronize docker-compose.yml
|
||||
ansible.posix.synchronize:
|
||||
# noqa jinja[spacing]
|
||||
src: >-
|
||||
{{ podman_repos }}/{{ project.name }}/
|
||||
{{- project.path | default('docker-compose.yml') }}
|
||||
dest: "{{ podman_rootdir }}/{{ project.name }}/docker-compose.yml"
|
||||
owner: false
|
||||
group: false
|
||||
delegate_to: "{{ inventory_hostname }}"
|
||||
register: podman_compose_update
|
||||
notify:
|
||||
- podman_compose_restart
|
||||
- podman_compose_enable
|
||||
loop: "{{ podman_project | default([]) }}"
|
||||
loop_control:
|
||||
loop_var: project
|
||||
label: "{{ project.name }}"
|
||||
when:
|
||||
- podman_project is defined
|
||||
- podman_project | length > 0
|
||||
|
||||
- name: Update list of compose projects updated
|
||||
ansible.builtin.set_fact:
|
||||
podman_compose_restart_list:
|
||||
"{{ (podman_compose_restart_list | default([])) +
|
||||
[{'user': podman_user, 'service': item.project.name}] }}"
|
||||
loop: "{{ podman_compose_update.results }}"
|
||||
loop_control:
|
||||
label: "{{ podman_user }}/{{ item.project.name }}"
|
||||
when: (podman_compose_update.results | default([]) | length) > 0
|
||||
|
||||
- name: Fix ownership of synchronized compose files
|
||||
ansible.builtin.file:
|
||||
path: "{{ podman_rootdir }}/{{ project.name }}/docker-compose.yml"
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "0664"
|
||||
loop: "{{ podman_project | default([]) }}"
|
||||
loop_control:
|
||||
loop_var: project
|
||||
label: "{{ project.name }}"
|
||||
when:
|
||||
- podman_project is defined
|
||||
- podman_project | length > 0
|
||||
|
||||
- name: Set environment variables for docker compose (podman) projects
|
||||
ansible.builtin.template:
|
||||
src: compose-env.j2
|
||||
dest: "{{ podman_rootdir }}/{{ project.name }}/.env"
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "0600"
|
||||
register: podman_compose_env_update
|
||||
notify:
|
||||
- podman_compose_restart
|
||||
- podman_compose_enable
|
||||
no_log: true
|
||||
loop: "{{ podman_project }}"
|
||||
loop_control:
|
||||
loop_var: project
|
||||
label: "{{ project.name }}"
|
||||
when: podman_project is defined and project.env is defined
|
||||
|
||||
- name: Update list of compose projects who updated their .env
|
||||
ansible.builtin.set_fact:
|
||||
# noqa jinja[spacing]
|
||||
podman_compose_restart_list: "{{
|
||||
(podman_compose_restart_list | default([]))
|
||||
+ ([{'user': podman_user,'service': item.project.name}]
|
||||
if {'user': podman_user, 'service': item.project.name}
|
||||
not in (podman_compose_restart_list | default([]))
|
||||
else [])
|
||||
}}"
|
||||
loop: "{{ podman_compose_env_update.results }}"
|
||||
loop_control:
|
||||
label: "{{ podman_user }}/{{ item.project.name }}"
|
||||
when: (podman_compose_env_update.results | default([]) | length) > 0
|
||||
|
||||
- name: Update list of enabled compose projects
|
||||
ansible.builtin.set_fact:
|
||||
podman_compose_enable_list: >-
|
||||
{{ (podman_compose_enable_list | default([]))
|
||||
+ [{'user': podman_user, 'service': project.name}] }}
|
||||
when: project.enabled | default(false)
|
||||
notify: podman_compose_enable
|
||||
@@ -1,14 +1,23 @@
|
||||
- name: Install Podman
|
||||
- name: Install Podman with Docker CLI tools
|
||||
ansible.builtin.apt:
|
||||
name: ["podman", "podman-compose", "podman-docker"]
|
||||
name: ["podman", "docker-cli", "docker-compose"]
|
||||
state: present
|
||||
|
||||
- name: Get user info for namespace users
|
||||
- name: Install GnuPG tools and trusted CA bundle
|
||||
ansible.builtin.apt:
|
||||
name: ["gnupg", "ca-certificates"]
|
||||
state: present
|
||||
when: podman_compose is defined
|
||||
|
||||
- name: Get podman user info for user namespace configuration
|
||||
ansible.builtin.getent:
|
||||
database: passwd
|
||||
key: "{{ item }}"
|
||||
loop: "{{ user_namespaces }}"
|
||||
loop: "{{ podman_compose.keys() | list }}"
|
||||
register: user_info
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when: podman_compose is defined
|
||||
|
||||
- name: Configure /etc/subuid for rootless users
|
||||
ansible.builtin.lineinfile:
|
||||
@@ -22,6 +31,8 @@
|
||||
backup: true
|
||||
mode: "0644"
|
||||
loop: "{{ user_info.results }}"
|
||||
loop_control:
|
||||
label: "{{ item.item }}"
|
||||
|
||||
- name: Configure /etc/subgid for rootless users
|
||||
ansible.builtin.lineinfile:
|
||||
@@ -35,14 +46,33 @@
|
||||
backup: true
|
||||
mode: "0644"
|
||||
loop: "{{ user_info.results }}"
|
||||
loop_control:
|
||||
label: "{{ item.item }}"
|
||||
|
||||
- name: Create nodocker file to disable Docker CLI emulation message
|
||||
ansible.builtin.file:
|
||||
path: /etc/containers/nodocker
|
||||
state: touch
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
- name: Enable lingering for podman compose user
|
||||
ansible.builtin.command:
|
||||
cmd: "loginctl enable-linger {{ item.item }}"
|
||||
changed_when: false
|
||||
loop: "{{ user_info.results }}"
|
||||
loop_control:
|
||||
label: "{{ item.item }}"
|
||||
|
||||
- name: Start and enable the Podman socket
|
||||
ansible.builtin.systemd:
|
||||
name: podman.socket
|
||||
state: started
|
||||
enabled: true
|
||||
scope: user
|
||||
vars:
|
||||
uid: "{{ item.ansible_facts.getent_passwd[item.item][1] }}"
|
||||
environment:
|
||||
XDG_RUNTIME_DIR: "/run/user/{{ uid }}"
|
||||
DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ uid }}/bus"
|
||||
become: true
|
||||
become_user: "{{ item.item }}"
|
||||
loop: "{{ user_info.results }}"
|
||||
loop_control:
|
||||
label: "{{ item.item }}"
|
||||
|
||||
- name: Create global containers config directory
|
||||
ansible.builtin.file:
|
||||
@@ -58,5 +88,29 @@
|
||||
events_logger = "journald"
|
||||
runtime = "crun"
|
||||
dest: /etc/containers/containers.conf
|
||||
mode: "0644"
|
||||
backup: true
|
||||
mode: "0644"
|
||||
|
||||
- name: Configure Docker CLI to use rootless Podman socket
|
||||
ansible.builtin.copy:
|
||||
src: files/docker-host.sh
|
||||
dest: /etc/profile.d/docker-host.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Install git for repository cloning
|
||||
ansible.builtin.apt:
|
||||
name: git
|
||||
state: present
|
||||
when: podman_compose is defined
|
||||
|
||||
- name: Deploy Podman compose projects for each user
|
||||
ansible.builtin.include_tasks: deploy.yml
|
||||
vars:
|
||||
podman_user: "{{ compose_user.key }}"
|
||||
podman_compose_config: "{{ compose_user.value }}"
|
||||
loop: "{{ podman_compose | dict2items }}"
|
||||
loop_control:
|
||||
loop_var: compose_user
|
||||
when: podman_compose is defined
|
||||
|
||||
Reference in New Issue
Block a user