testing

roles/podman/tasks/deploy.yml

@@ -0,0 +1,182 @@
+- name: Get user info for podman compose user
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ podman_user }}"
+  register: podman_user_info
+
+- name: Set user-specific variables
+  ansible.builtin.set_fact:
+    podman_rootdir: "{{ podman_compose_config.root }}"
+    podman_userid: "{{ podman_user_info.ansible_facts.getent_passwd[podman_user][1] }}"
+    podman_compose: "{{ podman_compose_config.compose }}"
+    podman_repos: "{{ podman_compose_config.root }}/.compose_repos"
+
+- name: Create podman-compose root directory for user
+  ansible.builtin.file:
+    path: "{{ podman_rootdir }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: "0700"
+
+- name: Create user systemd directory
+  ansible.builtin.file:
+    path: "/home/{{ podman_user }}/.config/systemd/user"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: "0755"
+
+- name: Install podman-compose systemd service for user
+  ansible.builtin.template:
+    src: podman-compose.service.j2
+    dest: "/home/{{ podman_user }}/.config/systemd/user/podman-compose@.service"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: "0644"
+  notify: podman_compose_systemd
+
+- name: Create directories for cloning podman-compose repositories
+  ansible.builtin.file:
+    path: "{{ repo_dir }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: "0700"
+  loop:
+    - "{{ podman_repos }}"
+  loop_control:
+    loop_var: repo_dir
+  when:
+    - podman_compose is defined
+    - podman_compose | length > 0
+
+- name: Create .ssh directory for podman compose user
+  ansible.builtin.file:
+    path: "{{ podman_ssh_key_path }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: "0700"
+  when:
+    - podman_compose is defined
+    - podman_compose | length > 0
+
+- name: Generate OpenSSH deploy keys for podman-compose clones
+  community.crypto.openssh_keypair:
+    path: "{{ podman_ssh_key_path }}/podman-id_{{ podman_repos_keytype }}"
+    type: "{{ podman_repos_keytype }}"
+    comment: "{{ ansible_hostname }}-{{ podman_user }}-deploy-key"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: "0600"
+    state: present
+  when: podman_compose is defined
+
+- name: Import trusted GPG keys for podman-compose projects
+  ansible.builtin.command:
+    cmd: "gpg --keyserver {{ key.keyserver | default('keys.openpgp.org') }} --recv-key {{ key.id }}"
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ podman_compose_config.trusted_keys }}"
+  loop_control:
+    loop_var: key
+    label: "{{ key.id }}"
+  changed_when: false
+  when: podman_compose_config.trusted_keys is defined
+
+- name: Clone external podman-compose projects
+  ansible.builtin.git:
+    repo: "{{ project.url }}"
+    dest: "{{ podman_repos }}/{{ project.name }}"
+    version: "{{ project.version }}"
+    accept_newhostkey: "{{ project.accept_newhostkey | default(false) }}"
+    gpg_whitelist: "{{ (project.trusted_keys | default(podman_compose_config.trusted_keys | default([]))) | map(attribute='id') | list }}"
+    verify_commit: >-
+      {{ true if (project.trusted_keys is defined and project.trusted_keys) or
+         (podman_compose_config.trusted_keys is defined and podman_compose_config.trusted_keys)
+         else false }}
+    key_file: "{{ podman_ssh_key_path }}/podman-id_{{ podman_repos_keytype }}"
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ podman_compose }}"
+  loop_control:
+    loop_var: project
+    label: "{{ project.url }}"
+  when:
+    - podman_compose is defined
+    - podman_compose | length > 0
+
+- name: Create directories for podman-compose projects
+  ansible.builtin.file:
+    path: "{{ podman_rootdir }}/{{ project.name }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: "0700"
+  loop: "{{ podman_compose }}"
+  loop_control:
+    loop_var: project
+    label: "{{ project.name }}"
+  when:
+    - podman_compose is defined
+    - podman_compose | length > 0
+
+- name: Synchronize podman-compose.yml (or docker-compose.yml)
+  ansible.posix.synchronize:
+    src: "{{ podman_repos }}/{{ project.name }}/{{ project.path | default('docker-compose.yml') }}"
+    dest: "{{ podman_rootdir }}/{{ project.name }}/docker-compose.yml"
+    owner: false
+    group: false
+  delegate_to: "{{ inventory_hostname }}"
+  register: podman_compose_update
+  notify:
+    - podman_compose_restart
+    - podman_compose_enable
+  loop: "{{ podman_compose | default([]) }}"
+  loop_control:
+    loop_var: project
+    label: "{{ project.name }}"
+  when:
+    - podman_compose is defined
+    - podman_compose | length > 0
+
+- name: Fix ownership of synchronized compose files
+  ansible.builtin.file:
+    path: "{{ podman_rootdir }}/{{ project.name }}/docker-compose.yml"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: "0600"
+  loop: "{{ podman_compose | default([]) }}"
+  loop_control:
+    loop_var: project
+    label: "{{ project.name }}"
+  when:
+    - podman_compose is defined
+    - podman_compose | length > 0
+
+- name: Set environment variables for podman-compose projects
+  ansible.builtin.template:
+    src: podman-compose-env.j2
+    dest: "{{ podman_rootdir }}/{{ project.name }}/.env"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: "0600"
+  register: podman_compose_env_update
+  notify:
+    - podman_compose_restart
+    - podman_compose_enable
+  no_log: true
+  loop: "{{ podman_compose }}"
+  loop_control:
+    loop_var: project
+    label: "{{ project.name }}"
+  when: podman_compose is defined and project.env is defined
+
+- name: Enable lingering for podman compose user
+  ansible.builtin.command:
+    cmd: "loginctl enable-linger {{ podman_user }}"
+  changed_when: false
+  when:
+    - podman_compose is defined
+    - podman_compose | length > 0

roles/podman/tasks/main.yml

@@ -43,6 +43,7 @@
     owner: root
     group: root
     mode: "0644"
+  when: podman_nodocker | bool
 
 - name: Create global containers config directory
   ansible.builtin.file:
@@ -60,3 +61,17 @@
     dest: /etc/containers/containers.conf
     mode: "0644"
     backup: true
+
+- name: Install git for repository cloning
+  ansible.builtin.apt:
+    name: git
+    state: present
+  when: podman_compose_deploy is defined
+
+- name: Deploy Podman compose projects for each user
+  ansible.builtin.include_tasks: deploy.yml
+  vars:
+    podman_user: "{{ item.key }}"
+    podman_compose_config: "{{ item.value }}"
+  loop: "{{ podman_compose_deploy | dict2items }}"
+  when: podman_compose_deploy is defined