From d3763920a8cb869192f4091fa20cff56d358e036 Mon Sep 17 00:00:00 2001
From: Kris Lamoureux <kris@lamoureux.io>
Date: Mon, 7 Sep 2026 23:38:31 -0400
Subject: [PATCH] Add optional swap support to the base role

---
 roles/base/defaults/main.yml                |   3 +-
 roles/base/tasks/main.yml                   |   5 +
 roles/base/tasks/swap.yml                   | 117 ++++++++++++++++++++
 roles/base/templates/zram-generator.conf.j2 |   9 ++
 4 files changed, 133 insertions(+), 1 deletion(-)
 create mode 100644 roles/base/tasks/swap.yml
 create mode 100644 roles/base/templates/zram-generator.conf.j2

diff --git a/roles/base/defaults/main.yml b/roles/base/defaults/main.yml
index 77b516f..f109c23 100644
--- a/roles/base/defaults/main.yml
+++ b/roles/base/defaults/main.yml
@@ -21,6 +21,7 @@ base_packages:
   - vim
   - wget
 
-
 base_scripts: /srv/.scripts
 base_ssh_ufw_rule: limit
+base_swapfile_path: /swapfile
+base_swap_sysctl_file: /etc/sysctl.d/70-swap.conf
diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
index e2af720..baf039e 100644
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@@ -6,6 +6,11 @@
   ansible.builtin.import_tasks: system.yml
   tags: system
 
+- name: Import swap tasks
+  ansible.builtin.import_tasks: swap.yml
+  tags: swap
+  when: swap is defined
+
 - name: Import Firewall tasks
   ansible.builtin.import_tasks: firewall.yml
   tags: firewall
diff --git a/roles/base/tasks/swap.yml b/roles/base/tasks/swap.yml
new file mode 100644
index 0000000..c102a38
--- /dev/null
+++ b/roles/base/tasks/swap.yml
@@ -0,0 +1,117 @@
+- name: Install the zram generator
+  ansible.builtin.apt:
+    name: systemd-zram-generator
+    state: present
+  register: base_zram_pkg
+  when: swap.zram | default({}) | length > 0
+
+- name: Create the zram generator drop-in directory
+  ansible.builtin.file:
+    path: /etc/systemd/zram-generator.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: swap.zram | default({}) | length > 0
+
+- name: Configure zram swap devices
+  ansible.builtin.template:
+    src: zram-generator.conf.j2
+    dest: "/etc/systemd/zram-generator.conf.d/{{ item.key }}.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ swap.zram | default({}) | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  register: base_zram_conf
+
+- name: Reload systemd to run the zram generator
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: >-
+    base_zram_conf is changed
+    or base_zram_pkg is changed
+
+- name: Start zram swap devices
+  ansible.builtin.systemd_service:
+    name: "systemd-zram-setup@{{ item.key }}.service"
+    state: started
+  loop: "{{ swap.zram | default({}) | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+
+- name: Allocate the swapfile
+  ansible.builtin.command:
+    cmd: >-
+      dd if=/dev/zero of={{ base_swapfile_path }}
+      bs=1M count={{ swap.file.size_mb }}
+    creates: "{{ base_swapfile_path }}"
+  when: swap.file is defined
+
+- name: Secure and label the swapfile
+  ansible.builtin.file:
+    path: "{{ base_swapfile_path }}"
+    owner: root
+    group: root
+    mode: "0600"
+    setype: >-
+      {{ (selinux is defined and selinux is not false)
+        | ternary('swapfile_t', omit) }}
+  when: swap.file is defined
+
+- name: Check the swapfile for a swap signature
+  ansible.builtin.command:
+    cmd: "blkid -p -s TYPE -o value {{ base_swapfile_path }}"
+  register: base_swapfile_sig
+  changed_when: false
+  failed_when: false
+  when: swap.file is defined
+
+- name: Format the swapfile
+  ansible.builtin.command:
+    cmd: "mkswap {{ base_swapfile_path }}"
+  register: base_mkswap
+  changed_when: base_mkswap.rc == 0
+  when:
+    - swap.file is defined
+    - (base_swapfile_sig.stdout | default('')) != 'swap'
+
+- name: Add the swapfile to fstab
+  ansible.posix.mount:
+    path: none
+    src: "{{ base_swapfile_path }}"
+    fstype: swap
+    opts: "sw,pri={{ swap.file.priority | default(10) }}"
+    state: present
+  when: swap.file is defined
+
+- name: List active swap devices
+  ansible.builtin.command:
+    cmd: swapon --show=NAME --noheadings
+  register: base_swap_active
+  changed_when: false
+  when: swap.file is defined
+
+- name: Enable the swapfile
+  ansible.builtin.command:
+    cmd: >-
+      swapon --priority {{ swap.file.priority | default(10) }}
+      {{ base_swapfile_path }}
+  register: base_swapon
+  changed_when: base_swapon.rc == 0
+  when:
+    - swap.file is defined
+    - base_swapfile_path not in (base_swap_active.stdout_lines | default([]))
+
+- name: Configure virtual memory sysctls
+  ansible.posix.sysctl:
+    name: "{{ item.key }}"
+    value: "{{ item.value }}"
+    sysctl_file: "{{ base_swap_sysctl_file }}"
+    sysctl_set: true
+    reload: true
+    state: present
+  loop: "{{ swap.sysctls | default({}) | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
diff --git a/roles/base/templates/zram-generator.conf.j2 b/roles/base/templates/zram-generator.conf.j2
new file mode 100644
index 0000000..161f8ca
--- /dev/null
+++ b/roles/base/templates/zram-generator.conf.j2
@@ -0,0 +1,9 @@
+# Managed by Ansible
+[{{ item.key }}]
+zram-size = {{ item.value.size | default('ram') }}
+compression-algorithm = {{ item.value.algorithm | default('zstd') }}
+{% if item.value.writeback_device is defined %}
+writeback-device = {{ item.value.writeback_device }}
+{% endif %}
+swap-priority = {{ item.value.priority | default(100) }}
+fs-type = {{ item.value.fs_type | default('swap') }}