homelab/roles/podman/tasks/deploy.yml

- name: Get user info for podman compose user
  ansible.builtin.getent:
    database: passwd
    key: "{{ podman_user }}"
  register: podman_user_info

- name: Set user-specific variables
  ansible.builtin.set_fact:
    podman_rootdir: "{{ podman_compose_config.root }}"
    podman_userid: "{{ podman_user_info.ansible_facts.getent_passwd[podman_user][1] }}"
    podman_compose: "{{ podman_compose_config.compose }}"
    podman_repos: "{{ podman_compose_config.root }}/.compose_repos"

- name: Create podman-compose root directory for user
  ansible.builtin.file:
    path: "{{ podman_rootdir }}"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_user }}"
    mode: "0700"

- name: Create user systemd directory
  ansible.builtin.file:
    path: "/home/{{ podman_user }}/.config/systemd/user"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_user }}"
    mode: "0755"

- name: Install podman-compose systemd service for user
  ansible.builtin.template:
    src: podman-compose.service.j2
    dest: "/home/{{ podman_user }}/.config/systemd/user/podman-compose@.service"
    owner: "{{ podman_user }}"
    group: "{{ podman_user }}"
    mode: "0644"
  notify: podman_compose_systemd

- name: Create directories for cloning podman-compose repositories
  ansible.builtin.file:
    path: "{{ repo_dir }}"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_user }}"
    mode: "0700"
  loop:
    - "{{ podman_repos }}"
  loop_control:
    loop_var: repo_dir
  when:
    - podman_compose is defined
    - podman_compose | length > 0

- name: Create .ssh directory for podman compose user
  ansible.builtin.file:
    path: "{{ podman_ssh_key_path }}"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_user }}"
    mode: "0700"
  when:
    - podman_compose is defined
    - podman_compose | length > 0

- name: Generate OpenSSH deploy keys for podman-compose clones
  community.crypto.openssh_keypair:
    path: "{{ podman_ssh_key_path }}/podman-id_{{ podman_repos_keytype }}"
    type: "{{ podman_repos_keytype }}"
    comment: "{{ ansible_hostname }}-{{ podman_user }}-deploy-key"
    owner: "{{ podman_user }}"
    group: "{{ podman_user }}"
    mode: "0600"
    state: present
  when: podman_compose is defined

- name: Import trusted GPG keys for podman-compose projects
  ansible.builtin.command:
    cmd: "gpg --keyserver {{ key.keyserver | default('keys.openpgp.org') }} --recv-key {{ key.id }}"
  become: true
  become_user: "{{ podman_user }}"
  loop: "{{ podman_compose_config.trusted_keys }}"
  loop_control:
    loop_var: key
    label: "{{ key.id }}"
  changed_when: false
  when: podman_compose_config.trusted_keys is defined

- name: Clone external podman-compose projects
  ansible.builtin.git:
    repo: "{{ project.url }}"
    dest: "{{ podman_repos }}/{{ project.name }}"
    version: "{{ project.version }}"
    accept_newhostkey: "{{ project.accept_newhostkey | default(false) }}"
    gpg_whitelist: "{{ (project.trusted_keys | default(podman_compose_config.trusted_keys | default([]))) | map(attribute='id') | list }}"
    verify_commit: >-
      {{ true if (project.trusted_keys is defined and project.trusted_keys) or
         (podman_compose_config.trusted_keys is defined and podman_compose_config.trusted_keys)
         else false }}
    key_file: "{{ podman_ssh_key_path }}/podman-id_{{ podman_repos_keytype }}"
  become: true
  become_user: "{{ podman_user }}"
  loop: "{{ podman_compose }}"
  loop_control:
    loop_var: project
    label: "{{ project.url }}"
  when:
    - podman_compose is defined
    - podman_compose | length > 0

- name: Create directories for podman-compose projects
  ansible.builtin.file:
    path: "{{ podman_rootdir }}/{{ project.name }}"
    state: directory
    owner: "{{ podman_user }}"
    group: "{{ podman_user }}"
    mode: "0700"
  loop: "{{ podman_compose }}"
  loop_control:
    loop_var: project
    label: "{{ project.name }}"
  when:
    - podman_compose is defined
    - podman_compose | length > 0

- name: Synchronize podman-compose.yml (or docker-compose.yml)
  ansible.posix.synchronize:
    src: "{{ podman_repos }}/{{ project.name }}/{{ project.path | default('docker-compose.yml') }}"
    dest: "{{ podman_rootdir }}/{{ project.name }}/docker-compose.yml"
    owner: false
    group: false
  delegate_to: "{{ inventory_hostname }}"
  register: podman_compose_update
  notify:
    - podman_compose_restart
    - podman_compose_enable
  loop: "{{ podman_compose | default([]) }}"
  loop_control:
    loop_var: project
    label: "{{ project.name }}"
  when:
    - podman_compose is defined
    - podman_compose | length > 0

- name: Fix ownership of synchronized compose files
  ansible.builtin.file:
    path: "{{ podman_rootdir }}/{{ project.name }}/docker-compose.yml"
    owner: "{{ podman_user }}"
    group: "{{ podman_user }}"
    mode: "0600"
  loop: "{{ podman_compose | default([]) }}"
  loop_control:
    loop_var: project
    label: "{{ project.name }}"
  when:
    - podman_compose is defined
    - podman_compose | length > 0

- name: Set environment variables for podman-compose projects
  ansible.builtin.template:
    src: podman-compose-env.j2
    dest: "{{ podman_rootdir }}/{{ project.name }}/.env"
    owner: "{{ podman_user }}"
    group: "{{ podman_user }}"
    mode: "0600"
  register: podman_compose_env_update
  notify:
    - podman_compose_restart
    - podman_compose_enable
  no_log: true
  loop: "{{ podman_compose }}"
  loop_control:
    loop_var: project
    label: "{{ project.name }}"
  when: podman_compose is defined and project.env is defined

- name: Enable lingering for podman compose user
  ansible.builtin.command:
    cmd: "loginctl enable-linger {{ podman_user }}"
  changed_when: false
  when:
    - podman_compose is defined
    - podman_compose | length > 0