82 lines
2.2 KiB
YAML
82 lines
2.2 KiB
YAML
|
# code: language=ansible
|
||
|
|
|
||
|
|
- name: Install podman packages
|
||
|
|
community.general.pacman:
|
||
|
|
name:
|
||
|
|
- nginx
|
||
|
|
- podman
|
||
|
|
- passt
|
||
|
|
- podlet
|
||
|
|
- podman-compose
|
||
|
|
state: present
|
||
|
|
update_cache: true
|
||
|
|
|
||
|
|
- name: Enable kernel.unprivileged_userns_clone
|
||
|
|
ansible.posix.sysctl:
|
||
|
|
name: kernel.unprivileged_userns_clone
|
||
|
|
reload: true
|
||
|
|
state: present
|
||
|
|
sysctl_set: true
|
||
|
|
value: 1
|
||
|
|
|
||
|
|
- name: Create an unprivileged user to run quadlet files as
|
||
|
|
ansible.builtin.user:
|
||
|
|
comment: Quadlet services user
|
||
|
|
create_home: false
|
||
|
|
home: /
|
||
|
|
name: quadlet
|
||
|
|
password: '!'
|
||
|
|
password_lock: true
|
||
|
|
shell: /usr/bin/nologin
|
||
|
|
state: present
|
||
|
|
system: true
|
||
|
|
|
||
|
|
- name: Ensure quadlet user parent directory exists
|
||
|
|
ansible.builtin.file:
|
||
|
|
group: root
|
||
|
|
mode: '0755'
|
||
|
|
owner: root
|
||
|
|
path: /etc/containers/systemd/users
|
||
|
|
state: directory
|
||
|
|
|
||
|
|
- name: Create quadlet user directory
|
||
|
|
ansible.builtin.file:
|
||
|
|
group: quadlet
|
||
|
|
mode: '0775'
|
||
|
|
owner: quadlet
|
||
|
|
path: /etc/containers/systemd/users/quadlet
|
||
|
|
state: directory
|
||
|
|
|
||
|
|
- name: Create shared container image directory
|
||
|
|
ansible.builtin.file:
|
||
|
|
group: root
|
||
|
|
mode: '0755'
|
||
|
|
owner: root
|
||
|
|
path: /var/containers/images
|
||
|
|
state: directory
|
||
|
|
|
||
|
|
- name: Pull required container images into shared storage for all users
|
||
|
|
containers.podman.podman_image:
|
||
|
|
name: "{{ item }}"
|
||
|
|
platform: linux/amd64
|
||
|
|
pull: true
|
||
|
|
pull_extra_args: --imagestore=/var/containers/images
|
||
|
|
state: present
|
||
|
|
loop:
|
||
|
|
- "{{ podman_technitium_registry }}/{{ podman_technitium_repository }}:{{ podman_technitium_version }}"
|
||
|
|
- "{{ podman_distribution_registry }}/{{ podman_distribution_repository }}:{{ podman_distribution_version }}"
|
||
|
|
- "{{ podman_git_server_registry }}/{{ podman_git_server_repository }}:{{ podman_git_server_version }}"
|
||
|
|
|
||
|
|
- name: Recurse shared image storage and make contents readable for all users
|
||
|
|
ansible.builtin.command:
|
||
|
|
cmd: chmod -R u=rwX,g=rX,o=rX /var/containers/images
|
||
|
|
changed_when: true
|
||
|
|
|
||
|
|
- name: Add containers storage.conf file
|
||
|
|
ansible.builtin.copy:
|
||
|
|
dest: /etc/containers/storage.conf # Can NOT go in the drop in containers.conf.d directory
|
||
|
|
group: root
|
||
|
|
mode: '0644'
|
||
|
|
owner: root
|
||
|
|
src: "{{ role_path }}/files/storage.conf"
|