Podman shared images working

inventory/host_vars/ch01.balsillie.house/high_availability.yml

@@ -0,0 +1 @@
+ha_pair_value: '01'

inventory/host_vars/ch02.balsillie.house/high_availability.yml

@@ -0,0 +1 @@
+ha_pair_value: '02'

playbooks/archlinux-servers.yml

@@ -2,7 +2,8 @@
 
 - name: Configure ssh and firewall
   hosts:
-    - archlinux_servers
+    # - archlinux_servers
+    - ch01.balsillie.house
   gather_facts: false
   become: true
   pre_tasks:
@@ -30,5 +31,6 @@
 
   roles:
     # - hostname
-    - sudoers
+    # - sudoers
     # - sshd
+    - podman

roles/podman/files/storage.conf

@@ -0,0 +1,6 @@
+[storage]
+driver = "overlay"
+[storage.options]
+additionalimagestores = [
+    "/var/containers/images"
+]

roles/podman/tasks/main.yml

@@ -0,0 +1,81 @@
+# code: language=ansible
+
+- name: Install podman packages
+  community.general.pacman:
+    name:
+      - nginx
+      - podman
+      - passt
+      - podlet
+      - podman-compose
+    state: present
+    update_cache: true
+
+- name: Enable kernel.unprivileged_userns_clone
+  ansible.posix.sysctl:
+    name: kernel.unprivileged_userns_clone
+    reload: true
+    state: present
+    sysctl_set: true
+    value: 1
+
+- name: Create an unprivileged user to run quadlet files as
+  ansible.builtin.user:
+    comment: Quadlet services user
+    create_home: false
+    home: /
+    name: quadlet
+    password: '!'
+    password_lock: true
+    shell: /usr/bin/nologin
+    state: present
+    system: true
+
+- name: Ensure quadlet user parent directory exists
+  ansible.builtin.file:
+    group: root
+    mode: '0755'
+    owner: root
+    path: /etc/containers/systemd/users
+    state: directory
+
+- name: Create quadlet user directory
+  ansible.builtin.file:
+    group: quadlet
+    mode: '0775'
+    owner: quadlet
+    path: /etc/containers/systemd/users/quadlet
+    state: directory
+
+- name: Create shared container image directory
+  ansible.builtin.file:
+    group: root
+    mode: '0755'
+    owner: root
+    path: /var/containers/images
+    state: directory
+
+- name: Pull required container images into shared storage for all users
+  containers.podman.podman_image:
+    name: "{{ item }}"
+    platform: linux/amd64
+    pull: true
+    pull_extra_args: --imagestore=/var/containers/images
+    state: present
+  loop:
+    - "{{ podman_technitium_registry }}/{{ podman_technitium_repository }}:{{ podman_technitium_version }}"
+    - "{{ podman_distribution_registry }}/{{ podman_distribution_repository }}:{{ podman_distribution_version }}"
+    - "{{ podman_git_server_registry }}/{{ podman_git_server_repository }}:{{ podman_git_server_version }}"
+
+- name: Recurse shared image storage and make contents readable for all users
+  ansible.builtin.command:
+    cmd: chmod -R u=rwX,g=rX,o=rX /var/containers/images
+  changed_when: true
+
+- name: Add containers storage.conf file
+  ansible.builtin.copy:
+    dest: /etc/containers/storage.conf # Can NOT go in the drop in containers.conf.d directory
+    group: root
+    mode: '0644'
+    owner: root
+    src: "{{ role_path }}/files/storage.conf"

roles/podman/templates/technitium.service.j2

@@ -0,0 +1,37 @@
+[Unit]
+Description=Technitium DNS Server
+
+[Container]
+ContainerName=technitium
+Image={{ podman_technitium_registry }}/{{ podman_technitium_repository }}:{{ podman_technitium_version }}
+
+# Enable auto-update container
+AutoUpdate=registry
+
+Volume=/path/to/syncthing/config:/config
+Volume=/path/to/data1:/data1
+
+HostName=technitium{{ ha_pair_value }}
+PublishPort=127.0.0.1:8384:8384/tcp
+PublishPort=22000:22000/tcp
+
+Environment=PUID=1000
+Environment=PGID=1000
+Environment=TZ=Etc/UTC
+
+# UID mapping is needed to run linuxserver.io container as rootless podman.
+# This will map UID=1000 inside the container to intermediate UID=0.
+# For rootless podman intermediate UID=0 will be mapped to the UID of current user.
+UIDMap=1000:0:1
+UIDMap=0:1:1000
+UIDMap=1001:1001:64536
+
+[Service]
+Restart=on-failure
+
+# Extend Timeout to allow time to pull the image
+TimeoutStartSec=300
+
+# The [Install] section allows enabling the generated service.
+[Install]
+WantedBy=default.target

roles/podman/vars/main.yml

@@ -0,0 +1,13 @@
+# code: language=ansible
+
+podman_technitium_registry: "docker.io"
+podman_technitium_repository: "technitium/dns-server"
+podman_technitium_version: "15.4.0"
+
+podman_distribution_registry: "docker.io"
+podman_distribution_repository: "distribution/distribution"
+podman_distribution_version: "3"
+
+podman_git_server_registry: "docker.io"
+podman_git_server_repository: "rockstorm/git-server"
+podman_git_server_version: "2.54"