From 16ae125e1fef205e634a1a778fe2aa145a67c724 Mon Sep 17 00:00:00 2001 From: Michael Balsillie Date: Fri, 11 Sep 2026 01:34:44 -0400 Subject: [PATCH] Podman shared images working --- .../high_availability.yml | 1 + .../high_availability.yml | 1 + playbooks/archlinux-servers.yml | 6 +- roles/podman/files/storage.conf | 6 ++ roles/podman/tasks/main.yml | 81 +++++++++++++++++++ roles/podman/templates/technitium.service.j2 | 37 +++++++++ roles/podman/vars/main.yml | 13 +++ 7 files changed, 143 insertions(+), 2 deletions(-) create mode 100644 inventory/host_vars/ch01.balsillie.house/high_availability.yml create mode 100644 inventory/host_vars/ch02.balsillie.house/high_availability.yml create mode 100644 roles/podman/files/storage.conf create mode 100644 roles/podman/tasks/main.yml create mode 100644 roles/podman/templates/technitium.service.j2 create mode 100644 roles/podman/vars/main.yml diff --git a/inventory/host_vars/ch01.balsillie.house/high_availability.yml b/inventory/host_vars/ch01.balsillie.house/high_availability.yml new file mode 100644 index 0000000..ea96c80 --- /dev/null +++ b/inventory/host_vars/ch01.balsillie.house/high_availability.yml @@ -0,0 +1 @@ +ha_pair_value: '01' diff --git a/inventory/host_vars/ch02.balsillie.house/high_availability.yml b/inventory/host_vars/ch02.balsillie.house/high_availability.yml new file mode 100644 index 0000000..78cb262 --- /dev/null +++ b/inventory/host_vars/ch02.balsillie.house/high_availability.yml @@ -0,0 +1 @@ +ha_pair_value: '02' diff --git a/playbooks/archlinux-servers.yml b/playbooks/archlinux-servers.yml index 3b70d26..df62eb7 100644 --- a/playbooks/archlinux-servers.yml +++ b/playbooks/archlinux-servers.yml @@ -2,7 +2,8 @@ - name: Configure ssh and firewall hosts: - - archlinux_servers + # - archlinux_servers + - ch01.balsillie.house gather_facts: false become: true pre_tasks: @@ -30,5 +31,6 @@ roles: # - hostname - - sudoers + # - sudoers # - sshd + - podman diff --git a/roles/podman/files/storage.conf b/roles/podman/files/storage.conf new file mode 100644 index 0000000..4e4c783 --- /dev/null +++ b/roles/podman/files/storage.conf @@ -0,0 +1,6 @@ +[storage] +driver = "overlay" +[storage.options] +additionalimagestores = [ + "/var/containers/images" +] \ No newline at end of file diff --git a/roles/podman/tasks/main.yml b/roles/podman/tasks/main.yml new file mode 100644 index 0000000..b9777a9 --- /dev/null +++ b/roles/podman/tasks/main.yml @@ -0,0 +1,81 @@ +# code: language=ansible + +- name: Install podman packages + community.general.pacman: + name: + - nginx + - podman + - passt + - podlet + - podman-compose + state: present + update_cache: true + +- name: Enable kernel.unprivileged_userns_clone + ansible.posix.sysctl: + name: kernel.unprivileged_userns_clone + reload: true + state: present + sysctl_set: true + value: 1 + +- name: Create an unprivileged user to run quadlet files as + ansible.builtin.user: + comment: Quadlet services user + create_home: false + home: / + name: quadlet + password: '!' + password_lock: true + shell: /usr/bin/nologin + state: present + system: true + +- name: Ensure quadlet user parent directory exists + ansible.builtin.file: + group: root + mode: '0755' + owner: root + path: /etc/containers/systemd/users + state: directory + +- name: Create quadlet user directory + ansible.builtin.file: + group: quadlet + mode: '0775' + owner: quadlet + path: /etc/containers/systemd/users/quadlet + state: directory + +- name: Create shared container image directory + ansible.builtin.file: + group: root + mode: '0755' + owner: root + path: /var/containers/images + state: directory + +- name: Pull required container images into shared storage for all users + containers.podman.podman_image: + name: "{{ item }}" + platform: linux/amd64 + pull: true + pull_extra_args: --imagestore=/var/containers/images + state: present + loop: + - "{{ podman_technitium_registry }}/{{ podman_technitium_repository }}:{{ podman_technitium_version }}" + - "{{ podman_distribution_registry }}/{{ podman_distribution_repository }}:{{ podman_distribution_version }}" + - "{{ podman_git_server_registry }}/{{ podman_git_server_repository }}:{{ podman_git_server_version }}" + +- name: Recurse shared image storage and make contents readable for all users + ansible.builtin.command: + cmd: chmod -R u=rwX,g=rX,o=rX /var/containers/images + changed_when: true + +- name: Add containers storage.conf file + ansible.builtin.copy: + dest: /etc/containers/storage.conf # Can NOT go in the drop in containers.conf.d directory + group: root + mode: '0644' + owner: root + src: "{{ role_path }}/files/storage.conf" diff --git a/roles/podman/templates/technitium.service.j2 b/roles/podman/templates/technitium.service.j2 new file mode 100644 index 0000000..c4f086d --- /dev/null +++ b/roles/podman/templates/technitium.service.j2 @@ -0,0 +1,37 @@ +[Unit] +Description=Technitium DNS Server + +[Container] +ContainerName=technitium +Image={{ podman_technitium_registry }}/{{ podman_technitium_repository }}:{{ podman_technitium_version }} + +# Enable auto-update container +AutoUpdate=registry + +Volume=/path/to/syncthing/config:/config +Volume=/path/to/data1:/data1 + +HostName=technitium{{ ha_pair_value }} +PublishPort=127.0.0.1:8384:8384/tcp +PublishPort=22000:22000/tcp + +Environment=PUID=1000 +Environment=PGID=1000 +Environment=TZ=Etc/UTC + +# UID mapping is needed to run linuxserver.io container as rootless podman. +# This will map UID=1000 inside the container to intermediate UID=0. +# For rootless podman intermediate UID=0 will be mapped to the UID of current user. +UIDMap=1000:0:1 +UIDMap=0:1:1000 +UIDMap=1001:1001:64536 + +[Service] +Restart=on-failure + +# Extend Timeout to allow time to pull the image +TimeoutStartSec=300 + +# The [Install] section allows enabling the generated service. +[Install] +WantedBy=default.target \ No newline at end of file diff --git a/roles/podman/vars/main.yml b/roles/podman/vars/main.yml new file mode 100644 index 0000000..8445cfb --- /dev/null +++ b/roles/podman/vars/main.yml @@ -0,0 +1,13 @@ +# code: language=ansible + +podman_technitium_registry: "docker.io" +podman_technitium_repository: "technitium/dns-server" +podman_technitium_version: "15.4.0" + +podman_distribution_registry: "docker.io" +podman_distribution_repository: "distribution/distribution" +podman_distribution_version: "3" + +podman_git_server_registry: "docker.io" +podman_git_server_repository: "rockstorm/git-server" +podman_git_server_version: "2.54"