Technitium working

roles/podman/tasks/main.yml

@@ -8,6 +8,7 @@
       - passt
       - podlet
       - podman-compose
+      - fuse-overlayfs
     state: present
     update_cache: true
 
@@ -22,28 +23,50 @@
 - name: Create an unprivileged user to run quadlet files as
   ansible.builtin.user:
     comment: Quadlet services user
-    create_home: false
-    home: /
+    create_home: true
+    home: /home/quadlet
     name: quadlet
     password: '!'
     password_lock: true
-    shell: /usr/bin/nologin
+    shell: /usr/bin/bash
     state: present
-    system: true
+    system: false # Can't be a system user or subuid/subgid entries don't get created
 
-- name: Ensure quadlet user parent directory exists
+- name: Ensure graphroot location exists for unprivileged user
   ansible.builtin.file:
-    group: root
-    mode: '0755'
-    owner: root
-    path: /etc/containers/systemd/users
+    group: quadlet
+    mode: '0750'
+    owner: quadlet
+    path: "/home/quadlet/.local/share/containers/storage"
     state: directory
 
-- name: Create quadlet user directory
+- name: Enable linger for unprivileged user
+  ansible.builtin.command:
+    cmd: loginctl enable-linger quadlet
+    creates: /var/lib/systemd/linger/quadlet
+  register: podman_enable_linger_result
+
+- name: Reboot if enabling lingering caused a change # noqa: no-handler
+  when:
+    - podman_enable_linger_result is changed
+  ansible.builtin.reboot:
+    post_reboot_delay: 10
+    test_command: whoami
+
+- name: Create directories for quadlet volumes
   ansible.builtin.file:
     group: quadlet
     mode: '0775'
     owner: quadlet
+    path: /quadlet/{{ item }}
+    state: directory
+  loop: "{{ podman_containers }}"
+
+- name: Create quadlet systemd user directory
+  ansible.builtin.file:
+    group: root
+    mode: '0775'
+    owner: root
     path: /etc/containers/systemd/users/quadlet
     state: directory
 
@@ -79,3 +102,58 @@
     mode: '0644'
     owner: root
     src: "{{ role_path }}/files/storage.conf"
+
+- name: Template out volume unit files
+  ansible.builtin.template:
+    dest: /etc/containers/systemd/users/quadlet/{{ item }}.volume
+    group: root
+    mode: '0644'
+    owner: root
+    src: "{{ role_path }}/templates/quadlet.volume.j2"
+  loop: "{{ podman_containers }}"
+  notify:
+    - Quadlet daemon-reload
+
+- name: Template out network unit file
+  ansible.builtin.template:
+    dest: /etc/containers/systemd/users/quadlet/dual-stack.network
+    group: root
+    mode: '0644'
+    owner: root
+    src: "{{ role_path }}/templates/dual-stack.network.j2"
+  notify:
+    - Quadlet daemon-reload
+
+- name: Template out container unit files
+  ansible.builtin.template:
+    dest: /etc/containers/systemd/users/quadlet/{{ item }}.container
+    group: root
+    mode: '0644'
+    owner: root
+    src: "{{ role_path }}/templates/{{ item }}.container.j2"
+  loop:
+    - technitium
+  notify:
+    - Quadlet daemon-reload
+
+- name: Flush handlers to trigger daemon-reload
+  ansible.builtin.meta: flush_handlers
+
+- name: Enable IP forwarding
+  ansible.posix.sysctl:
+    name: "{{ item }}"
+    reload: true
+    state: present
+    sysctl_set: true
+    value: 1
+  loop:
+    - net.ipv4.ip_forward
+    - net.ipv6.conf.all.forwarding
+
+# Enable forwarding rules in UFW
+
+# Enable/start user service
+
+# Add to containers.conf
+# [network]
+# rootless_port_forwarder="pasta"