# code: language=ansible

- name: Install podman packages
  community.general.pacman:
    name:
      - nginx
      - podman
      - passt
      - podlet
      - podman-compose
    state: present
    update_cache: true

- name: Enable kernel.unprivileged_userns_clone
  ansible.posix.sysctl:
    name: kernel.unprivileged_userns_clone
    reload: true
    state: present
    sysctl_set: true
    value: 1

- name: Create an unprivileged user to run quadlet files as
  ansible.builtin.user:
    comment: Quadlet services user
    create_home: false
    home: /
    name: quadlet
    password: '!'
    password_lock: true
    shell: /usr/bin/nologin
    state: present
    system: true

- name: Ensure quadlet user parent directory exists
  ansible.builtin.file:
    group: root
    mode: '0755'
    owner: root
    path: /etc/containers/systemd/users
    state: directory

- name: Create quadlet user directory
  ansible.builtin.file:
    group: quadlet
    mode: '0775'
    owner: quadlet
    path: /etc/containers/systemd/users/quadlet
    state: directory

- name: Create shared container image directory
  ansible.builtin.file:
    group: root
    mode: '0755'
    owner: root
    path: /var/containers/images
    state: directory

- name: Pull required container images into shared storage for all users
  containers.podman.podman_image:
    name: "{{ item }}"
    platform: linux/amd64
    pull: true
    pull_extra_args: --imagestore=/var/containers/images
    state: present
  loop:
    - "{{ podman_technitium_registry }}/{{ podman_technitium_repository }}:{{ podman_technitium_version }}"
    - "{{ podman_distribution_registry }}/{{ podman_distribution_repository }}:{{ podman_distribution_version }}"
    - "{{ podman_git_server_registry }}/{{ podman_git_server_repository }}:{{ podman_git_server_version }}"

- name: Recurse shared image storage and make contents readable for all users
  ansible.builtin.command:
    cmd: chmod -R u=rwX,g=rX,o=rX /var/containers/images
  changed_when: true

- name: Add containers storage.conf file
  ansible.builtin.copy:
    dest: /etc/containers/storage.conf # Can NOT go in the drop in containers.conf.d directory
    group: root
    mode: '0644'
    owner: root
    src: "{{ role_path }}/files/storage.conf"