---
# Connects as the container user and runs everything as that user. The rootless
# Quadlet units belong to it, so the connection's PAM session is what makes
# `systemctl --user` work without any environment juggling. Root-only steps
# (apt, sysctl, linger) elevate individually inside the podman role.
#
# gather_facts is required: podman_user and the home directory come from the
# user_id / user_dir facts.
#
# Run with: ansible-playbook -u tanshu caddy/playbook.yml
- name: Deploy Caddy as a rootless Podman Quadlet
  hosts: emily
  gather_facts: true
  vars_files:
    - vars/default.yml

  roles:
    # Rootless prerequisites: podman, lingering, low-port sysctl, Quadlet dir.
    # Also guards against running as root.
    - podman
    # The base Caddy unit. It does NOT know which networks it serves.
    # Each service registers itself via caddy/roles/register.
    - caddy