tanshu
060173db5e
Replaces the docker_container role with Quadlet systemd user units under ~/.config/containers/systemd, and moves state from /var/lib/caddy to ~/podman-data/caddy. Caddy is now the base unit and no longer lists its upstream networks. Each service registers itself by writing its own <name>.network unit plus a drop-in into caddy.container.d/, so adding or removing a service never means editing the Caddy playbook. Drop-ins are used rather than blockinfile because this playbook re-templates caddy.container on every run, which would wipe appended blocks. The play runs as the connecting user instead of using become: the rootless units belong to it, so the connection's PAM session is what makes systemctl --user work without setting XDG_RUNTIME_DIR. podman_user and the data directory are derived from facts, so the play fails loudly if that resolves to root. Two things that bit us and are worth keeping: - The privileged-port sysctl is applied inline with sysctl -w, not via a handler. Handlers only run at the end of the play, by which point Caddy has already failed to bind 80/443. - The Caddyfile is seeded with a minimal valid config. Caddy exits 1 with a bare "EOF" on an empty config file, so touching it into existence made the service crash-loop.
81 lines
3.2 KiB
YAML
81 lines
3.2 KiB
YAML
---
|
|
# Rootless Podman prerequisites. Shared by every container playbook.
|
|
#
|
|
# This playbook runs AS the container user; it does not use become to reach it.
|
|
# Root-only steps elevate individually. Keeping the connection's PAM session
|
|
# intact is what lets `systemctl --user` work without setting XDG_RUNTIME_DIR.
|
|
|
|
- name: Fail if the connecting user resolved to root
|
|
ansible.builtin.assert:
|
|
that: podman_user != 'root'
|
|
fail_msg: >-
|
|
podman_user resolved to root, but this playbook configures *rootless*
|
|
Podman and writes Quadlet units into the user's home. Connect as the
|
|
unprivileged user that should own the containers, e.g.
|
|
`ansible-playbook -u tanshu ...`. If this appeared because become was
|
|
re-enabled at play level, drop it: the root-only tasks below elevate
|
|
individually.
|
|
|
|
- name: Install Podman and the rootless runtime pieces
|
|
ansible.builtin.apt:
|
|
name:
|
|
- podman
|
|
# Everything below is only a Recommends, not a Depends, of podman or
|
|
# netavark. apt installs Recommends by default, so these would normally
|
|
# arrive on their own; listing them makes the requirement explicit and
|
|
# keeps it true under --no-install-recommends.
|
|
# - aardvark-dns # container-name DNS: Caddy resolves every upstream by name
|
|
# - nftables # netavark's firewall backend; Podman 6 dropped iptables
|
|
# - passt # pasta, the rootless network backend
|
|
# - uidmap # newuidmap/newgidmap, required for rootless user namespaces
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
become: true
|
|
|
|
# Without lingering, the user's systemd manager is torn down when the last
|
|
# session ends: Quadlet units stop, and they never start at boot.
|
|
- name: Enable systemd lingering for {{ podman_user }}
|
|
ansible.builtin.command: "loginctl enable-linger {{ podman_user }}"
|
|
args:
|
|
creates: "/var/lib/systemd/linger/{{ podman_user }}"
|
|
become: true
|
|
|
|
# Rootless containers cannot bind host ports below 1024 unless the kernel
|
|
# floor is lowered. Caddy publishes 80/443.
|
|
#
|
|
# This is applied inline rather than via a handler on purpose: handlers only
|
|
# run at the end of the play, by which point Caddy has already tried (and
|
|
# failed) to bind port 80. sysctl -w touches the running kernel; the file
|
|
# makes it survive a reboot.
|
|
- name: Read the current unprivileged port floor
|
|
ansible.builtin.command: sysctl -n net.ipv4.ip_unprivileged_port_start
|
|
register: podman_port_floor
|
|
changed_when: false
|
|
|
|
- name: Persist the unprivileged port floor
|
|
ansible.builtin.copy:
|
|
dest: /etc/sysctl.d/99-podman.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
# Managed by Ansible (podman role).
|
|
net.ipv4.ip_unprivileged_port_start = {{ podman_unprivileged_port_start }}
|
|
become: true
|
|
|
|
- name: Apply the unprivileged port floor
|
|
ansible.builtin.command: >-
|
|
sysctl -w net.ipv4.ip_unprivileged_port_start={{ podman_unprivileged_port_start }}
|
|
become: true
|
|
when: podman_port_floor.stdout | int > podman_unprivileged_port_start
|
|
changed_when: true
|
|
|
|
- name: Ensure the Quadlet unit directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ quadlet_dir }}"
|
|
state: directory
|
|
owner: "{{ podman_user }}"
|
|
group: "{{ podman_user }}"
|
|
mode: "0755"
|