From d6b72cda249eb3883544903071e23f86754a7915 Mon Sep 17 00:00:00 2001
From: "pulsar89.5" <pulsar89.5@ykn.fr>
Date: Mon, 17 Mar 2025 01:59:03 +0100
Subject: [PATCH] fix: Review CoreOS compatibility

---
 defaults/main.yml    |  7 ++++
 handlers/main.yml    |  6 ++--
 tasks/containers.yml | 25 ++++++++++++++
 tasks/main.yml       | 78 +++++---------------------------------------
 tasks/pods.yml       | 25 ++++++++++++++
 tasks/prepare.yml    | 49 ++++++++++++++++++++++++++++
 6 files changed, 118 insertions(+), 72 deletions(-)
 create mode 100644 tasks/containers.yml
 create mode 100644 tasks/pods.yml
 create mode 100644 tasks/prepare.yml

diff --git a/defaults/main.yml b/defaults/main.yml
index 71eb4f1..e0c8580 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,7 +1,14 @@
 ---
 # defaults file for podman
 
+# Dedicated user
+podman_user: podman
+
+# Enable container auto-update
 podman_auto_update: true
 
+# Define pods
 podman_pods: []
+
+# Define containers
 podman_containers: []
diff --git a/handlers/main.yml b/handlers/main.yml
index 2c6375d..a57cacd 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -1,11 +1,11 @@
 ---
-# handlers file for exim4
+# handlers file for podman
 
 - name: Set default permissions on volumes folders
   ansible.builtin.file:
     path: "{{ item.path }}"
-    owner: root
-    group: root
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
   become: true
   loop: "{{ folders.results | selectattr('changed', 'equalto', true) }}"
   loop_control:
diff --git a/tasks/containers.yml b/tasks/containers.yml
new file mode 100644
index 0000000..2ba73d2
--- /dev/null
+++ b/tasks/containers.yml
@@ -0,0 +1,25 @@
+---
+# tasks file for podman
+
+- name: Deploy containers
+  containers.podman.podman_container: "{{ container }}"
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ podman_containers }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: deployed_containers
+  vars:
+    container: "{{ podman_containers_defaults | ansible.builtin.combine(item) }}"
+
+- name: Start or restart containers
+  ansible.builtin.systemd_service:
+    name: "{{ item.item.name }}.service"
+    state: "{{ 'restarted' if item.changed else 'started' }}"
+    daemon_reload: true
+    scope: user
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ deployed_containers.results }}"
+  loop_control:
+    label: "{{ item.item.name }}"
diff --git a/tasks/main.yml b/tasks/main.yml
index c52242d..4fcb084 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -1,74 +1,14 @@
 ---
 # tasks file for podman
 
-- name: Ensure podman.service is started
-  ansible.builtin.systemd_service:
-    name: podman.service
-    state: started
-    enabled: true
-    masked: false
-    daemon_reload: true
-  become: true
+- name: Import task to prepare instance
+  ansible.builtin.import_tasks:
+    file: prepare.yml
 
-- name: Create subvolumes paths
-  ansible.builtin.file:
-    path: "{{ item.1 | split(':') | first }}"
-    state: directory
-    mode: u=rwX,g=rX,o=rX
-  become: true
-  loop: "{{ q('ansible.builtin.subelements', podman_containers, 'volumes', {'skip_missing': True}) }}"
-  loop_control:
-    label: "{{ item.0.name }}"
-  register: folders
-  notify: Set default permissions on volumes folders
+- name: Import task to manage pods
+  ansible.builtin.import_tasks:
+    file: pods.yml
 
-- name: Exécuter les handlers
-  ansible.builtin.meta: flush_handlers
-
-- name: Deploy pods
-  containers.podman.podman_pod: "{{ pod }}"
-  become: true
-  loop: "{{ podman_pods }}"
-  loop_control:
-    label: "{{ item.name }}"
-  register: deployed_pods
-  vars:
-    pod: "{{ podman_pods_defaults | ansible.builtin.combine(item) }}"
-
-- name: Start or restart pods
-  ansible.builtin.systemd_service:
-    name: "{{ item.item.name }}-pod.service"
-    state: "{{ 'restarted' if item.changed else 'started' }}"
-    daemon_reload: true
-  become: true
-  loop: "{{ deployed_pods.results }}"
-  loop_control:
-    label: "{{ item.item.name }}"
-
-- name: Deploy containers
-  containers.podman.podman_container: "{{ container }}"
-  become: true
-  loop: "{{ podman_containers }}"
-  loop_control:
-    label: "{{ item.name }}"
-  register: deployed_containers
-  vars:
-    container: "{{ podman_containers_defaults | ansible.builtin.combine(item) }}"
-
-- name: Start or restart containers
-  ansible.builtin.systemd_service:
-    name: "{{ item.item.name }}.service"
-    state: "{{ 'restarted' if item.changed else 'started' }}"
-    daemon_reload: true
-  become: true
-  loop: "{{ deployed_containers.results }}"
-  loop_control:
-    label: "{{ item.item.name }}"
-
-- name: Enable containers auto-update service
-  ansible.builtin.systemd_service:
-    name: podman-auto-update.timer
-    daemon_reload: true
-    enabled: true
-  when: podman_auto_update
-  become: true
+- name: Import task to manage pods
+  ansible.builtin.import_tasks:
+    file: containers.yml
diff --git a/tasks/pods.yml b/tasks/pods.yml
new file mode 100644
index 0000000..58e7196
--- /dev/null
+++ b/tasks/pods.yml
@@ -0,0 +1,25 @@
+---
+# tasks file for podman
+
+- name: Deploy pods
+  containers.podman.podman_pod: "{{ pod }}"
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ podman_pods }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: deployed_pods
+  vars:
+    pod: "{{ podman_pods_defaults | ansible.builtin.combine(item) }}"
+
+- name: Start or restart pods
+  ansible.builtin.systemd_service:
+    name: "{{ item.item.name }}-pod.service"
+    state: "{{ 'restarted' if item.changed else 'started' }}"
+    daemon_reload: true
+    scope: user
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ deployed_pods.results }}"
+  loop_control:
+    label: "{{ item.item.name }}"
diff --git a/tasks/prepare.yml b/tasks/prepare.yml
new file mode 100644
index 0000000..cc2652e
--- /dev/null
+++ b/tasks/prepare.yml
@@ -0,0 +1,49 @@
+---
+# tasks file for podman
+
+- name: Create dedicated group
+  ansible.builtin.group:
+    name: "{{ podman_user }}"
+  become: true
+
+- name: Create dedicated user
+  ansible.builtin.user:
+    name: "{{ podman_user }}"
+    comment: Dedicated Podman user
+    password_lock: true
+    shell: /bin/bash
+    group: podman
+  become: true
+
+- name: Disable global podman auto-update
+  ansible.builtin.systemd_service:
+    name: podman-auto-update.timer
+    enabled: false
+  become: true
+
+- name: Enable containers auto-update service
+  ansible.builtin.command:
+    cmd: systemctl --user --machine={{ podman_user }}@ start podman-auto-update.timer
+  when: podman_auto_update
+  become: true
+
+- name: Enable lingering for podman user
+  ansible.builtin.command:
+    cmd: loginctl enable-linger {{ podman_user }}
+    creates: /var/lib/systemd/linger/podman
+  become: true
+
+- name: Create subvolumes paths
+  ansible.builtin.file:
+    path: "{{ item.1 | split(':') | first }}"
+    state: directory
+    mode: u=rwX,g=rX,o=rX
+  become: true
+  loop: "{{ q('ansible.builtin.subelements', podman_containers, 'volumes', {'skip_missing': True}) }}"
+  loop_control:
+    label: "{{ item.0.name }}"
+  register: folders
+  notify: Set default permissions on volumes folders
+
+- name: Execute handlers
+  ansible.builtin.meta: flush_handlers