fix: Review CoreOS compatibility

This reverts commit 81b51cfcba.

README.md

@@ -1,82 +1,66 @@
 # role_podman
 
-Rôle de déploiement de podman.
-
-## Pré-requis
-
-Ce rôle créer un utilisateur dédié via [cet autre rôle](https://gitea.ykn.fr/ansible/role_users) dont il est dépendant.
-L'utilisation de ce rôle et de sa dépendance dans un playbook nécessite d'utilise ansible-galaxy en lui indiquant un fichier dont le contenu est le suivant :
-
-```bash
-$ cd playbook_podman
-$ tee requirements.yml <<EOF
----
-
-roles:
-  - name: users
-    scm: git
-    src: ssh://gitea@git.ykn.fr:12393/ansible/role_users.git
-    version: alpha
-
-  - name: podman
-    scm: git
-    src: ssh://gitea@git.ykn.fr:12393/ansible/role_podman.git
-    version: alpha
-EOF
-$ ansible-galaxy install -fr requirements.yml
-```
+Deploy podman, manage pods and containers.
 
 ## Variables
 
-### podman_configure_rsyslog
+### podman_auto_update
 
-Désactive les messages du programme *podman* et des programmes dans les conteneurs si ils portent le nom du conteneur.
+Status of the automatic container update service.
 
-<span style="text-decoration: underline">Valeur par défaut:</span> `true` (activé, `false` pour désactiver)
+<span style="text-decoration: underline">Default value:</span> `true
+
+### podman_pods
+
+List of dictionnaries to define pods ([see ansible documentation](https://docs.ansible.com/ansible/latest/collections/containers/podman/podman_pod_module.html)).
+
+<span style="text-decoration: underline">Default value:</span> none
 
 ### podman_containers
 
-Définition des conteneurs à déployer.
+List of dictionnaries to define containers ([see ansible documentation](https://docs.ansible.com/ansible/latest/collections/containers/podman/podman_container_module.html#ansible-collections-containers-podman-podman-container-module)).
 
-<span style="text-decoration: underline">Valeur par défaut:</span> *aucune*
+<span style="text-decoration: underline">Default value:</span> none
 
-## Utilisation
+## Usage
 
-Définir la variable `podman_containers` dans un fichier sous `host_vars` ou `group_vars` :
-
-```bash
-$ tee host_vars/lxd_podman_host.yml <<EOF
----
+To deploy *wg-easy* container:
 
+```yml
+# BEGIN role_podman
 podman_containers:
-  - image: docker.io/wallabag/wallabag:latest
-    name: wallbag
-    userns: keep-id
+  - image: "ghcr.io/wg-easy/wg-easy:latest"
+    name: wg-easy
+    publish:
+      - "51820:51820/udp"
+      - "51821:51821/tcp"
     volumes:
-      - wallbag-data:/var/www/wallabag/data
-      - wallbag-image:/var/www/wallabag/web/assets/images
-    ports:
-      - 80:80/tcp
-    environment_vars:
-      - SYMFONY__ENV__DOMAIN_NAME=https://wallbag.ykn.fr
-```
-
-Il est également possible de définir l'utilisateur via la variable `user`, comme ceci :
-
-```bash
-$ tee host_vars/lxd_podman_host.yml <<EOF
----
-
-podman_containers:
-  - image: docker.io/wallabag/wallabag:latest
-    name: wallbag
-    user: un_utilisateur
-    userns: keep-id
-    volumes:
-      - wallbag-data:/var/www/wallabag/data
-      - wallbag-image:/var/www/wallabag/web/assets/images
-    ports:
-      - 80:80/tcp
-    environment_vars:
-      - SYMFONY__ENV__DOMAIN_NAME=https://wallbag.ykn.fr
+      - "/srv/wg-easy:/etc/wireguard"
+    env:
+      LANG: fr
+      PORT: 51821
+      UI_CHART_TYPE: 2
+      PASSWORD_HASH: <secret>
+      WG_HOST: noun.ykn.fr
+      WG_PORT: 51820
+      WG_PERSISTENT_KEEPALIVE: 25
+      WG_DEFAULT_DNS: ""
+      WG_ALLOWED_IPS: 192.168.84.0/24
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+      - SYS_MODULE
+    sysctl:
+      net.ipv4.ip_forward: 1
+      net.ipv4.conf.all.src_valid_mark: 1
+    quadlet_options:
+      - AutoUpdate=registry
+      - |-
+        [Service]
+        Restart=on-failure
+        TimeoutStartSec=900
+      - |-
+        [Install]
+        WantedBy=default.target
+# END role_podman
 ```

defaults/main.yml

@@ -1,19 +1,22 @@
 ---
 # defaults file for podman
 
-podman_configure_rsyslog: true
+# Packages to install to run podman
+podman_packages:
+  - dbus-user-session
+  - passt
+  - podman
+  - systemd-container
+  - uidmap
 
+# Dedicated user
+podman_user: podman
+
+# Enable container auto-update
+podman_auto_update: true
+
+# Define pods
+podman_pods: []
+
+# Define containers
 podman_containers: []
-# Exemple:
-#  - image: docker.io/wallabag/wallabag:latest
-#    name: wallbag
-#    userns: keep-id
-#    commands:
-#       - echo toto
-#    volumes:
-#      - wallbag-data:/var/www/wallabag/data
-#      - wallbag-image:/var/www/wallabag/web/assets/images
-#    ports:
-#      - 80:80/tcp
-#    environment_vars:
-#      - SYMFONY__ENV__DOMAIN_NAME=https://wallbag.ykn.fr

handlers/main.yml

@@ -1,8 +1,12 @@
 ---
-# handlers file for exim4
+# handlers file for podman
 
-- name: Redémarrer rsyslog.service
-  ansible.builtin.systemd:
-    state: restarted
-    name: rsyslog.service
+- name: Set default permissions on volumes folders
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
   become: true
+  loop: "{{ folders.results | selectattr('changed', 'equalto', true) }}"
+  loop_control:
+    label: "{{ item.path }}"

meta/main.yml

@@ -1,15 +1,15 @@
 galaxy_info:
   namespace: ykn
   author: pulsar89.5
-  description: Rôle de déploiement de podman
+  description: Deploy podman, manage pods and containers
 
   license: GPL-3.0-or-later
 
   min_ansible_version: '2.1'
 
   platforms:
-    - name: Debian
+    - name: CoreOS
       versions:
-        - bookworm
+        - 41
 
 dependencies: []

tasks/configuration.yml

@@ -1,48 +0,0 @@
----
-# tasks file for podman
-
-- name: Créer l'utilisateur dédié
-  ansible.builtin.include_role:
-    name: users
-  vars:
-    users:
-      - name: "{{ container_user }}"
-        comment: Dedicated Podman user ({{ container.name }})
-        update_password: on_create
-        password_lock: true
-        shell: /bin/bash
-
-- name: Créer le chemin de stockage des définitions
-  ansible.builtin.file:
-    path: "{{ container_basepath }}"
-    state: directory
-    owner: "{{ container_user }}"
-    group: "{{ container_user }}"
-    mode: u=rwX,g=rwX,o=
-  become: true
-
-- name: Déployer le conteneur
-  ansible.builtin.template:
-    src: podman-quadlet.container.j2 
-    dest: "{{ container_basepath }}/{{ container_filename }}"
-    owner: "{{ container_user }}"
-    group: "{{ container_user }}"
-    mode: u=rw,g=rw,o=
-  become: true
-  register: deploy_container
-
-- name: Activer le lingering
-  ansible.builtin.command:
-   cmd: "loginctl enable-linger {{ container_user }}"
-   creates: /var/lib/systemd/linger/{{ container_user }}
-  become: true
-
-- name: Démarrer ou redémarrer le conteneur
-  ansible.builtin.systemd_service:
-    name: "{{ container_filename | replace('.container', '.service') }}"
-    state: "{{ 'restarted' if deploy_container.changed else 'started' }}"
-    enabled: true
-    daemon_reload: true
-    scope: user
-  become: true
-  become_user: "{{ container_user }}"

tasks/containers.yml

@@ -0,0 +1,25 @@
+---
+# tasks file for podman
+
+- name: Deploy containers
+  containers.podman.podman_container: "{{ container }}"
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ podman_containers }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: deployed_containers
+  vars:
+    container: "{{ podman_containers_defaults | ansible.builtin.combine(item) }}"
+
+- name: Start or restart containers
+  ansible.builtin.systemd_service:
+    name: "{{ item.item.name }}.service"
+    state: "{{ 'restarted' if item.changed else 'started' }}"
+    daemon_reload: true
+    scope: user
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ deployed_containers.results }}"
+  loop_control:
+    label: "{{ item.item.name }}"

tasks/installation.yml

@@ -1,25 +1,7 @@
 ---
-# tasks file for podman
+# tasks file for dnsmasq
 
-- name: Installer les paquets
+- name: Install podman
   ansible.builtin.apt:
-    name:
-      - dbus-user-session
-      - podman
-      - rootlesskit
-      - slirp4netns
-      - systemd-container
-    state: present
-    default_release: sid
+    name: "{{ podman_packages }}"
   become: true
-
-- name: Déployer la configuration de rsyslog
-  ansible.builtin.template:
-    src: templates/rsyslog.conf.j2
-    dest: /etc/rsyslog.d/10-podman.conf
-    owner: root
-    group: root
-    mode: u=rw,g=r,o=r
-  when: podman_configure_rsyslog
-  become: true
-  notify: Redémarrer rsyslog.service

tasks/main.yml

@@ -1,18 +1,18 @@
 ---
 # tasks file for podman
 
-- name: Importer les tâches d'installation
-  tags: installation
-  ansible.builtin.import_tasks: installation.yml
+- name: Import installation tasks
+  ansible.builtin.import_tasks:
+    file: installation.yml
 
-- name: Importer les tâches de configuration
-  tags: configuration
-  ansible.builtin.include_tasks: configuration.yml
-  loop: "{{ podman_containers }}"
-  loop_control:
-    label: "{{ container.name }}"
-    loop_var: container
-  vars:
-    container_user: "podman-{{ container.user | default(container.name) }}"
-    container_basepath: "/home/{{ container_user }}/.config/containers/systemd"
-    container_filename: "podman-{{ container.name }}.container"
+- name: Import instance preparation tasks
+  ansible.builtin.import_tasks:
+    file: prepare.yml
+
+- name: Import pods management tasks
+  ansible.builtin.import_tasks:
+    file: pods.yml
+
+- name: Import containers management tasks
+  ansible.builtin.import_tasks:
+    file: containers.yml

tasks/pods.yml

@@ -0,0 +1,25 @@
+---
+# tasks file for podman
+
+- name: Deploy pods
+  containers.podman.podman_pod: "{{ pod }}"
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ podman_pods }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: deployed_pods
+  vars:
+    pod: "{{ podman_pods_defaults | ansible.builtin.combine(item) }}"
+
+- name: Start or restart pods
+  ansible.builtin.systemd_service:
+    name: "{{ item.item.name }}-pod.service"
+    state: "{{ 'restarted' if item.changed else 'started' }}"
+    daemon_reload: true
+    scope: user
+  become: true
+  become_user: "{{ podman_user }}"
+  loop: "{{ deployed_pods.results }}"
+  loop_control:
+    label: "{{ item.item.name }}"

tasks/prepare.yml

@@ -0,0 +1,49 @@
+---
+# tasks file for podman
+
+- name: Create dedicated group
+  ansible.builtin.group:
+    name: "{{ podman_user }}"
+  become: true
+
+- name: Create dedicated user
+  ansible.builtin.user:
+    name: "{{ podman_user }}"
+    comment: Dedicated Podman user
+    password_lock: true
+    shell: /bin/bash
+    group: podman
+  become: true
+
+- name: Disable global podman auto-update
+  ansible.builtin.systemd_service:
+    name: podman-auto-update.timer
+    enabled: false
+  become: true
+
+- name: Enable containers auto-update service
+  ansible.builtin.command:
+    cmd: systemctl --user --machine={{ podman_user }}@ start podman-auto-update.timer
+  when: podman_auto_update
+  become: true
+
+- name: Enable lingering for podman user
+  ansible.builtin.command:
+    cmd: loginctl enable-linger {{ podman_user }}
+    creates: /var/lib/systemd/linger/podman
+  become: true
+
+- name: Create subvolumes paths
+  ansible.builtin.file:
+    path: "{{ item.1 | split(':') | first }}"
+    state: directory
+    mode: u=rwX,g=rX,o=rX
+  become: true
+  loop: "{{ q('ansible.builtin.subelements', podman_containers, 'volumes', {'skip_missing': True}) }}"
+  loop_control:
+    label: "{{ item.0.name }}"
+  register: folders
+  notify: Set default permissions on volumes folders
+
+- name: Execute handlers
+  ansible.builtin.meta: flush_handlers

templates/podman-quadlet.container.j2

@@ -1,50 +0,0 @@
-# {{ ansible_managed }}
-
-[Unit]
-Description=Podman container: {{ container.name }}
-{% for extra in container.get('unit_extras', []) %}
-{{ extra }}
-{% endfor %}
-
-[Container]
-HostName={{ inventory_hostname }}
-
-Image={{ container.image }}
-ContainerName={{ container.name }}
-
-{% if container.get('userns', '') | length > 0 %}
-UserNS={{ container.userns }}
-{% endif %}
-
-AutoUpdate=registry
-
-{% for cmd in container.get('commands', []) %}
-Exec={{ cmd }}
-{% endfor %}
-
-{% for volume in container.get('volumes', []) %}
-Volume={{ volume }}
-{% endfor %}
-
-{% for mount in container.get('mounts', []) %}
-{% if mount.get('options', []) | length > 0 %}
-Mount=type={{ mount.type }},src={{ mount.source }},dst={{ mount.destination }},{{ mount.options | join(',') }}
-{% else %}
-Mount=type={{ mount.type }},src={{ mount.source }},dst={{ mount.destination }}
-{% endif %}
-{% endfor %}
-
-{% for port in container.get('ports', []) %}
-PublishPort={{ port }}
-{% endfor %}
-
-{% for environment in container.get('environment_vars', []) %}
-Environment={{ environment }}
-{% endfor %}
-
-[Service]
-Restart=on-failure
-TimeoutStartSec=900
-
-[Install]
-WantedBy=default.target

templates/rsyslog.conf.j2

@@ -1,9 +0,0 @@
-# {{ ansible_managed }}
-
-# Don't log podman
-:programname, contains, "podman" stop
-
-# Don't log progams inside podman container
-{% for container in podman_containers %}
-:programname, contains, "{{ container.name }}" stop
-{% endfor %}

vars/main.yml

@@ -0,0 +1,12 @@
+---
+
+podman_pods_defaults: []
+
+podman_containers_defaults:
+  state: quadlet
+  recreate: true
+  quadlet_options:
+    - "AutoUpdate=registry"
+    - |
+      [Install]
+      WantedBy=default.target