feat(docker): add ansible role (WIP)

playbooks/user.yml

@@ -0,0 +1,7 @@
+---
+- name: Configure user accounts
+  hosts: "{{ user_hosts | default('all', true) }}"
+  become: "{{ user_role_become | default(false, true) }}"
+  gather_facts: "{{ user_role_gather_facts | default(false, true) }}"
+  roles:
+    - role: finallycoffee.base.user

roles/docker/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+docker_state: "present"
+docker_daemon_config: ~
+docker_daemon_config_file: "/etc/docker/daemon.json"
+docker_daemon_config_file_mode: "0644"
+docker_daemon_config_owner: root
+docker_daemon_config_group: "{{ docker_daemon_config_owner }}"

roles/docker/defaults/systemd.yml

@@ -0,0 +1,5 @@
+---
+docker_systemd_service_name: "docker.service"
+docker_systemd_service_state: >-2
+  {{ (docker_state == 'present') | ternary('started', 'stopped') }}
+docker_systemd_service_enabled: "{{ (docker_state == 'present') }}"

roles/docker/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart docker daemon
+  ansible.builtin.systemd_service:
+    name: "{{ docker_systemd_service_name }}"
+    state: "restarted"
+  listen: "docker-restart"

roles/docker/tasks/configure.yml

@@ -0,0 +1,18 @@
+---
+- name: Ensure config directory '{{ docker_daemon_config_file | dirname }}' is present
+  ansible.builtin.file:
+    path: "{{ docker_daemon_config_file | dirname }}"
+    state: "directory"
+    mode: "0755"
+    owner: "{{ docker_daemon_config_owner }}"
+    group: "{{ docker_daemon_config_group }}"
+
+- name: Configure docker daemon using '{{ docker_daemon_config_file }}'
+  ansible.builtin.copy:
+    content: "{{ docker_daemon_config | to_json }}"
+    dest: "{{ docker_daemon_config_file }}"
+    mode: "{{ docker_daemon_config_file_mode }}"
+    owner: "{{ docker_daemon_config_owner }}"
+    group: "{{ docker_daemon_config_group }}"
+  when: docker_daemon_config | string | length > 0
+  notify: docker-restart

roles/docker/tasks/main.yml

@@ -0,0 +1,29 @@
+---
+- name: Check if target OS is supported
+  ansible.builtin.fail:
+    msg: >-2
+      OS Family '{{ docker_os_family }}' is not supported!
+  when: docker_os_family not in docker_supported_os_families
+  vars:
+    docker_os_family: "{{ ansible_os_family | lower }}"
+
+- name: Ensure docker is {{ docker_state }} on {{ ansible_os_family }}-family
+  ansible.builtin.include_tasks:
+    file: "install-{{ ansible_os_family | lower }}.yml"
+
+- name: Configure docker daemon
+  ansible.builtin.include_tasks:
+    file: "configure.yml"
+  when: docker_state == 'present'
+
+- name: Ensure docker daemon is {{ docker_systemd_service_enabled | ternary('enabled', 'disabled') }}
+  ansible.builtin.systemd_service:
+    name: "{{ docker_systemd_service_name }}"
+    enabled: "{{ docker_systemd_service_enabled }}"
+  when: ansible_facts['service_mgr'] == 'systemd'
+
+- name: Ensure docker daemon is {{ docker_systemd_service_state }}
+  ansible.builtin.systemd_service:
+    name: "{{ docker_systemd_service_name }}"
+    state: "{{ docker_systemd_service_state }}"
+  when: ansible_facts['service_mgr'] == 'systemd'

roles/docker/vars/main.yml

@@ -0,0 +1,3 @@
+---
+docker_supported_os_families:
+  - 'debian'

roles/lego/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 lego_user: "lego"
-lego_version: "4.22.2"
+lego_version: "4.23.0"
 lego_instance: default
 lego_base_path: "/opt/lego"
 lego_cert_user: "acme-{{ lego_instance }}"

roles/minio/defaults/main/container.yml

@@ -1,7 +1,7 @@
 ---
 minio_container_name: minio
 minio_container_image_name: "docker.io/minio/minio"
-minio_container_image_tag: "RELEASE.2025-04-03T14-56-28Z"
+minio_container_image_tag: "RELEASE.2025-04-08T15-41-24Z"
 minio_container_image: "{{ minio_container_image_name }}:{{ minio_container_image_tag }}"
 minio_container_networks: []
 minio_container_ports: []

roles/nginx/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-nginx_version: "1.27.4"
+nginx_version: "1.27.5"
 nginx_flavour: alpine
 nginx_base_path: /opt/nginx
 nginx_config_file: "{{ nginx_base_path }}/nginx.conf"

roles/user/README.md

@@ -0,0 +1,23 @@
+# `finallycoffee.base.user` ansible role
+
+Provision and manage user accounts on the remote host. Supports setting user
+home, gecos (display name) and shell.
+
+Warning: if the users' home exists and is changed, the role will attempt to
+move the home directory. Set `move_home` to false on the user to disable this
+behaviour.
+
+## Examples
+```yaml
+- hosts: all
+  roles:
+    - role: finallycoffee.base.user
+  vars:
+    users:
+      - name: root
+      - name: alice
+      - name: bob
+        state: present
+      - name: eve
+        state: absent
+```

roles/user/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+users: []

roles/user/tasks/configure-user.yml

@@ -0,0 +1,41 @@
+---
+- name: Ensure user '{{ user.name }}' is {{ user_state }}
+  ansible.builtin.user:
+    name: "{{ user.name }}"
+    state: "{{ user_state }}"
+    system: "{{ user.system | default(false, true) }}"
+    shell: "{{ user.shell | default(omit, true) }}"
+    home: "{{ user.home | default(omit, true) }}"
+    create_home: "{{ user.create_home | default(true, true) }}"
+    move_home: "{{ user.move_home | default(true, true) }}"
+    skeleton: >-2
+      {{ (user.create_home | default(true, true) and 'skeleton' in user)
+      | ternary(user.skeleton | default(''), omit) }}
+    comment: "{{ user.comment | default(user.gecos | default(omit, true), true) }}"
+  vars:
+    user_state: "{{ user.state | default('present', false) }}"
+
+- name: Ensure SSH authorized keys for '{{ user.name }}' are {{ user_state }}
+  vars:
+    user_state: "{{ user.state | default('present', false) }}"
+  when:
+    - user_state == 'present'
+    - user.authorized_keys | default([]) | length > 0
+  block:
+    - name: Ensure .ssh directory for user '{{ user.name }}' exists
+      ansible.builtin.file:
+        path: "{{ user.home | default('/home/' + user.name) + '/.ssh' }}"
+        state: "directory"
+        owner: "{{ user.name }}"
+        group: "{{ user.name }}"
+        mode: "0700"
+    - name: Ensure key is up to date
+      ansible.posix.authorized_key:
+        user: "{{ user.name }}"
+        state: "{{ key.state | default('present', true) }}"
+        key: "{{ key.type }} {{ key.key }}"
+        comment: "{{ user.name }}-{{ key.comment }}"
+      loop: "{{ user.authorized_keys }}"
+      loop_control:
+        loop_var: key
+        label: "{{ user.name }}-{{ key.comment }}"

roles/user/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+- name: Ensure users are configured
+  ansible.builtin.include_tasks:
+    file: "configure-user.yml"
+  loop: "{{ users }}"
+  loop_control:
+    loop_var: user
+    label: "{{ user.name }}"