Initial import; migrate some roles from irl.wip

roles/podman_host/tasks/check_subid.yml

@@ -0,0 +1,41 @@
+---
+- name: Podman Host | AUDIT | Gather rootless user facts
+  ansible.builtin.user:
+    name: "{{ _podman_host_rootless_user }}"
+  register: _podman_host_rootless_user_facts
+
+- name: Podman Host | AUDIT | Resolve name of user's primary group
+  ansible.builtin.getent:
+    database: group
+    key: "{{ _podman_host_rootless_user_facts.group }}"
+  register: _podman_host_rootless_user_group
+
+- name: Podman Host | AUDIT | Check if user is in subuid file
+  ansible.builtin.lineinfile:
+    path: /etc/subuid
+    regexp: '^{{ _podman_host_rootless_user }}:.*$'
+    state: absent
+  register: uid_line_found
+  check_mode: yes
+  failed_when: false
+  changed_when: false
+
+- name: Podman Host | AUDIT | Check if group is in subgid file
+  ansible.builtin.lineinfile:
+    path: /etc/subgid
+    regexp: '^{{ _podman_host_rootless_user_group.ansible_facts.getent_group | first }}:.*$'
+    state: absent
+  register: gid_line_found
+  check_mode: yes
+  failed_when: false
+  changed_when: false
+
+- name: Podman Host | AUDIT | Assert that user is in subuid file exactly once
+  ansible.builtin.assert:
+    that:
+      - uid_line_found.found == 1
+
+- name: Podman Host | AUDIT | Assert that group is in subgid file exactly once
+  ansible.builtin.assert:
+    that:
+      - gid_line_found.found == 1

roles/podman_host/tasks/main.yml

@@ -0,0 +1,75 @@
+---
+- name: Podman Host | PRELIM | Ensure the rootless users are defined and are not root
+  ansible.builtin.assert:
+    that:
+      - podman_host_rootless_users | length > 0
+      - '"root" not in podman_host_rootless_users'
+
+- name: Podman Host | AUDIT | Ensure that subuid and subgid are defined for the users
+  ansible.builtin.include_tasks:
+    file: check_subid.yml
+  vars:
+    _podman_host_rootless_user: "{{ item }}"
+  with_items: "{{ podman_host_rootless_users }}"
+
+- name: Podman Host | PATCH | Set unprivileged port minimum
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_unprivileged_port_start
+    value: "{{ podman_host_minimum_unpriv_port }}"
+    sysctl_set: true
+    sysctl_file: /etc/sysctl.d/zzz-podman-unpriv-port.conf
+    reload: true
+  become: true
+
+- name: Podman Host | PATCH | Create users for rootless podman
+  ansible.builtin.user:
+    name: "{{ item }}"
+  become: true
+  with_items: "{{ podman_host_rootless_users }}"
+
+- name: Podman Host | PATCH | Set XDG_RUNTIME_DIR in .profile for rootless users
+  ansible.builtin.lineinfile:
+    path: "/home/{{ item }}/.bash_profile"
+    line: "export XDG_RUNTIME_DIR=/run/user/$(id -u)"
+    create: false
+  become: true
+  become_user: "{{ item }}"
+  with_items: "{{ podman_host_rootless_users }}"
+
+- name: Podman Host | PATCH | Enable linger for rootless users
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/loginctl
+      - enable-linger
+      - "{{ item }}"
+    creates: "/var/lib/systemd/linger/{{ item }}"
+  become: true
+  with_items: "{{ podman_host_rootless_users }}"
+
+- name: Podman Host | PATCH | Install Podman
+  ansible.builtin.dnf:
+    name:
+      - podman
+      - container-selinux
+    state: latest
+  become: true
+
+- name: Podman Host | PATCH | Create users quadlets directory
+  ansible.builtin.file:
+    path: "/home/{{ item }}/.config/containers/systemd"
+    state: directory
+    owner: "{{ item }}"
+    group: "{{ item }}"
+    mode: "0700"
+  with_items: "{{ podman_host_rootless_users }}"
+  become: true
+
+- name: Podman Host | PATCH | Enable podman auto update timer for users
+  ansible.builtin.systemd_service:
+    name: podman-auto-update.timer
+    scope: user
+    state: started
+    enabled: true
+  become: true
+  become_user: "{{ item }}"
+  with_items: "{{ podman_host_rootless_users }}"