feat: new headscale role

roles/podman_headscale/tasks/main.yml

@@ -0,0 +1,141 @@
+---
+- name: Podman Headscale | PATCH | Open firewall for http and https services
+  ansible.posix.firewalld:
+    zone: "{{ podman_headscale_firewalld_zone }}"
+    service: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  become: true
+  with_items:
+    - http
+    - https
+
+- name: Podman Headscale | PATCH | Install data plate
+  ansible.builtin.template:
+    src: etc/motd.d/10-data-plate.txt
+    dest: /etc/motd.d/10-data-plate.txt
+    owner: root
+    group: root
+    mode: "0444"
+  become: true
+
+- name: Podman Headscale | PATCH | Install podman and verify rootless podman user
+  ansible.builtin.include_role:
+    role: sr2c.core.podman_host
+  vars:
+    podman_host_minimum_unpriv_port: 80
+    podman_host_rootless_users: ["{{ podman_headscale_podman_rootless_user }}"]
+
+- name: Podman Headscale | AUDIT | Get subuid range for user
+  ansible.builtin.command:
+    cmd: "getsubids {{ podman_headscale_podman_rootless_user }}"
+  register: _podman_headscale_user_subuid
+  changed_when: false
+
+- name: Podman Headscale | AUDIT | Get subgid range for user
+  ansible.builtin.command:
+    cmd: "getsubids -g {{ podman_headscale_podman_rootless_user }}"
+  register: _podman_headscale_user_subgid
+  changed_when: false
+
+- name: Podman Headscale | AUDIT | Parse outputs of getsubids and store results
+  ansible.builtin.set_fact:
+    _podman_headscale_user_subuid_start: "{{ _podman_headscale_user_subuid.stdout_lines[0].split()[2] }}"
+    _podman_headscale_user_subgid_start: "{{ _podman_headscale_user_subgid.stdout_lines[0].split()[2] }}"
+
+# Headscale runs with UID/GID 0 inside the container
+# TODO: let's fix the above
+- name: Podman Headscale | PATCH | Create configuration directory for Headscale
+  ansible.builtin.file:
+    path: "/home/{{ podman_headscale_podman_rootless_user }}/headscale-config"
+    owner: "{{ podman_headscale_podman_rootless_user }}"
+    group: "{{ podman_headscale_podman_rootless_user }}"
+    mode: "0700"
+    state: "directory"
+  become: true
+
+- name: Podman Headscale | PATCH | Create data directory for Headscale
+  ansible.builtin.file:
+    path: "/home/{{ podman_headscale_podman_rootless_user }}/headscale-data"
+    owner: "{{ podman_headscale_podman_rootless_user }}"
+    group: "{{ podman_headscale_podman_rootless_user }}"
+    mode: "0700"
+    state: "directory"
+  become: true
+
+- name: Podman Headscale | PATCH | Install Headscale configuration
+  ansible.builtin.template:
+    src: "home/podman/headscale-config/{{ item }}"
+    dest: "/home/{{ podman_headscale_podman_rootless_user }}/headscale-config/{{ item }}"
+    mode: "0400"
+    owner: "{{ (_podman_headscale_user_subuid_start | int) + 65533 }}"
+    group: "{{ (_podman_headscale_user_subgid_start | int) + 65533 }}"
+  become: true
+  with_items:
+    - acls.hujson
+    - config.yaml
+  notify:
+    - Restart Headscale
+
+- name: Podman Headscale | PATCH | Install container quadlets
+  ansible.builtin.template:
+    src: "home/podman/config/containers/systemd/{{ item }}"
+    dest: "/home/{{ podman_headscale_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_headscale_podman_rootless_user }}"
+    mode: "0400"
+  with_items:
+    - headscale.container
+  become: true
+  notify:
+    - Restart Headscale
+
+- name: Podman Headscale | PATCH | Install network quadlets
+  ansible.builtin.template:
+    src: "home/podman/config/containers/systemd/{{ item }}"
+    dest: "/home/{{ podman_headscale_podman_rootless_user }}/.config/containers/systemd/{{ item }}"
+    owner: "{{ podman_headscale_podman_rootless_user }}"
+    mode: "0400"
+  with_items:
+    - headscale.network
+  become: true
+  notify:
+    - Restart Headscale
+
+- name: Podman Headscale | AUDIT | Verify quadlets are correctly defined
+  ansible.builtin.command: /usr/libexec/podman/quadlet -dryrun -user
+  register: podman_prometheus_quadlet_result
+  ignore_errors: true
+  changed_when: false
+  become: true
+  become_user: "{{ podman_headscale_podman_rootless_user }}"
+
+- name: Podman Headscale | AUDIT | Assert that the quadlet verification succeeded
+  ansible.builtin.assert:
+    that:
+      - podman_prometheus_quadlet_result.rc == 0
+    fail_msg: "'/usr/libexec/podman/quadlet -dryrun -user' failed! Output withheld to prevent leaking secrets."
+
+- name: Podman Headscale | PATCH | Make sure Headscale is running now and started on boot
+  ansible.builtin.systemd_service:
+    name: "{{ item }}.service"
+    enabled: true
+    state: started
+    masked: false
+    daemon_reload: true
+    scope: user
+  with_items:
+    - headscale
+  become: true
+  become_user: "{{ podman_headscale_podman_rootless_user }}"
+
+- name: Podman Headscale | PATCH | Set up ClouDNS monitoring
+  sr2c.core.cloudns_monitor:
+    name: "Headscale - {{ podman_headscale_web_hostname[:20] }}"
+    host: "{{ inventory_hostname }}"
+    ip: "{{ inventory_hostname }}"
+    http_status_code: "200"
+    emails: "{{ cloudns_monitoring_emails }}"
+    auth_id: "{{ cloudns_auth_id }}"
+    auth_password: "{{ cloudns_auth_password }}"
+  delegate_to: localhost