noticket - reorganized podman

ansible/roles/podman/tasks/containers/base/awsddns.yml

@@ -0,0 +1,81 @@
+---
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: awsddns
+    container_image: "{{ image }}"
+
+- name: create home.bdebyl.net awsddns server container
+  become: true
+  become_user: "{{ podman_user }}"
+  diff: false
+  containers.podman.podman_container:
+    name: awsddns
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    env:
+      AWS_ZONE_TTL: 60
+      AWS_ZONE_ID: "{{ aws_zone_id }}"
+      AWS_ZONE_HOSTNAME: "{{ aws_zone_hostname }}"
+      AWS_ACCESS_KEY_ID: "{{ aws_access_key_id }}"
+      AWS_SECRET_ACCESS_KEY: "{{ aws_secret_access_key }}"
+      AWS_DEFAULT_REGION: "{{ aws_default_region }}"
+
+- name: create systemd startup job for awsddns
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: awsddns
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: awsddns-skudak
+    container_image: "{{ image }}"
+
+- name: create wiki.skudakrennsport.com awsddns server container
+  become: true
+  become_user: "{{ podman_user }}"
+  diff: false
+  containers.podman.podman_container:
+    name: awsddns-skudak
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    env:
+      AWS_ZONE_TTL: 60
+      AWS_ZONE_ID: "{{ aws_skudak_zone_id }}"
+      AWS_ZONE_HOSTNAME: "{{ aws_skudak_zone_hostname }}"
+      AWS_ACCESS_KEY_ID: "{{ aws_skudak_access_key_id }}"
+      AWS_SECRET_ACCESS_KEY: "{{ aws_skudak_secret_access_key }}"
+      AWS_DEFAULT_REGION: "{{ aws_default_region }}"
+
+- name: create systemd startup job for awsddns-skudak
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: awsddns-skudak
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: awsddns-fulfillr
+    container_image: "{{ image }}"
+
+- name: create fulfillr.debyltech.com awsddns server container
+  become: true
+  become_user: "{{ podman_user }}"
+  diff: false
+  containers.podman.podman_container:
+    name: awsddns-fulfillr
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    env:
+      AWS_ZONE_TTL: 60
+      AWS_ZONE_ID: "{{ fulfillr_zone_id }}"
+      AWS_ZONE_HOSTNAME: "{{ fulfillr_server_name }}"
+      AWS_ACCESS_KEY_ID: "{{ fulfillr_dns_access_key }}"
+      AWS_SECRET_ACCESS_KEY: "{{ fulfillr_dns_secret_key }}"
+      AWS_DEFAULT_REGION: "{{ fulfillr_region }}"
+
+- name: create systemd startup job for awsddns-fulfillr
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: awsddns-fulfillr

ansible/roles/podman/tasks/containers/base/conf-nginx-http.yml

@@ -0,0 +1,101 @@
+---
+- name: create required nginx volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ nginx_path }}/etc"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  tags: http
+
+- name: setup nginx base configuration
+  become: true
+  ansible.builtin.template:
+    src: templates/nginx/nginx.conf.j2
+    dest: "{{ nginx_path }}/etc/nginx.conf"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: http
+
+- name: create required nginx files
+  become: true
+  ansible.builtin.copy:
+    src: "files/nginx/{{ item }}"
+    dest: "{{ nginx_path }}/etc/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - mime.types
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: http
+
+- name: setup nginx directories
+  become: true
+  ansible.builtin.file:
+    path: "{{ nginx_path }}/etc/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    state: directory
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - sites-enabled
+    - sites-available
+  tags: http
+
+- name: template nginx http sites-available
+  become: true
+  ansible.builtin.template:
+    src: "templates/nginx/sites/{{ item }}.j2"
+    dest: "{{ nginx_path }}/etc/sites-available/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - "{{ assistant_server_name }}.conf"
+    - "{{ bookstack_server_name }}.conf"
+    - "{{ ci_server_name }}.http.conf"
+    - "{{ cloud_server_name }}.conf"
+    - "{{ cloud_skudak_server_name }}.conf"
+    - "{{ fulfillr_server_name }}.conf"
+    - "{{ home_server_name }}.conf"
+    - "{{ logs_server_name }}.conf"
+    - "{{ parts_server_name }}.conf"
+    - "{{ photos_server_name }}.conf"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: http
+
+- name: enable desired nginx http sites
+  become: true
+  ansible.builtin.file:
+    src: "../sites-available/{{ item }}"
+    dest: "{{ nginx_path }}/etc/sites-enabled/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    state: link
+  loop:
+    - "{{ assistant_server_name }}.conf"
+    - "{{ bookstack_server_name }}.conf"
+    - "{{ ci_server_name }}.http.conf"
+    - "{{ cloud_server_name }}.conf"
+    - "{{ cloud_skudak_server_name }}.conf"
+    - "{{ fulfillr_server_name }}.conf"
+    - "{{ home_server_name }}.conf"
+    - "{{ logs_server_name }}.conf"
+    - "{{ parts_server_name }}.conf"
+    - "{{ photos_server_name }}.conf"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: http

ansible/roles/podman/tasks/containers/base/conf-nginx-https.yml

@@ -0,0 +1,68 @@
+---
+- name: create nginx ssl directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ nginx_path }}/etc/ssl"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+    state: directory
+  tags: https
+
+- name: stat dhparam
+  become: true
+  ansible.builtin.stat:
+    path: "{{ nginx_path }}/etc/ssl/dhparam.pem"
+  register: dhparam
+  tags: https
+
+- name: generate openssl dhparam for nginx
+  become: true
+  ansible.builtin.command: |
+    openssl dhparam -out {{ nginx_path }}/ssl/dhparam.pem 2048
+  when: not dhparam.stat.exists
+  args:
+    creates: "{{ nginx_path }}/ssl/dhparam.pem"
+  tags: https
+
+- name: template nginx https sites-available
+  become: true
+  ansible.builtin.template:
+    src: "templates/nginx/sites/{{ item }}.j2"
+    dest: "{{ nginx_path }}/etc/sites-available/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - "{{ bookstack_server_name }}.https.conf"
+    - "{{ ci_server_name }}.https.conf"
+    - "{{ cloud_server_name }}.https.conf"
+    - "{{ cloud_skudak_server_name }}.https.conf"
+    - "{{ fulfillr_server_name }}.https.conf"
+    - "{{ parts_server_name }}.https.conf"
+    - "{{ photos_server_name }}.https.conf"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: https
+
+- name: enable desired nginx https sites
+  become: true
+  ansible.builtin.file:
+    src: "../sites-available/{{ item }}"
+    dest: "{{ nginx_path }}/etc/sites-enabled/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    state: link
+  loop:
+    - "{{ bookstack_server_name }}.https.conf"
+    - "{{ ci_server_name }}.https.conf"
+    - "{{ cloud_server_name }}.https.conf"
+    - "{{ cloud_skudak_server_name }}.https.conf"
+    - "{{ fulfillr_server_name }}.https.conf"
+    - "{{ parts_server_name }}.https.conf"
+    - "{{ photos_server_name }}.https.conf"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: https

ansible/roles/podman/tasks/containers/base/conf-nginx-modsec.yml

@@ -0,0 +1,127 @@
+---
+- name: create nginx/conf directory
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - "{{ nginx_conf_path }}"
+    - "{{ modsec_rules_path }}"
+  notify: restorecon podman
+  tags: modsec
+
+- name: create modsec_includes.conf
+  become: true
+  ansible.builtin.copy:
+    src: files/nginx/modsec_includes.conf
+    dest: "{{ nginx_path }}/etc/modsec_includes.conf"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: modsec
+
+- name: clone coreruleset and modsecurity
+  become: true
+  ansible.builtin.git:
+    repo: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    update: "{{ update_modsec | default(false) }}"
+    force: true
+    version: "{{ item.ver }}"
+  loop: "{{ modsec_git_urls }}"
+  tags: modsec
+
+- name: setup modsec and coreruleset configs
+  become: true
+  ansible.builtin.copy:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    force: "{{ update_modsec | default(false) }}"
+    mode: 0644
+    remote_src: true
+  loop: "{{ modsec_conf_links }}"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags: modsec
+
+- name: setup coreruleset rules
+  become: true
+  ansible.builtin.copy:
+    src: "{{ crs_rules_path }}/{{ item.name }}.conf"
+    dest: "{{ modsec_rules_path }}/{{ item.name }}.conf"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    force: "{{ update_modsec | default(false) }}"
+    mode: 0644
+    remote_src: true
+  when: item.enabled
+  loop: "{{ crs_rule_links }}"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags:
+    - modsec
+    - modsec_rules
+
+- name: removed disabled coreruleset rules
+  become: true
+  ansible.builtin.file:
+    path: "{{ modsec_rules_path }}/{{ item.name }}.conf"
+    state: absent
+  when: not item.enabled
+  loop: "{{ crs_rule_links }}"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags:
+    - modsec
+    - modsec_rules
+
+- name: setup coreruleset data
+  become: true
+  ansible.builtin.copy:
+    src: "{{ crs_rules_path }}/{{ item }}.data"
+    dest: "{{ modsec_rules_path }}/{{ item }}.data"
+    force: "{{ update_modsec | default(false) }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+    remote_src: true
+  loop: "{{ crs_data_links }}"
+  notify:
+    - restorecon podman
+    - restart nginx
+  tags:
+    - modsec
+    - modsec_rules
+
+- name: whitelist local ip addresses
+  become: true
+  ansible.builtin.lineinfile:
+    path: "{{ modsec_crs_before_rule_conf }}"
+    regexp: "{{ modsec_whitelist_local_re }}"
+    line: "{{ modsec_whitelist_local }}"
+  notify: restart nginx
+  tags:
+    - modsec
+    - modsec_rules
+    - modsec_whitelist
+
+- name: activate mod-security
+  become: true
+  ansible.builtin.lineinfile:
+    path: "{{ nginx_path }}/etc/modsecurity.conf"
+    regexp: "{{ item.regex }}"
+    line: "{{ item.line }}"
+  loop: "{{ modsec_conf_replaces }} "
+  notify: restart nginx
+  tags: modsec

ansible/roles/podman/tasks/containers/base/conf-nginx.yml

@@ -0,0 +1,23 @@
+---
+- name: create letsencrypt shared root srv directory
+  become: true
+  ansible.builtin.file:
+    path: /srv/http/letsencrypt
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+    state: directory
+  tags:
+    - ssl
+    - https
+
+- import_tasks: conf-nginx-http.yml
+- import_tasks: conf-nginx-https.yml
+- import_tasks: conf-nginx-modsec.yml
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+  tags:
+    - http
+    - modsec
+    - modsec_rules

ansible/roles/podman/tasks/containers/base/nginx.yml

@@ -0,0 +1,32 @@
+---
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: nginx
+    container_image: "{{ image }}"
+
+- name: create nginx container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: nginx
+    image: "{{ image }}"
+    entrypoint: ""
+    command: ["nginx", "-g", "daemon off;"]
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - host
+    cap_add:
+      - CAP_NET_BIND_SERVICE
+    ports:
+      - 80:80
+      - 443:443
+    volumes:
+      - "{{ nginx_path }}/etc:/etc/nginx:ro"
+      - "/srv/http/letsencrypt:/srv/http/letsencrypt:z"
+      - "/etc/letsencrypt:/etc/letsencrypt:ro"
+
+- name: create systemd startup job for nginx
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: nginx

ansible/roles/podman/tasks/containers/debyltech/fulfillr.yml

@@ -0,0 +1,55 @@
+---
+- import_tasks: ecr/podman-ecr-login.yml
+
+- name: create fulfillr host directory volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ fulfillr_path }}"
+
+- name: template fulfillr config
+  become: true
+  ansible.builtin.template:
+    src: "templates/fulfillr/{{ item }}.j2"
+    dest: "{{ fulfillr_path }}/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - production.json
+  notify:
+    - restorecon podman
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: fulfillr
+    container_image: "{{ image }}"
+
+- name: create fulfillr server container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: fulfillr
+    image: "{{ image }}"
+    image_strict: true
+    command: --config /config/production.json
+    restart_policy: on-failure:3
+    log_driver: journald
+    volumes:
+      - "{{ fulfillr_path }}:/config"
+    ports:
+      - 9054:8080/tcp
+
+- name: create systemd startup job for fulfillr
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: fulfillr

ansible/roles/podman/tasks/containers/games/factorio.yml

@@ -0,0 +1,46 @@
+---
+- name: create factorio host directory volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ factorio_path }}"
+
+- name: unshare chown the elastic volume
+  become: true
+  become_user: "{{ podman_user }}"
+  changed_when: false
+  ansible.builtin.command: |
+    podman unshare chown -R 845:845 {{ factorio_path }}
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: factorio
+    container_image: "{{ image }}"
+
+- name: create factorio server container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: factorio
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    volumes:
+      - "{{ factorio_path }}:/factorio"
+    ports:
+      - 34197:34197/udp
+      - 27015:27015/tcp
+
+- name: create systemd startup job for factorio
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: factorio

ansible/roles/podman/tasks/containers/games/palworld.yml

@@ -0,0 +1,56 @@
+---
+- name: create palworld host directory volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ palworld_path }}"
+
+- name: unshare chown the palworld volumes
+  become: true
+  become_user: "{{ podman_user }}"
+  changed_when: false
+  ansible.builtin.command: |
+    podman unshare chown -R 1000:10000 {{ palworld_path }}
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: palworld
+    container_image: "{{ image }}"
+
+- name: create palworld server container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: palworld
+    image: "{{ image }}"
+    image_strict: true
+    restart_policy: unless-stopped
+    log_driver: journald
+    volumes:
+      - "{{ palworld_path }}:/palworld"
+    env:
+      ALWAYS_UPDATE_ON_START: "true"
+      MAX_PLAYERS: 32
+      MULTITHREAD_ENABLED: "true"
+      COMMUNITY_SERVER: "false"
+      RCON_ENABLED: "true"
+      RCON_PORT: 25575
+      PUBLIC_PORT: 8211
+      SERVER_NAME: Bearbehr and Friends
+      SERVER_DESCRIPTION: Bearbehr's Dedicated Server for Friends
+      SERVER_PASSWORD: ""
+      ADMIN_PASSWORD: "{{ palworld_admin_password }}"
+    ports:
+      - 8211:8211/udp
+      - 25575:25575/udp
+
+- name: create systemd startup job for palworld
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: palworld

ansible/roles/podman/tasks/containers/home/cloud.yml

@@ -0,0 +1,100 @@
+---
+- name: create required cloud volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_subuid.stdout }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ cloud_path }}/apps"
+    - "{{ cloud_path }}/config"
+    - "{{ cloud_path }}/data"
+    - "{{ cloud_path }}/mysql"
+
+- name: unshare chown the nextcloud volumes
+  become: true
+  become_user: "{{ podman_user }}"
+  changed_when: false
+  ansible.builtin.command: |
+    podman unshare chown -R 33:33 {{ cloud_path }}/apps {{ cloud_path }}/data {{ cloud_path}}/config
+
+- name: get user/group id from unshare
+  become: true
+  ansible.builtin.stat:
+    path: "{{ cloud_path }}/data"
+  register: cloud_owner
+
+- name: mount cloud cifs
+  become: true
+  ansible.posix.mount:
+    src: "{{ cloud_cifs_src }}"
+    path: "{{ cloud_path }}/data"
+    fstype: cifs
+    opts: "username=cloud,password={{ cloud_cifs_pass }},uid={{ cloud_owner.stat.uid }},gid={{ cloud_owner.stat.uid }},file_mode=0770,dir_mode=0770"
+    state: mounted
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: cloud-db
+    container_image: "{{ db_image }}"
+
+- name: create cloud-db container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: cloud-db
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MYSQL_ROOT_PASSWORD: "{{ cloud_db_root_pass }}"
+      MYSQL_DATABASE: cloud
+      MYSQL_PASSWORD: "{{ cloud_db_pass }}"
+      MYSQL_USER: cloud
+    volumes:
+      - "{{ cloud_path }}/mysql:/var/lib/mysql"
+
+- name: create systemd startup job for cloud-db
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: cloud-db
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: cloud
+    container_image: "{{ image }}"
+
+- name: create cloud container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: cloud
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MYSQL_PASSWORD: "{{ cloud_db_pass }}"
+      MYSQL_DATABASE: cloud
+      MYSQL_HOST: cloud-db
+      MYSQL_USER: cloud
+    volumes:
+      - "{{ cloud_path }}/apps:/var/www/html/custom_apps"
+      - "{{ cloud_path }}/data:/var/www/html/data"
+      - "{{ cloud_path }}/config:/var/www/html/config"
+    ports:
+      - "8089:80"
+
+- name: create systemd startup job for cloud
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: cloud

ansible/roles/podman/tasks/containers/home/drone.yml

@@ -0,0 +1,79 @@
+---
+- name: create required drone volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ drone_path }}/data"
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: drone
+    container_image: "{{ image }}"
+
+- name: create drone-ci server container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: drone
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      DRONE_LOGS_DEBUG: "false"
+      DRONE_RPC_DEBUG: "false"
+      DRONE_GITHUB_CLIENT_ID: "{{ drone_gh_client_id }}"
+      DRONE_GITHUB_CLIENT_SECRET: "{{ drone_gh_client_sec }}"
+      DRONE_RPC_SECRET: "{{ drone_rpc_secret }}"
+      DRONE_SERVER_HOST: "{{ ci_server_name }}"
+      DRONE_SERVER_PROTO: "{{ drone_server_proto }}"
+      DRONE_USER_FILTER: "{{ drone_user_filter }}"
+    volumes:
+      - "{{ drone_path }}/data:/data"
+    ports:
+      - "8080:80"
+
+- name: create systemd startup job for drone
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: drone
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: drone-runner
+    container_image: "{{ runner_image }}"
+
+- name: create drone-ci worker container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: drone-runner
+    image: "{{ runner_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      DRONE_RPC_SECRET: "{{ drone_rpc_secret }}"
+      DRONE_RPC_HOST: "drone"
+      DRONE_RPC_PROTO: "{{ drone_runner_proto }}"
+      DRONE_RUNNER_CAPACITY: "{{ drone_runner_capacity }}"
+    volumes:
+      - "/run/user/1002/podman/podman.sock:/var/run/docker.sock"
+    ports:
+      - "3000:3000"
+
+- name: create systemd startup job for drone-runner
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: drone-runner

ansible/roles/podman/tasks/containers/home/graylog.yml

@@ -0,0 +1,128 @@
+---
+- name: create required graylog volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ graylog_path }}/mongo"
+    - "{{ graylog_path }}/elastic"
+    - "{{ graylog_path }}/conf"
+    - "{{ graylog_path }}/bin"
+
+- name: copy configuration files
+  become: true
+  ansible.builtin.copy:
+    src: "files/graylog/{{ item.src }}"
+    dest: "{{ graylog_path }}/{{ item.dest }}"
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  loop:
+    - src: "graylogctl"
+      dest: "bin/graylogctl"
+    - src: "graylog.conf"
+      dest: "conf/graylog.conf"
+  notify: restorecon podman
+
+- name: unshare chown the elastic volume
+  become: true
+  become_user: "{{ podman_user }}"
+  changed_when: false
+  ansible.builtin.command: |
+    podman unshare chown -R 1000:1000 {{ graylog_path }}/elastic
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: graylog-mongo
+    container_image: "{{ db_image }}"
+
+- name: create graylog mongodb container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: graylog-mongo
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    network:
+      - shared
+    volumes:
+      - "{{ graylog_path }}/mongo:/data/db"
+
+- name: create systemd startup job for graylog-mongo
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: graylog-mongo
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: graylog-elastic
+    container_image: "{{ es_image }}"
+
+- name: create graylog elasticsearch container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: graylog-elastic
+    image: "{{ es_image }}" 
+    restart_policy: on-failure:3
+    network:
+      - shared
+    volumes:
+      - "{{ graylog_path }}/elastic:/usr/share/elasticsearch/data"
+    env:
+      http.host: "0.0.0.0"
+      transport.host: "localhost"
+      network.host: "0.0.0.0"
+      cluster.name: "graylog"
+      ES_JAVA_OPTS: "-Dlog4j2.formatMsgNoLookups=true -Xms512m -Xmx2048m"
+
+- name: create systemd startup job for graylog-elastic
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: graylog-elastic
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: graylog
+    container_image: "{{ image }}"
+
+- name: create graylog container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: graylog
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    sysctl:
+      net.ipv6.conf.all.disable_ipv6: 1
+      net.ipv6.conf.default.disable_ipv6: 1
+    network:
+      - shared
+    volumes:
+      - "{{ graylog_path }}/conf:/usr/share/graylog/data/config"
+      - "{{ graylog_path }}/bin:/usr/share/graylog/bin"
+    env:
+      GRAYLOG_PASSWORD_SECRET: "{{ graylog_secret }}"
+      GRAYLOG_ROOT_PASSWORD_SHA2: "{{ graylog_root_pass_sha2 }}"
+      GRAYLOG_HTTP_EXTERNAL_URI: http://{{ ansible_default_ipv4.address }}:9000/
+      GRAYLOG_HTTP_BIND_ADDRESS: 0.0.0.0:9000
+      GRAYLOG_MONGODB_URI: mongodb://graylog-mongo/graylog
+      GRAYLOG_ELASTICSEARCH_HOSTS: http://graylog-elastic:9200
+    ports:
+      - "{{ graylog_port }}:9000"
+      - "{{ syslog_udp_default }}:{{ syslog_udp_default }}/udp"
+      - "{{ syslog_udp_unifi }}:{{ syslog_udp_unifi }}/udp"
+      - "{{ syslog_udp_error }}:{{ syslog_udp_error }}/udp"
+
+- name: create systemd startup job for graylog
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: graylog

ansible/roles/podman/tasks/containers/home/hass.yml

@@ -0,0 +1,56 @@
+---
+- name: create home-assistant host directory volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ hass_path }}/media"
+    - "{{ hass_path }}/config"
+
+- name: copy configuration and automations
+  become: true
+  ansible.builtin.copy:
+    src: "files/hass/{{ item }}"
+    dest: "{{ hass_path }}/config/{{ item }}"
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0644
+  notify: restorecon podman
+  loop:
+    - configuration.yaml
+    - automations.yaml
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: hass
+    container_image: "{{ image }}"
+
+- name: create home-assistant server container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: hass
+    image: "{{ image }}" 
+    restart_policy: on-failure:3
+    log_driver: journald
+    cap_add:
+      - CAP_NET_RAW
+      - CAP_NET_BIND_SERVICE
+    volumes:
+      - "{{ hass_path }}/config:/config"
+      - "{{ hass_path }}/media:/share"
+    ports:
+      - "8123:8123"
+
+- name: create systemd startup job for hass
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: hass

ansible/roles/podman/tasks/containers/home/nosql.yml

@@ -0,0 +1,44 @@
+---
+- name: create nosql host directory volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ nosql_path }}/conf"
+    - "{{ nosql_path }}/data"
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: nosql
+    container_image: "{{ image }}"
+
+- name: create nosql container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: nosql
+    image: "{{ image }}"
+    command: redis-server --requirepass {{ nosql_password }} 
+    restart_policy: on-failure:3
+    log_driver: journald
+    volumes:
+      - "{{ nosql_path }}/conf:/usr/local/etc/redis/"
+      - "{{ nosql_path }}/data:/var/lib/redis"
+    env:
+      TZ: America/New_York
+      REDIS_REPLICATION_MODE: master
+    ports:
+      - 6379:6379/tcp
+
+- name: create systemd startup job for nosql
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: nosql

ansible/roles/podman/tasks/containers/home/partkeepr.yml

@@ -0,0 +1,66 @@
+---
+- name: create required partkeepr volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ partkeepr_path }}/mysql"
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: partkeepr-db
+    container_image: "{{ db_image }}"
+
+- name: create partkeepr-db container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: partkeepr-db
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
+      MYSQL_DATABASE: partkeepr
+      MYSQL_USER: partkeepr
+      MYSQL_PASSWORD: "{{ partkeepr_mysql_password }}"
+    volumes:
+      - "{{ partkeepr_path }}/mysql:/var/lib/mysql"
+
+- name: create systemd startup job for partkeepr-db
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: partkeepr-db
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: partkeepr
+    container_image: "{{ image }}"
+
+- name: create partkeepr container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: partkeepr
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    ports:
+      - "8081:80"
+
+- name: create systemd startup job for partkeepr
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: partkeepr

ansible/roles/podman/tasks/containers/home/photos.yml

@@ -0,0 +1,107 @@
+---
+- name: create required photos volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ photos_path }}/mysql"
+    - "{{ photos_path }}/storage"
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- name: mount photos cifs
+  become: true
+  ansible.posix.mount:
+    src: "{{ photos_cifs_src }}"
+    path: "{{ photos_path }}/storage"
+    fstype: cifs
+    opts: "username=photos,password={{ photos_cifs_pass }},uid={{ podman_subuid.stdout }},gid={{ podman_subuid.stdout }}"
+    state: mounted
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: photos-db
+    container_image: "{{ db_image }}"
+
+- name: create photos-db container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: photos-db
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MARIADB_AUTO_UPGRADE: "1"
+      MYSQL_ROOT_PASSWORD: "{{ photos_db_root_pass }}"
+      MYSQL_DATABASE: photos
+      MYSQL_USER: photos
+      MYSQL_PASSWORD: "{{ photos_db_pass }}"
+    volumes:
+      - "{{ photos_path }}/mysql:/var/lib/mysql"
+
+- name: create systemd startup job for photos-db
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: photos-db
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: photos
+    container_image: "{{ image }}"
+
+- name: create photos container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: photos
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      PHOTOPRISM_ADMIN_PASSWORD: "{{ photos_user_pass }}"
+      PHOTOPRISM_AUTH_MODE: "password"
+      PHOTOPRISM_SITE_URL: "https://photos.bdebyl.net/"
+      PHOTOPRISM_ORIGINALS_LIMIT: 5000
+      PHOTOPRISM_HTTP_COMPRESSION: "gzip"
+      PHOTOPRISM_LOG_LEVEL: "info"
+      PHOTOPRISM_READONLY: "false"
+      PHOTOPRISM_EXPERIMENTAL: "false"
+      PHOTOPRISM_DISABLE_CHOWN: "false"
+      PHOTOPRISM_DISABLE_WEBDAV: "false"
+      PHOTOPRISM_DISABLE_SETTINGS: "false"
+      PHOTOPRISM_DISABLE_TENSORFLOW: "false"
+      PHOTOPRISM_DISABLE_FACES: "false"
+      PHOTOPRISM_DISABLE_CLASSIFICATION: "false"
+      PHOTOPRISM_DISABLE_RAW: "false"
+      PHOTOPRISM_RAW_PRESETS: "false"
+      PHOTOPRISM_JPEG_QUALITY: 85
+      PHOTOPRISM_DETECT_NSFW: "false"
+      PHOTOPRISM_UPLOAD_NSFW: "true"
+      PHOTOPRISM_DATABASE_DRIVER: "mysql"
+      PHOTOPRISM_DATABASE_SERVER: "photos-db:3306"
+      PHOTOPRISM_DATABASE_NAME: "photos"
+      PHOTOPRISM_DATABASE_USER: "photos"
+      PHOTOPRISM_DATABASE_PASSWORD: "{{ photos_db_pass }}"
+      PHOTOPRISM_SITE_CAPTION: "AI-Powered Photos App"
+      PHOTOPRISM_SITE_DESCRIPTION: ""
+      PHOTOPRISM_SITE_AUTHOR: "Bastian D."
+    volumes:
+      - "{{ photos_path }}/storage:/photoprism/"
+    ports:
+      - "8088:2342"
+
+- name: create systemd startup job for photos
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: photos

ansible/roles/podman/tasks/containers/skudak/cloud.yml

@@ -0,0 +1,100 @@
+---
+- name: create required skudak cloud volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_subuid.stdout }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ cloud_skudak_path }}/apps"
+    - "{{ cloud_skudak_path }}/config"
+    - "{{ cloud_skudak_path }}/data"
+    - "{{ cloud_skudak_path }}/mysql"
+
+- name: unshare chown the skudak cloud volumes
+  become: true
+  become_user: "{{ podman_user }}"
+  changed_when: false
+  ansible.builtin.command: |
+    podman unshare chown -R 33:33 {{ cloud_skudak_path }}/apps {{ cloud_skudak_path }}/data {{ cloud_skudak_path}}/config
+
+- name: get user/group id from unshare
+  become: true
+  ansible.builtin.stat:
+    path: "{{ cloud_skudak_path }}/data"
+  register: cloud_skudak_owner
+
+- name: mount cloud cifs
+  become: true
+  ansible.posix.mount:
+    src: "{{ cloud_skudak_cifs_src }}"
+    path: "{{ cloud_skudak_path }}/data"
+    fstype: cifs
+    opts: "username=skucloud,password={{ cloud_skudak_cifs_pass }},uid={{ cloud_skudak_owner.stat.uid }},gid={{ cloud_skudak_owner.stat.uid }},file_mode=0770,dir_mode=0770"
+    state: mounted
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: skudak-cloud-db
+    container_image: "{{ db_image }}"
+
+- name: create skudak-cloud-db container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: skudak-cloud-db
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MYSQL_ROOT_PASSWORD: "{{ cloud_skudak_db_root_pass }}"
+      MYSQL_DATABASE: skucloud
+      MYSQL_PASSWORD: "{{ cloud_skudak_db_pass }}"
+      MYSQL_USER: skucloud
+    volumes:
+      - "{{ cloud_skudak_path }}/mysql:/var/lib/mysql"
+
+- name: create systemd startup job for skudak-cloud-db
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: skudak-cloud-db
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: skudak-cloud
+    container_image: "{{ image }}"
+
+- name: create skudak cloud container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: skudak-cloud
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MYSQL_PASSWORD: "{{ cloud_skudak_db_pass }}"
+      MYSQL_DATABASE: skucloud
+      MYSQL_HOST: skudak-cloud-db
+      MYSQL_USER: skucloud
+    volumes:
+      - "{{ cloud_skudak_path }}/apps:/var/www/html/custom_apps"
+      - "{{ cloud_skudak_path }}/data:/var/www/html/data"
+      - "{{ cloud_skudak_path }}/config:/var/www/html/config"
+    ports:
+      - "8090:80"
+
+- name: create systemd startup job for cloud
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: skudak-cloud

ansible/roles/podman/tasks/containers/skudak/wiki.yml

@@ -0,0 +1,94 @@
+---
+- name: create required bookstack volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_subuid.stdout }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ bookstack_path }}/mysql"
+    - "{{ bookstack_path }}/public"
+    - "{{ bookstack_path }}/storage"
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- name: unshare chown the bookstack upload volumes
+  become: true
+  become_user: "{{ podman_user }}"
+  changed_when: false
+  ansible.builtin.command: |
+    podman unshare chown -R 33:33 {{ bookstack_path }}/public {{ bookstack_path }}/storage
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: bookstack-db
+    container_image: "{{ db_image }}"
+    
+- name: create bookstack-db container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: bookstack-db
+    image: "{{ db_image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      MYSQL_ROOT_PASSWORD: "{{ bookstack_db_root_pass }}"
+      TZ: "America/New_York"
+      MYSQL_DATABASE: bookstack
+      MYSQL_USER: bookstack
+      MYSQL_PASSWORD: "{{ bookstack_db_pass }}"
+    volumes:
+      - "{{ bookstack_path }}/mysql:/var/lib/mysql"
+
+- name: create systemd startup job for bookstack-db
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: bookstack-db
+
+- import_tasks: podman/podman-check.yml
+  vars:
+    container_name: bookstack
+    container_image: "{{ image }}"
+
+- name: create bookstack container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: bookstack
+    image: "{{ image }}"
+    restart_policy: on-failure:3
+    log_driver: journald
+    network:
+      - shared
+    env:
+      APP_URL: "https://wiki.skudakrennsport.com"
+      APP_KEY: "{{ bookstack_app_key }}"
+      DB_HOST: "bookstack-db"
+      DB_USERNAME: "bookstack"
+      DB_DATABASE: "bookstack"
+      DB_PASSWORD: "{{ bookstack_db_pass }}"
+      MAIL_DRIVER: "smtp"
+      MAIL_HOST: "{{ bookstack_mail_host }}"
+      MAIL_PORT: 465
+      MAIL_ENCRYPTION: "ssl"
+      MAIL_USERNAME: "{{ bookstack_mail_user }}"
+      MAIL_PASSWORD: "{{ bookstack_mail_pass }}"
+      MAIL_FROM: "{{ bookstack_mail_user }}"
+      MAIL_FROM_NAME: "Skudak Wiki"
+    ports:
+      - "6875:8080"
+    volumes:
+      - "{{ bookstack_path }}/public:/var/www/bookstack/public/uploads"
+      - "{{ bookstack_path }}/storage:/var/www/bookstack/storage/uploads"
+
+- name: create systemd startup job for bookstack
+  include_tasks: podman/systemd-generate.yml
+  vars:
+    container_name: bookstack