#!/bin/bash
# {{ ansible_managed }}
# Weekly reclaim of unused podman images and volumes.
#
# Every image bump leaves the previous tag behind and nothing ever removed
# them: this was written after finding 896 images totalling 59.6 GB, 75% of it
# unused -- 94 tags of greg-time-bot and 73 of fulfillr, one per deploy.
#
# --filter until={{ podman_prune_until }} keeps recent images so a rollback
# does not require a rebuild or re-pull. Anything older is unused AND stale.
#
# Volumes pruned here are podman's ANONYMOUS volumes, not the bind mounts
# under {{ podman_volumes }} that hold real service data -- those are
# directories on the host and podman does not know about them. The dangling
# ones seen in practice were 804 MB copies of Nextcloud's /var/www/html left
# by container recreations, which are image content, not data.
set -uo pipefail

TAG=podman-prune

log() { logger -t "$TAG" -p daemon.info -- "$*"; echo "$TAG: $*"; }

total_before=0
total_after=0

for u in {{ podman_prune_users | join(' ') }}; do
  # Rootless podman: -H so HOME points at the user's store, and the `cd;`
  # preamble is required (see CLAUDE.md) or podman cannot find its graph root.
  run() {
    sudo -H -u "$u" bash -c \
      'cd; d=/run/user/$(id -u); [ -d "$d" ] && export XDG_RUNTIME_DIR="$d"
       exec podman "$@"' _ "$@"
  }

  if ! id "$u" >/dev/null 2>&1; then
    log "user=$u status=skipped reason=no-such-user"
    continue
  fi

  before=$(run system df --format '{{ '{{' }}.Size{{ '}}' }}' 2>/dev/null | head -1)

  # Deliberately NOT `set -e`: a prune failing for one user must not stop the
  # other, and a busy image is a normal, non-fatal outcome.
  img=$(run image prune -af --filter "until={{ podman_prune_until }}" 2>&1 | tail -1)
  vol=$(run volume prune -f 2>&1 | tail -1)

  after=$(run system df --format '{{ '{{' }}.Size{{ '}}' }}' 2>/dev/null | head -1)

  log "user=$u images_before=$before images_after=$after"
  log "user=$u image_prune=${img:-none} volume_prune=${vol:-none}"
done

log "status=ok"