initial opencode commit

roles/podman/defaults/main.yml

@@ -0,0 +1,8 @@
+---
+enable_podman_socket: true
+podman_enable_linger: true
+podman_manage_subuid: true
+podman_subuid_start: 200000
+podman_manage_subgid: true
+podman_subgid_start: 200000
+podman_storage_driver: overlay

roles/podman/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+# Podman runtime preparation: rootless container support for the admin user.
+
+- name: Enable Podman socket activation
+  ansible.builtin.systemd:
+    name: podman.socket
+    enabled: true
+    state: started
+  when: enable_podman_socket | bool
+
+- name: Enable user lingering for rootless containers
+  ansible.builtin.command: loginctl enable-linger {{ admin_user }}
+  changed_when: false
+  when: podman_enable_linger | bool
+
+- name: Ensure subuid range for the admin user
+  ansible.builtin.lineinfile:
+    path: /etc/subuid
+    regexp: '^{{ admin_user }}:'
+    line: "{{ admin_user }}:{{ podman_subuid_start }}:65536"
+  when: podman_manage_subuid | bool
+
+- name: Ensure subgid range for the admin user
+  ansible.builtin.lineinfile:
+    path: /etc/subgid
+    regexp: '^{{ admin_user }}:'
+    line: "{{ admin_user }}:{{ podman_subgid_start }}:65536"
+  when: podman_manage_subgid | bool
+
+- name: Persist kernel modules for container networking
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/containers.conf
+    owner: root
+    group: root
+    mode: "0644"
+    content: "overlay\nbr_netfilter\n"
+
+- name: Load overlay kernel module
+  ansible.builtin.command: modprobe overlay
+  changed_when: false
+
+- name: Load br_netfilter kernel module
+  ansible.builtin.command: modprobe br_netfilter
+  changed_when: false
+
+- name: Enable IPv4 forwarding persistently
+  ansible.builtin.lineinfile:
+    path: /etc/sysctl.d/99-podman.conf
+    create: true
+    regexp: '^net\.ipv4\.ip_forward'
+    line: "net.ipv4.ip_forward = 1"
+    mode: "0644"
+
+- name: Apply IPv4 forwarding
+  ansible.builtin.command: sysctl -w net.ipv4.ip_forward=1
+  changed_when: false
+
+- name: Configure Podman storage driver
+  ansible.builtin.lineinfile:
+    path: /etc/containers/storage.conf
+    regexp: '^driver\s*='
+    line: 'driver = "{{ podman_storage_driver }}"'