initial opencode commit

roles/selinux/tasks/main.yml

@@ -0,0 +1,22 @@
+---
+# SELinux hardening: enforcing mode plus correct labels for container data.
+
+- name: Enforce SELinux (targeted policy)
+  ansible.builtin.selinux:
+    policy: targeted
+    state: enforcing
+
+- name: Ensure semanage is available
+  ansible.builtin.dnf:
+    name: policycoreutils-python-utils
+    state: present
+
+- name: Add SELinux file context for the Minecraft data directory
+  ansible.builtin.command:
+    cmd: semanage fcontext -a -t container_file_t "{{ minecraft_data_dir }}(/.*)?"
+  register: selinux_fcontext
+  changed_when: selinux_fcontext.rc == 0
+  failed_when:
+    - selinux_fcontext.rc != 0
+    - "'already defined' not in (selinux_fcontext.stdout + selinux_fcontext.stderr)"
+  when: selinux_set_minecraft_fcontext | bool