---
# Podman runtime preparation: rootless container support for the admin user.

- name: Enable Podman socket activation
  ansible.builtin.systemd:
    name: podman.socket
    enabled: true
    state: started
  when: enable_podman_socket | bool

- name: Enable user lingering for rootless containers
  ansible.builtin.command: loginctl enable-linger {{ admin_user }}
  changed_when: false
  when: podman_enable_linger | bool

- name: Ensure subuid range for the admin user
  ansible.builtin.lineinfile:
    path: /etc/subuid
    regexp: '^{{ admin_user }}:'
    line: "{{ admin_user }}:{{ podman_subuid_start }}:65536"
  when: podman_manage_subuid | bool

- name: Ensure subgid range for the admin user
  ansible.builtin.lineinfile:
    path: /etc/subgid
    regexp: '^{{ admin_user }}:'
    line: "{{ admin_user }}:{{ podman_subgid_start }}:65536"
  when: podman_manage_subgid | bool

- name: Persist kernel modules for container networking
  ansible.builtin.copy:
    dest: /etc/modules-load.d/containers.conf
    owner: root
    group: root
    mode: "0644"
    content: "overlay\nbr_netfilter\n"

- name: Load overlay kernel module
  ansible.builtin.command: modprobe overlay
  changed_when: false

- name: Load br_netfilter kernel module
  ansible.builtin.command: modprobe br_netfilter
  changed_when: false

- name: Enable IPv4 forwarding persistently
  ansible.builtin.lineinfile:
    path: /etc/sysctl.d/99-podman.conf
    create: true
    regexp: '^net\.ipv4\.ip_forward'
    line: "net.ipv4.ip_forward = 1"
    mode: "0644"

- name: Apply IPv4 forwarding
  ansible.builtin.command: sysctl -w net.ipv4.ip_forward=1
  changed_when: false

- name: Configure Podman storage driver
  ansible.builtin.lineinfile:
    path: /etc/containers/storage.conf
    regexp: '^driver\s*='
    line: 'driver = "{{ podman_storage_driver }}"'