grm/ansible/roles/gitea-runner/tasks/rootless_docker.yml

---
- name: Ensure keyrings directory exists (Debian/Ubuntu)
  ansible.builtin.file:
    path: "/etc/apt/keyrings"
    state: directory
    mode: "0755"
  when: ansible_facts['os_family'] == 'Debian'

- name: Download and dearmor Docker GPG key (Debian/Ubuntu)
  ansible.builtin.shell: |
    set -o pipefail
    curl -fsSL "https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}/gpg" | gpg --dearmor --yes -o {{ docker_gpg_key_path }}
  args:
    creates: "{{ docker_gpg_key_path }}"
    executable: /bin/bash
  when: ansible_facts['os_family'] == 'Debian'

- name: Add Docker APT repository (Debian/Ubuntu)
  ansible.builtin.copy:
    dest: /etc/apt/sources.list.d/docker.list
    content: "{{ docker_apt_source_line }}\n"
    mode: "0644"
  register: docker_apt_repo
  when: ansible_facts['os_family'] == 'Debian'

- name: Update apt cache after adding Docker repo (Debian/Ubuntu)
  ansible.builtin.apt:
    update_cache: true
  when:
    - ansible_facts['os_family'] == 'Debian'
    - docker_apt_repo is changed

- name: Install rootless Docker dependencies (Debian/Ubuntu)
  ansible.builtin.apt:
    name:
      - uidmap
      - slirp4netns
      - passt
      - fuse-overlayfs
      - docker-ce
      - docker-ce-cli
      - docker-ce-rootless-extras
      - containerd.io
      - docker-compose-plugin
      - rsync
    state: present
  when: ansible_facts['os_family'] == 'Debian'

- name: Update pacman cache (Arch Linux)
  community.general.pacman:
    update_cache: true
  when: ansible_facts['os_family'] == 'Archlinux'
  changed_when: false

- name: Install rootless Docker dependencies (Arch Linux)
  community.general.pacman:
    name:
      - docker
      - docker-compose
      - slirp4netns
      - passt
      - fuse-overlayfs
      - rsync
    state: present
  when: ansible_facts['os_family'] == 'Archlinux'

- name: Check if rootless Docker is already set up
  ansible.builtin.stat:
    path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service"
  register: rootless_docker_check

- name: Set up rootless Docker for runner user
  ansible.builtin.command: dockerd-rootless-setuptool.sh install
  args:
    creates: "{{ gitea_runner_home }}/.config/systemd/user/docker.service"
  become: true
  become_user: "{{ gitea_runner_service_user }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
  when:
    - docker_rootless_setup
    - not rootless_docker_check.stat.exists

- name: Start rootless Docker daemon (systemd user service)
  ansible.builtin.command: systemctl --user start docker
  become: true
  become_user: "{{ gitea_runner_service_user }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
  changed_when: true
  when: docker_rootless_setup

- name: Enable rootless Docker daemon (systemd user service)
  ansible.builtin.command: systemctl --user enable docker
  become: true
  become_user: "{{ gitea_runner_service_user }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
  changed_when: true
  when: docker_rootless_setup

- name: Ensure Docker config directory exists
  ansible.builtin.file:
    path: "{{ gitea_runner_home }}/.config/docker"
    state: directory
    mode: "0755"
    owner: "{{ gitea_runner_service_user }}"
    group: "{{ gitea_runner_service_user }}"
  when: docker_rootless_setup

- name: Ensure systemd user override directory exists
  ansible.builtin.file:
    path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d"
    state: directory
    mode: "0755"
    owner: "{{ gitea_runner_service_user }}"
    group: "{{ gitea_runner_service_user }}"
  when: docker_rootless_setup

- name: Configure rootless Docker to use pasta with IPv6
  ansible.builtin.copy:
    dest: "{{ gitea_runner_home }}/.config/systemd/user/docker.service.d/override.conf"
    content: |
      [Service]
      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_NET={{ docker_rootless_net_driver }}"
      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=implicit"
      Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS=--ipv6"
    mode: "0644"
    owner: "{{ gitea_runner_service_user }}"
    group: "{{ gitea_runner_service_user }}"
  register: docker_network_override
  when: docker_rootless_setup

- name: Reload systemd user daemon if network config changed
  ansible.builtin.command: systemctl --user daemon-reload
  become: true
  become_user: "{{ gitea_runner_service_user }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
  changed_when: true
  when:
    - docker_rootless_setup
    - docker_network_override is changed

- name: Configure rootless Docker daemon with IPv6 enabled
  ansible.builtin.copy:
    dest: "{{ gitea_runner_home }}/.config/docker/daemon.json"
    content: |
      {
        "ipv6": true,
        "ip6tables": true,
        "fixed-cidr-v6": "{{ docker_ipv6_cidr }}"
      }
    mode: "0644"
    owner: "{{ gitea_runner_service_user }}"
    group: "{{ gitea_runner_service_user }}"
  register: docker_ipv6_config
  when: docker_rootless_setup

- name: Restart rootless Docker if config changed
  ansible.builtin.command: systemctl --user restart docker
  become: true
  become_user: "{{ gitea_runner_service_user }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
  changed_when: true
  when:
    - docker_rootless_setup
    - docker_ipv6_config is changed or docker_network_override is changed

- name: Wait for rootless Docker daemon to be ready
  ansible.builtin.command: docker version
  become: true
  become_user: "{{ gitea_runner_service_user }}"
  environment:
    DOCKER_HOST: "unix:///run/user/{{ gitea_runner_uid }}/docker.sock"
    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
  register: docker_ready
  until: docker_ready.rc == 0
  retries: 10
  delay: 2
  changed_when: false
  when: docker_rootless_setup