nuc_storage.yml

# ansible-galaxy collection install linux_system_roles.storage
# then
# cd ~/.ansible/collections/ansible_collections/fedora/linux_system_roles/requirements.yml
# ansible-galaxy collection install -vv -r requirements.yml
---
- hosts: nuc.lan
  #connection: local
  become: yes

  roles:
    - fedora.linux_system_roles.storage
    - geerlingguy.nfs

  tasks:

    - name: Create mount points for media/backups
      file:
        path: "{{ item }}"
        state: directory
        mode: '0755'
        owner: root
        group: root
      loop:
        - /mnt/sg1
        - /mnt/sg2
        - /mnt/sg3
      tags:
        - nfs

    - name: Mount the filesystem for media/backups
      mount:
        path: /mnt/sg2
        src: LABEL=SEAGATE2
        fstype: ext4
        state: mounted
        backup: yes

    - name: Create mount point for vm_images filesystem
      file:
        path: /mnt/vm_images
        state: directory
        mode: '0755'
        owner: root
        group: root
      tags:
        - nfs

    - name: Mount vm_images filesystem from MicroServer
      mount:
        src: micro.lan:/mnt/vm_images
        path: /mnt/vm_images
        opts: x-systemd.after=network-online.target
        state: mounted
        fstype: nfs
      tags:
        - nfs

    - name: Open the appropriate firewall ports for NFS
      firewalld:
        zone: FedoraServer
        service: '{{ item }}'
        permanent: yes
        immediate: yes
        state: enabled
      loop:
        - nfs
        - nfs3
        - mountd
        - rpc-bind
      tags:
        - nfs

    - name: What's the user containers directory?
      debug:
        var: mount_point_user_containers

    - name: Configure storage directory for rootless containers
      block:
        - name: Set correct directory ownership/permissions for rootless container mount point
          file:
            path: "{{ mount_point_user_containers }}"
            state: directory
            owner: root
            group: root
            mode: '0777'

        # Fix the SELinux permissions for user container storage as per:
        # https://github.com/containers/podman/issues/12812
        # https://github.com/containers/podman/issues/3234
        # $ sudo semanage fcontext -a -e $HOME/.local/share/containers /mnt/containers
        # $ restorecon -R -v /mnt
        - name: Allow users to modify files in their local container storage directories
          community.general.sefcontext:
            #target: '/mnt/containers(/.*)?'
            #target: '/mnt/containers'
            target: "{{ mount_point_user_containers }}"
            # Trying to set seuser is redundant when using SELinux targeted policy
            seuser: unconfined_u
            setype: data_home_t
            state: present

        - name: Apply new SELinux file context to filesystem
          #ansible.builtin.command: restorecon -irv /mnt/containers
          ansible.builtin.command: restorecon -iv {{ mount_point_user_containers }}

        # Edit /etc/containers.conf to ensure rootless containers are stored in correct location
        # OLD: # rootless_storage_path = "$HOME/.local/share/containers/storage"
        # NEW: rootless_storage_path = "/mnt/containers/$USER/storage"
        - name: Ensure that rootless container storage is in the correct directory
          lineinfile:
            path: /usr/share/containers/storage.conf
            regexp: '^rootless_storage_path'
            insertafter: '^# rootless_storage_path'
            line: rootless_storage_path = "{{ mount_point_user_containers }}/$USER/storage"
            #owner: root
            #group: root
            #mode: '0644'
            backup: yes
      when: mount_point_user_containers is defined
      tags:
      - podman

    - name: Configure storage directory for OpenShift Local
      block:
        - name: Set correct directory ownership/permissions for CRC mount point
          file:
            path: "{{ mount_point_crc }}"
            state: directory
            owner: bblasco
            group: bblasco
            mode: '0755'

        - name: Set correct SELinux permissions for CRC mount point
          community.general.sefcontext:
            target: "{{ mount_point_crc }}"
            # Trying to set seuser is redundant when using SELinux targeted policy
            # unconfined_u:object_r:user_home_t:s0
            seuser: unconfined_u
            setype: user_home_t
            state: present
          tags:
          - selinux

        - name: Apply new SELinux file context to filesystem
          #ansible.builtin.command: restorecon -irv /mnt/containers
          ansible.builtin.command: restorecon -iv {{ mount_point_crc }}
          tags:
          - selinux
      tags:
      - crc