Refactor daemon configuration tasks

.github/workflows/install.yml

@@ -32,8 +32,8 @@ jobs:
       - name: run local install
         run: ./install.sh --local
 
-      - name: test docker binary
+      - name: test Docker binary
         run: docker --version
 
-      - name: test docker permissions
+      - name: test Docker permissions
         run: docker ps

.yamllint

@@ -14,4 +14,4 @@ rules:
   line-length: disable
   truthy: disable
   octal-values:
-    forbid-implicit-octal: false
+    forbid-implicit-octal: true

Makefile

@@ -13,11 +13,11 @@ all: install version lint test
 test: lint
 	poetry run molecule test -s ${MOLECULE_SCENARIO}
 
-poetry:
+install:
 	@type poetry >/dev/null || pip3 install poetry
 	@poetry install --no-root
 
-lint: poetry
+lint: install
 	poetry run yamllint .
 	poetry run ansible-lint .
 

defaults/main.yml

@@ -25,9 +25,10 @@ docker_group: docker
 docker_user_manage: true
 docker_group_manage: true
 docker_user: "{{ lookup('env', 'USER') }}"
-docker_log_conf_manage: no
-docker_log_conf_file: /etc/docker/daemon.json
-docker_log_conf:
+docker_conf_file: /etc/docker/daemon.json
+docker_conf_manage: false
+docker_conf_proxy: []
+docker_conf:
   log-driver: "json-file"
   log-opts:
     max-size: "10m"

handlers/main.yml

@@ -1,5 +1,5 @@
 ---
-- name: Restart docker service
+- name: Restart Docker service
   ansible.builtin.service:
     name: "{{ docker_service_name }}"
     state: restarted

install/playbook.yml

@@ -1,5 +1,5 @@
 ---
-- name: Perform local docker install
-  hosts: localhost
+- name: Perform local Docker install
+  hosts: docker
   roles:
     - nephelaiio.docker

molecule/install/converge.yml → molecule/common/converge.yml

@@ -1,6 +1,6 @@
 ---
 - name: Converge
-  hosts: all
+  hosts: docker
   roles:
     - nephelaiio.docker
   pre_tasks:

molecule/install/verify.yml → molecule/common/verify.yml

@@ -1,13 +1,13 @@
 ---
 - name: Verify
-  hosts: all
+  hosts: docker
   vars:
     docker_service: docker.service
   pre_tasks:
-    - name: Verify docker cli is installed
+    - name: Verify Docker cli is installed
       ansible.builtin.command: "docker --version"
 
-    - name: Verify docker pip is installed
+    - name: Verify Docker pip is installed
       ansible.builtin.command: "python3 -c 'import docker'"
 
     - name: Gather service facts

molecule/hold/converge.yml

@@ -1,6 +1,6 @@
 ---
-- name: Deploy docker packages
-  hosts: all
+- name: Deploy Docker packages
+  hosts: docker
   become: true
   roles:
     - nephelaiio.docker

molecule/hold/molecule.yml

@@ -4,7 +4,7 @@ dependency:
 driver:
   name: docker
 platforms:
-  - name: docker-hold
+  - name: docker-${MOLECULE_SCENARIO_NAME}
     image: geerlingguy/docker-${MOLECULE_DOCKER_IMAGE:-ubuntu2204}-ansible
     pre_build_image: true
     command: ${MOLECULE_DOCKER_COMMAND:-"/lib/systemd/systemd"}
@@ -15,6 +15,8 @@ platforms:
     tmpfs:
       - /tmp
       - /opt
+    groups:
+      - docker
 provisioner:
   name: ansible
   inventory:

molecule/hold/prepare.yml

@@ -1,6 +1,6 @@
 ---
-- name: Deploy docker packages
-  hosts: all
+- name: Deploy Docker packages
+  hosts: docker
   become: true
   roles:
     - nephelaiio.docker

molecule/hold/side_effect.yml

@@ -1,6 +1,6 @@
 ---
 - name: Update OS
-  hosts: all
+  hosts: docker
   become: true
   roles:
     - robertdebock.update

molecule/hold/verify.yml

@@ -1,6 +1,6 @@
 ---
-- name: Verify docker packages
-  hosts: all
+- name: Verify Docker packages
+  hosts: docker
   become: true
   tasks:
     - name: Query Debian package versions

molecule/install/molecule.yml

@@ -4,7 +4,7 @@ dependency:
 driver:
   name: docker
 platforms:
-  - name: docker-install
+  - name: docker-${MOLECULE_SCENARIO_NAME}
     image: geerlingguy/docker-${MOLECULE_DOCKER_IMAGE:-ubuntu2204}-ansible
     pre_build_image: true
     command: ${MOLECULE_DOCKER_COMMAND:-"/lib/systemd/systemd"}
@@ -15,7 +15,12 @@ platforms:
     tmpfs:
       - /tmp
       - /opt
+    groups:
+      - docker
 provisioner:
   name: ansible
+  playbooks:
+    converge: ../common/converge.yml
+    verify: ../common/verify.yml
 verifier:
   name: ansible

pyproject.toml

@@ -8,7 +8,7 @@ authors = ["Ted Cook <[email protected]>"]
 python = "^3.10"
 
 [tool.poetry.group.dev.dependencies]
-ansible-lint = { version = "^24.5.0", markers = "platform_system != 'Windows'" }
+ansible-lint = { version = "^24.6.0", markers = "platform_system != 'Windows'" }
 ansible = "^9.5.1"
 molecule = "^24.2.1"
 molecule-plugins = "^23.5.3"

tasks/config.yml

@@ -0,0 +1,10 @@
+---
+- name: Configure Docker daemon
+  ansible.builtin.copy:
+    dest: "{{ docker_log_conf_file }}"
+    content: "{{ docker_log_conf | to_nice_json(indent=2) }}"
+    group: root
+    owner: root
+    mode: 'u=rw,go=r'
+  notify: docker_restart  # noqa name[casing]
+  when: docker_proxy | bool

tasks/logging.yml

@@ -1,10 +1,10 @@
 ---
-- name: Configure logging
+- name: Configure Docker daemon
   ansible.builtin.copy:
     dest: "{{ docker_log_conf_file }}"
     content: "{{ docker_log_conf | to_nice_json(indent=2) }}"
     group: root
     owner: root
-    mode: 0644
+    mode: 'u=rw,go=r'
   notify: docker_restart  # noqa name[casing]
-  when: docker_log_conf_manage
+  when: docker_proxy | bool

tasks/main.yml

@@ -55,7 +55,7 @@
         state: directory
         group: root
         owner: root
-        mode: 0644
+        mode: 'u=rw,go=r'
       tags: install
 
     - name: Configure systemd service
@@ -69,13 +69,13 @@
             dest: "{{ docker_configuration_file }}"
             group: root
             owner: root
-            mode: 0644
+            mode: 'u=rw,go=r'
 
         - name: Include service tasks
           ansible.builtin.include_tasks: service.yml
 
-- name: Include logging tasks
-  ansible.builtin.include_tasks: logging.yml
+- name: Include configuration tasks
+  ansible.builtin.include_tasks: config.yml
 
 - name: Include user tasks
   ansible.builtin.include_tasks: users.yml

tasks/repo.yml

@@ -59,7 +59,7 @@
       ansible.builtin.get_url:
         url: "{{ docker_rpm_repo.url }}"
         dest: /etc/yum.repos.d/docker.repo
-        mode: 0644
+        mode: 'u=rw,go=r'
       when: docker_repo_state != 'absent'
 
     - name: Remove yum repository

tasks/users.yml

@@ -1,10 +1,10 @@
 ---
-- name: Manage docker groups
+- name: Manage Docker groups
   ansible.builtin.group:
     name: "{{ docker_group }}"
   when: docker_group_manage
 
-- name: Manage docker users
+- name: Manage Docker users
   ansible.builtin.user:
     append: true
     groups: "{{ docker_group }}"