Migrate Prometheus stack to Podman

ansible/inventory/group_vars/platform_rocky.yml

@@ -18,11 +18,9 @@ rocky_syncthing_archive_url: >-
 
 rocky_manage_openzfs_repo: false
 rocky_manage_syncthing_binary: false
-rocky_manage_docker_repo: false
+rocky_manage_podman: false
 rocky_manage_github_cli_repo: false
 
-rocky_docker_repo_url: https://download.docker.com/linux/rhel/docker-ce.repo
-rocky_docker_repo_file: /etc/yum.repos.d/docker-ce.repo
 rocky_github_cli_repo_url: https://cli.github.com/packages/rpm/gh-cli.repo
 rocky_github_cli_repo_file: /etc/yum.repos.d/gh-cli.repo
 
@@ -47,8 +45,8 @@ rocky_packages_base:
   - firewalld
   - openssh-server
   - rsync
+  - selinux-policy-targeted
   - sudo
 
 rocky_profile_packages: []
-rocky_docker_packages: []
-rocky_docker_conflicting_packages: []
+rocky_podman_packages: []

ansible/inventory/group_vars/rocky_server.yml

@@ -1,5 +1,5 @@
 ---
-rocky_manage_docker_repo: true
+rocky_manage_podman: true
 rocky_manage_github_cli_repo: true
 
 rocky_profile_packages:
@@ -22,37 +22,22 @@ rocky_profile_packages:
   - ranger
   - ripgrep
 
-rocky_docker_packages:
-  - containerd.io
-  - docker-buildx-plugin
-  - docker-ce
-  - docker-ce-cli
-  - docker-compose-plugin
-
-rocky_docker_conflicting_packages:
-  - docker
-  - docker-client
-  - docker-client-latest
-  - docker-common
-  - docker-engine
-  - docker-latest
-  - docker-latest-logrotate
-  - docker-logrotate
-  - runc
+rocky_podman_packages:
+  - podman
+  - podman-compose
 
 enabled_services:
   - firewalld
-  - docker
+  - podman.socket
 
 server_firewall_backend: firewalld
 server_firewalld_zone: public
 server_firewalld_services:
   - ssh
+  - cockpit
+  - http
+  - https
 server_firewalld_ports: []
-server_firewalld_absent_ports:
-  - 22000/tcp
-  - 22000/udp
-  - 21027/udp
 server_sshd_service_name: sshd
 server_compose_selinux_mount_option: Z
 server_syncthing_enabled: false

ansible/inventory/group_vars/server.yml

@@ -86,14 +86,6 @@ server_directories:
     owner: root
     group: root
     mode: "0755"
-  - path: /srv/nextcloud
-    owner: root
-    group: root
-    mode: "0755"
-  - path: /srv/nextcloud/data
-    owner: root
-    group: root
-    mode: "0755"
 
 server_syncthing_enabled: true
 server_syncthing_directories:

ansible/roles/packages_rocky/tasks/main.yml

@@ -50,16 +50,6 @@
     state: enabled
   when: rocky_manage_openzfs_repo | bool
 
-- name: Configure official Docker RPM repository
-  tags: [packages, docker]
-  ansible.builtin.get_url:
-    url: "{{ rocky_docker_repo_url }}"
-    dest: "{{ rocky_docker_repo_file }}"
-    owner: root
-    group: root
-    mode: "0644"
-  when: rocky_manage_docker_repo | bool
-
 - name: Configure official GitHub CLI RPM repository
   tags: [packages]
   ansible.builtin.get_url:
@@ -70,15 +60,6 @@
     mode: "0644"
   when: rocky_manage_github_cli_repo | bool
 
-- name: Remove packages conflicting with Docker CE
-  tags: [packages, docker]
-  ansible.builtin.dnf:
-    name: "{{ rocky_docker_conflicting_packages }}"
-    state: absent
-  when:
-    - rocky_manage_docker_repo | bool
-    - rocky_docker_conflicting_packages | length > 0
-
 - name: Refresh Rocky package metadata
   tags: [packages]
   ansible.builtin.dnf:
@@ -93,19 +74,21 @@
           (rocky_common_packages | default([]))
           + (rocky_packages_base | default([]))
           + (rocky_profile_packages | default([]))
-          + (rocky_docker_packages | default([]))
+          + (rocky_podman_packages | default([]))
           + (host_packages | default([]))
         ) | unique
       }}
     state: present
 
-- name: Add Rocky user to docker group
-  tags: [packages, docker]
-  ansible.builtin.user:
-    name: "{{ effective_username }}"
-    groups: docker
-    append: true
-  when: rocky_docker_packages | length > 0
+- name: Ensure Podman runtime socket directory exists
+  tags: [packages, podman]
+  ansible.builtin.file:
+    path: /run/podman
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  when: rocky_manage_podman | bool
 
 - name: Require supported architecture for Syncthing
   tags: [packages, syncthing]

ansible/roles/profile_server/handlers/main.yml

@@ -4,3 +4,8 @@
   ansible.builtin.service:
     name: "{{ server_sshd_service_name }}"
     state: reloaded
+
+- name: Reload systemd for Podman Compose
+  tags: [services]
+  ansible.builtin.systemd:
+    daemon_reload: true

ansible/roles/profile_server/tasks/main.yml

@@ -67,6 +67,10 @@
     label: "{{ item.dest }}"
   no_log: "{{ item.no_log | default(false) }}"
 
+- name: Manage Podman Compose stack
+  tags: [services, podman]
+  ansible.builtin.include_tasks: podman-compose.yml
+
 - name: Disable SSH root login on server
   tags: [services]
   ansible.builtin.lineinfile:
@@ -113,16 +117,3 @@
   loop_control:
     label: "{{ item }}"
   when: server_firewall_backend == 'firewalld'
-
-- name: Remove disabled server ports from firewalld
-  tags: [services, packages]
-  ansible.posix.firewalld:
-    port: "{{ item }}"
-    zone: "{{ server_firewalld_zone }}"
-    state: disabled
-    permanent: true
-    immediate: true
-  loop: "{{ server_firewalld_absent_ports | default([]) }}"
-  loop_control:
-    label: "{{ item }}"
-  when: server_firewall_backend == 'firewalld'

ansible/roles/profile_server/tasks/podman-compose.yml

@@ -0,0 +1,10 @@
+---
+- name: Render Podman Compose systemd unit
+  tags: [services, podman]
+  ansible.builtin.template:
+    src: podman-compose-server.service.j2
+    dest: /etc/systemd/system/podman-compose-server.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload systemd for Podman Compose

ansible/roles/profile_server/templates/podman-compose-server.service.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=Podman Compose stack for {{ server_username }}
+Requires=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory={{ server_container_stack_dir }}
+ExecStart=/usr/bin/podman-compose up -d
+ExecStop=/usr/bin/podman-compose down
+ExecReload=/usr/bin/podman-compose up -d
+
+[Install]
+WantedBy=multi-user.target

ansible/templates/server/docker-compose.yml.j2

@@ -1,10 +1,10 @@
 ---
 {% set selinux_volume_option = server_compose_selinux_mount_option | default('') %}
-version: "3.8"
+name: server
 
 services:
   navidrome:
-    image: deluan/navidrome:latest
+    image: docker.io/deluan/navidrome:latest
     container_name: navidrome
     restart: unless-stopped
     expose:
@@ -23,19 +23,18 @@ services:
     depends_on:
       - navidromedb
   nginx-proxy-manager:
-    image: jc21/nginx-proxy-manager:latest
+    image: docker.io/jc21/nginx-proxy-manager:latest
     container_name: nginx-proxy-manager
     restart: unless-stopped
     ports:
       - "80:80"
       - "443:443"
-      - "81:81"
+      - "127.0.0.1:81:81"
     volumes:
       - "/opt/npm/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
       - "/opt/npm/letsencrypt:/etc/letsencrypt{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
     networks:
       - web
-      - gitea
 
   # Disabled: prometheus does not have enough resources to run Nextcloud AIO.
   # nextcloud-aio-mastercontainer:
@@ -57,7 +56,7 @@ services:
   #     - web
 
   navidromedb:
-    image: postgres:13
+    image: docker.io/library/postgres:13
     container_name: navidromedb
     restart: unless-stopped
     mem_limit: 2048m
@@ -78,7 +77,7 @@ services:
       - USER_GID=1100
     restart: always
     networks:
-      - gitea
+      - web
     volumes:
       - /opt/gitea/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}
       - /etc/timezone:/etc/timezone:ro
@@ -90,7 +89,7 @@ services:
 
 {% if server_syncthing_enabled | default(true) | bool %}
   syncthing:
-    image: syncthing/syncthing:2
+    image: docker.io/syncthing/syncthing:2
     container_name: syncthing
     hostname: syncthing
     restart: unless-stopped
@@ -111,8 +110,6 @@ networks:
   web:
     name: server_web
     external: false
-  gitea:
-    external: false
 
 # volumes:
 #   nextcloud_aio_mastercontainer: