Migrate Prometheus stack to Podman

ansible/roles/packages_rocky/tasks/main.yml

@@ -50,16 +50,6 @@
     state: enabled
   when: rocky_manage_openzfs_repo | bool
 
-- name: Configure official Docker RPM repository
-  tags: [packages, docker]
-  ansible.builtin.get_url:
-    url: "{{ rocky_docker_repo_url }}"
-    dest: "{{ rocky_docker_repo_file }}"
-    owner: root
-    group: root
-    mode: "0644"
-  when: rocky_manage_docker_repo | bool
-
 - name: Configure official GitHub CLI RPM repository
   tags: [packages]
   ansible.builtin.get_url:
@@ -70,15 +60,6 @@
     mode: "0644"
   when: rocky_manage_github_cli_repo | bool
 
-- name: Remove packages conflicting with Docker CE
-  tags: [packages, docker]
-  ansible.builtin.dnf:
-    name: "{{ rocky_docker_conflicting_packages }}"
-    state: absent
-  when:
-    - rocky_manage_docker_repo | bool
-    - rocky_docker_conflicting_packages | length > 0
-
 - name: Refresh Rocky package metadata
   tags: [packages]
   ansible.builtin.dnf:
@@ -93,19 +74,21 @@
           (rocky_common_packages | default([]))
           + (rocky_packages_base | default([]))
           + (rocky_profile_packages | default([]))
-          + (rocky_docker_packages | default([]))
+          + (rocky_podman_packages | default([]))
           + (host_packages | default([]))
         ) | unique
       }}
     state: present
 
-- name: Add Rocky user to docker group
-  tags: [packages, docker]
-  ansible.builtin.user:
-    name: "{{ effective_username }}"
-    groups: docker
-    append: true
-  when: rocky_docker_packages | length > 0
+- name: Ensure Podman runtime socket directory exists
+  tags: [packages, podman]
+  ansible.builtin.file:
+    path: /run/podman
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  when: rocky_manage_podman | bool
 
 - name: Require supported architecture for Syncthing
   tags: [packages, syncthing]

ansible/roles/profile_server/handlers/main.yml

@@ -4,3 +4,8 @@
   ansible.builtin.service:
     name: "{{ server_sshd_service_name }}"
     state: reloaded
+
+- name: Reload systemd for Podman Compose
+  tags: [services]
+  ansible.builtin.systemd:
+    daemon_reload: true

ansible/roles/profile_server/tasks/main.yml

@@ -67,6 +67,10 @@
     label: "{{ item.dest }}"
   no_log: "{{ item.no_log | default(false) }}"
 
+- name: Manage Podman Compose stack
+  tags: [services, podman]
+  ansible.builtin.include_tasks: podman-compose.yml
+
 - name: Disable SSH root login on server
   tags: [services]
   ansible.builtin.lineinfile:
@@ -113,16 +117,3 @@
   loop_control:
     label: "{{ item }}"
   when: server_firewall_backend == 'firewalld'
-
-- name: Remove disabled server ports from firewalld
-  tags: [services, packages]
-  ansible.posix.firewalld:
-    port: "{{ item }}"
-    zone: "{{ server_firewalld_zone }}"
-    state: disabled
-    permanent: true
-    immediate: true
-  loop: "{{ server_firewalld_absent_ports | default([]) }}"
-  loop_control:
-    label: "{{ item }}"
-  when: server_firewall_backend == 'firewalld'

ansible/roles/profile_server/tasks/podman-compose.yml

@@ -0,0 +1,10 @@
+---
+- name: Render Podman Compose systemd unit
+  tags: [services, podman]
+  ansible.builtin.template:
+    src: podman-compose-server.service.j2
+    dest: /etc/systemd/system/podman-compose-server.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload systemd for Podman Compose

ansible/roles/profile_server/templates/podman-compose-server.service.j2

@@ -0,0 +1,15 @@
+[Unit]
+Description=Podman Compose stack for {{ server_username }}
+Requires=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+WorkingDirectory={{ server_container_stack_dir }}
+ExecStart=/usr/bin/podman-compose up -d
+ExecStop=/usr/bin/podman-compose down
+ExecReload=/usr/bin/podman-compose up -d
+
+[Install]
+WantedBy=multi-user.target