init commit

playbooks/install-standard-docker.yml

@@ -0,0 +1,146 @@
+---
+- name: Install Docker using official Docker documentation steps and set up /opt/docker and /srv/docker
+  hosts: docker
+  become: true
+  gather_facts: true
+
+  vars:
+    docker_keyring_path: /etc/apt/keyrings/docker.asc
+    docker_repo_list_path: /etc/apt/sources.list.d/docker.list
+    docker_acl_path: /opt/docker
+    srv_docker_path: /srv/docker
+    docker_data_user: dockeruser
+    docker_data_group: dockerdata
+    docker_data_uid: 2011
+    docker_data_gid: 2011
+
+  tasks:
+    # --- Prereqs ---
+    - name: Ensure required packages are installed
+      apt:
+        name:
+          - ca-certificates
+          - curl
+          - acl # Required for setfacl
+        state: present
+        update_cache: yes
+
+    - name: Ensure keyring directory exists
+      file:
+        path: /etc/apt/keyrings
+        state: directory
+        mode: "0755"
+
+    - name: Download Docker's official GPG key
+      get_url:
+        url: https://download.docker.com/linux/ubuntu/gpg
+        dest: "{{ docker_keyring_path }}"
+        mode: "0644"
+      register: docker_key_download
+
+    - name: Get native architecture (dpkg --print-architecture)
+      command: dpkg --print-architecture
+      register: dpkg_arch_result
+      changed_when: false
+
+    - name: Add Docker repository to Apt sources
+      copy:
+        dest: "{{ docker_repo_list_path }}"
+        content: |
+          deb [arch={{ dpkg_arch_result.stdout }} signed-by={{ docker_keyring_path }}] https://download.docker.com/linux/ubuntu {{ ansible_lsb.codename }} stable
+      notify: Update apt cache
+
+    - name: Flush handlers to update apt cache before install
+      meta: flush_handlers
+
+    # --- Docker Install ---
+    - name: Install Docker packages
+      apt:
+        name:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+          - docker-buildx-plugin
+          - docker-compose-plugin
+        state: present
+        update_cache: no
+
+    - name: Ensure docker group exists
+      group:
+        name: docker
+        state: present
+
+    - name: Ensure Docker service is enabled and running
+      systemd:
+        name: docker
+        enabled: true
+        state: started
+
+    # --- ACL & Folder Standardization ---
+    - name: Ensure Docker base folder exists with correct ownership
+      file:
+        path: "{{ docker_acl_path }}"
+        state: directory
+        owner: root
+        group: docker
+        mode: "0775"
+
+    - name: Set setgid bit on /opt/docker so group is inherited
+      file:
+        path: "{{ docker_acl_path }}"
+        mode: "2775"
+
+    - name: Check for existing default ACL on Docker folder
+      command: getfacl --access --default {{ docker_acl_path }}
+      register: facl_check
+      changed_when: false
+      failed_when: false
+
+    - name: Set default ACL for docker group if not already present
+      command: setfacl -d -m g:docker:rwx {{ docker_acl_path }}
+      when: "'group:docker:rwx' not in facl_check.stdout"
+
+    # --- New: Dedicated Docker Data User/Group and /srv/docker Setup ---
+    - name: Create docker data group with fixed GID
+      group:
+        name: "{{ docker_data_group }}"
+        gid: "{{ docker_data_gid }}"
+        state: present
+        system: yes
+
+    - name: Create docker data user with fixed UID and GID
+      user:
+        name: "{{ docker_data_user }}"
+        uid: "{{ docker_data_uid }}"
+        group: "{{ docker_data_group }}"
+        shell: /usr/sbin/nologin
+        create_home: no
+        system: yes
+        state: present
+
+    - name: Ensure /srv/docker exists with correct ownership
+      file:
+        path: "{{ srv_docker_path }}"
+        state: directory
+        owner: "{{ docker_data_user }}"
+        group: "{{ docker_data_group }}"
+        mode: "0770"
+
+    - name: Set setgid bit on /srv/docker so group is inherited
+      file:
+        path: "{{ srv_docker_path }}"
+        mode: "2770"
+
+    - name: Set default ACL for dockerdata group on /srv/docker
+      ansible.posix.acl:
+        path: "{{ srv_docker_path }}"
+        entity: "{{ docker_data_group }}"
+        etype: group
+        permissions: rwx
+        default: yes
+        state: present
+
+  handlers:
+    - name: Update apt cache
+      apt:
+        update_cache: yes