build

2025-12-14 10:04:52 +01:00 · 2025-11-22 23:47:35 +01:00
parent 22080b7d4c
commit f8b42a2674
7 changed files with 130 additions and 139 deletions
--- a/roles/docker/tasks/main.yml
+++ b/roles/docker/tasks/main.yml
@@ -44,21 +44,21 @@


    - name: Ensure docker keyring directory exists
-      file:
+      ansible.builtin.file:
        path: /etc/apt/keyrings
        state: directory
        mode: "0755"

    - name: Download Docker GPG key
-      get_url:
+      ansible.builtin.get_url:
        url: https://download.docker.com/linux/debian/gpg
        dest: /etc/apt/keyrings/docker.asc
        mode: "0644"
      when:
        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"
-        
+
    - name: Install docker.sources file
-      template:
+      ansible.builtin.template:
        src: docker.sources.j2
        dest: /etc/apt/sources.list.d/docker.sources
        owner: root
@@ -68,7 +68,7 @@
        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"

    - name: Create docker.sources file
-      copy:
+      ansible.builtin.copy:
        dest: /etc/apt/sources.list.d/docker.sources
        mode: "0644"
        content: |
@@ -78,31 +78,24 @@
          Components: stable
          Signed-By: /etc/apt/keyrings/docker.asc
      when:
-          - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"        
+          - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"


    - name: Update apt cache
-      apt:
-        update_cache: yes
+      ansible.builtin.apt:
+        update_cache: true

      when:
        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"

    - name: Download Docker GPG key
-      get_url:
+      ansible.builtin.get_url:
        url: https://download.docker.com/linux/debian/gpg
        dest: /etc/apt/keyrings/docker.asc
        mode: "0644"
      when:
        - ansible_distribution == "Debian"  and ansible_distribution_major_version  == "13"

-
-
-
-
-
-
-
    - name: Add an Apt signing key to a specific keyring file
      ansible.builtin.apt_key:
        url: https://download.docker.com/linux/ubuntu/gpg
@@ -135,75 +128,36 @@
      ansible.builtin.shell: echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
      when:
        - ansible_distribution == "Ubuntu"
+    - name: Pin docker version
+      ansible.builtin.copy:
+        dest: /etc/apt/preferences.d/docker.pref
+        mode: "0644"
+        content: |
+          Package: docker-ce
+          Pin: version 5:28.5.2-1~debian.13~trixie
+          Pin-Priority: 1001
+
+          Package: docker-ce-cli
+          Pin: version 5:28.5.2-1~debian.13~trixie
+          Pin-Priority: 1001
+      when:
+        - ansible_distribution == "Debian"
+        - ansible_distribution_major_version == "13"

-    # - name: Install docker
-    #   ansible.builtin.apt:
-    #     name:
-    #       - docker-ce
-    #       - docker-ce-cli
-    #       - containerd.io
-    #       - docker-buildx-plugin
-    #       - docker-compose-plugin
-    #     update_cache: true
    - name: Install the version docker1
      ansible.builtin.apt:
-        name: "{{ item }}=5:28.5.2-1~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
+        name: "{{ docker_package }}"
        state: present
      when:
        - ansible_distribution == "Debian"
+      loop_control:
+        loop_var: docker_package
      loop:
        - docker-ce
        - docker-ce-cli
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
        - containerd.io
-
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
-        - docker-buildx-plugin
-        
-
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}=5:28.5.2-1~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian1"
-      loop:
-        - docker-ce
-        - docker-ce-cli
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}=1.7.28-2~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
-        - containerd.io
-
-    - name: Install the version docker
-      ansible.builtin.apt:
-        name: "{{ item }}=0.28.0-0~{{ ansible_distribution | lower }}.{{ ansible_distribution_major_version }}~{{ ansible_distribution_release }}"
-        state: present
-        allow_downgrade: true
-      when:
-        - ansible_distribution == "Debian"
-      loop:
        - docker-buildx-plugin
+        - docker-compose-plugin

    - name: Create a directory docker.service.d
      ansible.builtin.file:
@@ -211,55 +165,35 @@
        state: directory
        mode: '0755'

-
-    # - name: Copy files
-    #   ansible.builtin.copy:
-    #     src: server-key.pem
-    #     dest: /etc/docker/certs/
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
-    # - name: Copy files
-    #   ansible.builtin.copy:
-    #     src: ca.pem
-    #     dest: /etc/docker/certs/
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
-    # - name: Copy files
-    #   ansible.builtin.copy:
-    #     src: server-cert.pem
-    #     dest: /etc/docker/certs/
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
    - name: Creating a file with content
      ansible.builtin.copy:
        dest: "/etc/systemd/system/docker.service.d/override.conf"
        content: |
          [Service]
          ExecStart=
-          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
+          ExecStart=/usr/bin/dockerd -H fd:// \
+          --containerd=/run/containerd/containerd.sock \
+          --tlsverify --tlscacert=/etc/docker/certs/ca.pem \
+          --tlscert=/etc/docker/certs/server-cert.pem \
+          --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
        mode: '0600'
        owner: root
        group: root
      notify: restart_docker
      when: mode == "cert"

-    # - name: Creating a file with content
-    #   ansible.builtin.copy:
-    #     dest: "/etc/systemd/system/docker.service.d/override.conf"
-    #     content: |
-    #       [Service]
-    #       ExecStart=
-    #       ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify \
-    #       --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem \
-    #       --tlskey=/etc/docker/certs/server-key.pem -H=0.0.0.0:2376
-    #     mode: '0600'
-    #     owner: root
-    #     group: root
-    #   notify: restart_docker
-    #   when: mode != "nocert"
+    - name: Creating a file with content
+      ansible.builtin.copy:
+        dest: "/etc/systemd/system/docker.service.d/override.conf"
+        content: |
+          [Service]
+          ExecStart=
+          ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock  -H=0.0.0.0:2376
+        mode: '0600'
+        owner: root
+        group: root
+      notify: restart_docker
+      when: mode != "cert"

    - name: Just force systemd to reread configs
      ansible.builtin.systemd:
@@ -270,10 +204,12 @@
        name: docker
        state: restarted

-    # - name: Get keys for raspotify
-    #   ansible.builtin.shell: docker plugin install grafana/loki-docker-driver:3.3.2-{{ ansible_architecture }} --alias loki --grant-all-permissions
-    - name: Install a plugin
+    - name: Install Loki plugin with TLS
      community.docker.docker_plugin:
-        plugin_name: grafana/loki-docker-driver:3.3.2
+        plugin_name: grafana/loki-docker-driver
        alias: loki
        state: present
+      environment:
+        DOCKER_HOST: "tcp://{{ inventory_hostname }}:2376"
+        DOCKER_TLS_VERIFY: "1"
+        DOCKER_CERT_PATH: "/tmp/certgen"