infra/ansible/playbooks/pve-docker-test.yml

---
- name: Create Docker test LXC on cloud-pc
  hosts: cloud-pc
  gather_facts: false
  vars:
    # После переезда на OpenTofu (tofu/svc-docker-test.tf, VMID 152) этот play —
    # legacy: он таргетит СТАРЫЙ VMID 145 и его handler/"Start" сделали бы
    # pct start 145, подняв остановленный откат на боевом адресе 192.168.1.29.
    # Пропускаем, пока реестр говорит provisioner: tofu. Для намеренного
    # legacy rollback: -e pve_docker_test_legacy_provisioning_enabled=true
    pve_docker_test_legacy_provisioning_enabled: >-
      {{ homelab_services['docker-test'].provisioner != 'tofu' }}
    docker_test_vmid: 145
    docker_test_hostname: docker-test
    docker_test_ip: 192.168.1.29/24
    docker_test_gateway: 192.168.1.1
    docker_test_rootfs: data:8
    docker_test_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
    docker_test_pubkey_file: ~/.ssh/id_ed25519_homelab.pub
  handlers:
    - name: restart docker test lxc
      ansible.builtin.shell: "pct stop {{ docker_test_vmid }} || true; pct start {{ docker_test_vmid }}"
      changed_when: true
  pre_tasks:
    - name: Skip legacy docker-test provisioning after cutover
      ansible.builtin.meta: end_play
      when: not (pve_docker_test_legacy_provisioning_enabled | bool)
  tasks:
    - name: Check if Docker test LXC exists
      ansible.builtin.command: "pct config {{ docker_test_vmid }}"
      register: docker_test_pct_config
      changed_when: false
      failed_when: false

    - name: Install Docker test LXC SSH public key on PVE host
      ansible.builtin.copy:
        dest: /tmp/docker-test-lxc.pub
        owner: root
        group: root
        mode: "0600"
        content: "{{ lookup('file', docker_test_pubkey_file) }}\n"
      when: docker_test_pct_config.rc != 0

    - name: Create Docker test LXC
      ansible.builtin.command: >-
        pct create {{ docker_test_vmid }} {{ docker_test_ostemplate }}
        --hostname {{ docker_test_hostname }}
        --rootfs {{ docker_test_rootfs }}
        --cores 1
        --memory 512
        --swap 512
        --net0 name=eth0,bridge=vmbr0,gw={{ docker_test_gateway }},ip={{ docker_test_ip }},firewall=1
        --nameserver 1.1.1.1
        --unprivileged 1
        --features nesting=1,keyctl=1
        --onboot 1
        --startup order=50
        --cmode shell
        --ssh-public-keys /tmp/docker-test-lxc.pub
      when: docker_test_pct_config.rc != 0

    - name: Start Docker test LXC
      ansible.builtin.command: "pct start {{ docker_test_vmid }}"
      register: docker_test_pct_start
      changed_when: docker_test_pct_start.rc == 0
      failed_when: docker_test_pct_start.rc not in [0, 255]

    - name: Allow FUSE device in Docker test LXC config
      ansible.builtin.lineinfile:
        path: "/etc/pve/lxc/{{ docker_test_vmid }}.conf"
        line: "lxc.cgroup2.devices.allow: c 10:229 rwm"
        state: present
      notify: restart docker test lxc

    - name: Bind mount FUSE device in Docker test LXC config
      ansible.builtin.lineinfile:
        path: "/etc/pve/lxc/{{ docker_test_vmid }}.conf"
        line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file"
        state: present
      notify: restart docker test lxc

    - name: Apply pending LXC config changes
      ansible.builtin.meta: flush_handlers

    - name: Wait for Docker test SSH through ru-vps
      ansible.builtin.wait_for_connection:
        timeout: 120
      delegate_to: docker-test
      vars:
        ansible_become: false

- name: Configure Docker test host
  # Таргет переопределяем ради blue-green переезда на OpenTofu: во время
  # миграции этот play нужно прогнать против нового контейнера на временном
  # адресе. Просто `--limit docker-test-new` для этого НЕ годится — лимит
  # пересекается с паттерном play и даёт ноль хостов, а не перенацеливание
  # (проверено 2026-09-02 через --list-hosts на всех плейбуках).
  # Использовать вместе с --limit, чтобы play создания контейнера отсеялся:
  #   ansible-playbook playbooks/pve-docker-test.yml \
  #     -e pve_config_target=docker-test-new --limit docker-test-new
  # По умолчанию поведение не меняется.
  hosts: "{{ pve_config_target | default('docker-test') }}"
  gather_facts: true
  vars:
    ansible_become: false
  tasks:
    - name: Install Docker packages
      ansible.builtin.apt:
        name:
          - docker.io
          - fuse-overlayfs
          - ca-certificates
          - curl
        state: present
        update_cache: true

    - name: Ensure Docker config directory exists
      ansible.builtin.file:
        path: /etc/docker
        state: directory
        owner: root
        group: root
        mode: "0755"

    - name: Configure Docker storage driver for unprivileged LXC
      ansible.builtin.copy:
        dest: /etc/docker/daemon.json
        owner: root
        group: root
        mode: "0644"
        content: |
          {
            "storage-driver": "fuse-overlayfs"
          }
      register: docker_test_daemon_config

    - name: Enable Docker service
      ansible.builtin.systemd:
        name: docker
        state: "{{ 'restarted' if docker_test_daemon_config.changed else 'started' }}"
        enabled: true

    - name: Verify Docker can run a container
      ansible.builtin.command: docker run --rm hello-world
      changed_when: false