infra/ansible/playbooks/pve-gitea.yml

- name: Create Gitea LXC on cloud-pc
  hosts: cloud-pc
  gather_facts: false
  vars:
    gitea_vmid: 141
    gitea_hostname: gitea
    gitea_ip: 192.168.1.25/24
    gitea_gateway: 192.168.1.1
    gitea_bridge: vmbr0
    gitea_rootfs: data:32
    gitea_host_data_dir: /opt/data/gitea
    gitea_host_data_uid: 101000
    gitea_host_data_gid: 101000
    gitea_container_data_dir: /opt/gitea/data
    gitea_ostemplate: local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst
    gitea_pubkey_file: ~/.ssh/id_ed25519_homelab.pub
  handlers:
    - name: restart gitea lxc
      ansible.builtin.shell: "pct stop {{ gitea_vmid }} || true; pct start {{ gitea_vmid }}"
      changed_when: true
  tasks:
    - name: Check if Gitea LXC exists
      ansible.builtin.command: "pct config {{ gitea_vmid }}"
      register: gitea_pct_config
      changed_when: false
      failed_when: false

    - name: Install Gitea LXC SSH public key on PVE host
      ansible.builtin.copy:
        dest: /tmp/gitea-lxc.pub
        owner: root
        group: root
        mode: "0600"
        content: "{{ lookup('file', gitea_pubkey_file) }}\n"
      when: gitea_pct_config.rc != 0

    - name: Create Gitea LXC
      ansible.builtin.command: >-
        pct create {{ gitea_vmid }} {{ gitea_ostemplate }}
        --hostname {{ gitea_hostname }}
        --rootfs {{ gitea_rootfs }}
        --cores 2
        --memory 2048
        --swap 1024
        --net0 name=eth0,bridge={{ gitea_bridge }},gw={{ gitea_gateway }},ip={{ gitea_ip }},firewall=1
        --nameserver 1.1.1.1
        --unprivileged 1
        --features nesting=1,keyctl=1
        --onboot 1
        --startup order=50
        --cmode shell
        --ssh-public-keys /tmp/gitea-lxc.pub
      when: gitea_pct_config.rc != 0

    - name: Start Gitea LXC
      ansible.builtin.command: "pct start {{ gitea_vmid }}"
      register: gitea_pct_start
      changed_when: gitea_pct_start.rc == 0
      failed_when: gitea_pct_start.rc not in [0, 255]

    - name: Allow FUSE device in Gitea LXC config
      ansible.builtin.lineinfile:
        path: "/etc/pve/lxc/{{ gitea_vmid }}.conf"
        line: "lxc.cgroup2.devices.allow: c 10:229 rwm"
        state: present
      notify: restart gitea lxc

    - name: Bind mount FUSE device in Gitea LXC config
      ansible.builtin.lineinfile:
        path: "/etc/pve/lxc/{{ gitea_vmid }}.conf"
        line: "lxc.mount.entry: /dev/fuse dev/fuse none bind,create=file"
        state: present
      notify: restart gitea lxc

    - name: Bind mount Gitea data directory in LXC config
      ansible.builtin.lineinfile:
        path: "/etc/pve/lxc/{{ gitea_vmid }}.conf"
        line: "mp0: {{ gitea_host_data_dir }},mp={{ gitea_container_data_dir }}"
        state: present
      notify: restart gitea lxc

    - name: Ensure Gitea host data directory ownership matches unprivileged LXC uid map
      ansible.builtin.file:
        path: "{{ gitea_host_data_dir }}"
        state: directory
        owner: "{{ gitea_host_data_uid }}"
        group: "{{ gitea_host_data_gid }}"
        recurse: true

    - name: Apply pending LXC config changes
      ansible.builtin.meta: flush_handlers

    - name: Wait for Gitea SSH through ru-vps
      ansible.builtin.wait_for_connection:
        timeout: 120
      delegate_to: gitea
      vars:
        ansible_become: false

- name: Configure Docker and Gitea inside LXC
  hosts: gitea
  gather_facts: true
  vars:
    ansible_become: false
    gitea_data_dir: /opt/gitea/data
    gitea_image: gitea/gitea:latest
    gitea_container_name: gitea
    gitea_http_port: 3000
    gitea_ssh_port: 2222
  tasks:
    - name: Install Docker packages
      ansible.builtin.apt:
        name:
          - docker.io
          - fuse-overlayfs
          - sqlite3
          - rsync
          - ca-certificates
          - curl
        state: present
        update_cache: true

    - name: Ensure Docker config directory exists
      ansible.builtin.file:
        path: /etc/docker
        state: directory
        owner: root
        group: root
        mode: "0755"

    - name: Configure Docker storage driver for unprivileged LXC
      ansible.builtin.copy:
        dest: /etc/docker/daemon.json
        owner: root
        group: root
        mode: "0644"
        content: |
          {
            "storage-driver": "fuse-overlayfs"
          }
      register: docker_daemon_config

    - name: Ensure Docker service is enabled and running
      ansible.builtin.systemd:
        name: docker
        state: "{{ 'restarted' if docker_daemon_config.changed else 'started' }}"
        enabled: true

    - name: Ensure Gitea data directory has container ownership
      ansible.builtin.file:
        path: "{{ gitea_data_dir }}"
        state: directory
        owner: "1000"
        group: "1000"
        mode: "0750"

    - name: Install Gitea systemd unit
      ansible.builtin.copy:
        dest: /etc/systemd/system/gitea.service
        owner: root
        group: root
        mode: "0644"
        content: |
          [Unit]
          Description=Gitea container
          After=docker.service
          Requires=docker.service

          [Service]
          Restart=always
          RestartSec=10
          ExecStartPre=-/usr/bin/docker rm -f {{ gitea_container_name }}
          ExecStart=/usr/bin/docker run --rm \
            --name {{ gitea_container_name }} \
            --pull always \
            -p {{ gitea_http_port }}:3000 \
            -p {{ gitea_ssh_port }}:22 \
            -v {{ gitea_data_dir }}:/data \
            -e USER_UID=1000 \
            -e USER_GID=1000 \
            {{ gitea_image }}
          ExecStop=/usr/bin/docker stop {{ gitea_container_name }}

          [Install]
          WantedBy=multi-user.target
      register: gitea_unit

    - name: Reload systemd when Gitea unit changes
      ansible.builtin.systemd:
        daemon_reload: true
      when: gitea_unit.changed

    - name: Enable and start Gitea
      ansible.builtin.systemd:
        name: gitea
        state: started
        enabled: true