ansible/roles/docker/tasks/main.yml

- name: Install required system packages
  apt:
    pkg:
      - apt-transport-https
      - ca-certificates
      - curl
      - python3-pip
      - virtualenv
      - python3-setuptools
      - duf
    state: latest
    update_cache: true

- name: setup shell
  import_tasks: shell.yml

# Docker's repo, signed by its own key file. The release name comes from the
# installed Debian, so this keeps working across upgrades. (Debian 13 has no
# apt-key, so the key can't go in the shared trusted.gpg any more.)
- name: Download Docker's apt key
  ansible.builtin.get_url:
    url: https://download.docker.com/linux/debian/gpg
    dest: /etc/apt/keyrings/docker.asc
    owner: root
    mode: '0644'
  tags: docker_apt

- name: Add Docker's apt repository
  ansible.builtin.deb822_repository:
    name: docker
    types: deb
    uris: https://download.docker.com/linux/debian
    suites: "{{ ansible_distribution_release }}"
    components: stable
    signed_by: /etc/apt/keyrings/docker.asc
  tags: docker_apt

# Written by the old apt_repository task; docker.sources replaces it.
- name: Remove the old Docker repo list
  ansible.builtin.file:
    path: /etc/apt/sources.list.d/download_docker_com_linux_debian.list
    state: absent
  tags: docker_apt

- name: Update apt and install docker-ce
  apt:
    name: docker-ce
    state: latest
    update_cache: true
  tags: docker_apt

- name: copy over ufw-docker.sh
  ansible.builtin.copy:
    src: ufw-docker.sh
    dest: /usr/local/bin/ufw-docker.sh
    owner: root
    mode: '0755'

- name: check ufw-docker rules
  ansible.builtin.command: /usr/local/bin/ufw-docker.sh check
  register: ufw_docker_check
  changed_when: false
  failed_when: false
  check_mode: false

- name: install ufw-docker rules
  ansible.builtin.command: /usr/local/bin/ufw-docker.sh install
  when: ufw_docker_check.rc != 0

# ufw-docker install asks for a ufw restart to load the new rules
- name: restart ufw after ufw-docker install
  ansible.builtin.systemd:
    name: ufw
    state: restarted
  when: ufw_docker_check.rc != 0

- name: Look up the shared docker network
  community.docker.docker_network_info:
    name: "{{ docker.network_name }}"
  register: lava_net
  tags: always

# True once the network has the reserved range. Fixed IPs other than Caddy's
# are only applied then, since today's dynamic containers may hold them.
- name: Record whether the shared network has the reserved range
  ansible.builtin.set_fact:
    lava_reserved: >-
      {{ lava_net.exists and
         (lava_net.network.IPAM.Config | map(attribute='IPRange', default='') | first) == docker.ip_range }}
  tags: always

- name: Create the shared docker network
  community.docker.docker_network:
    name: "{{ docker.network_name }}"
    driver: bridge
    ipam_config:
      - subnet: "{{ docker.subnet }}"
        gateway: "{{ docker.gateway }}"
        iprange: "{{ docker.ip_range }}"
  when: not lava_net.exists
  register: lava_created

- name: Mark a freshly created network as reserved
  ansible.builtin.set_fact:
    lava_reserved: true
  when: lava_created is changed

# Docker can't change a network's address range in place; recreating it
# needs every container detached first. See migrate-lava-network.yml.
- name: Warn if the shared network has the old address layout
  ansible.builtin.debug:
    msg: >-
      {{ docker.network_name }} has no reserved range (wanted {{ docker.ip_range }}),
      so other containers can take Caddy's fixed IP. Run migrate-lava-network.yml.
  when: lava_net.exists and not (lava_reserved | bool)

- name: make directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
  loop:
    - /opt/stacks
    - /opt/dockge

- name: template dockge compose file
  ansible.builtin.template:
    src: dockge-compose.yml.j2
    dest: /opt/dockge/dockge.yml
    owner: root
    mode: '0644'

# Deploy services by category for better organization and dependency management
- name: Deploy infrastructure services
  import_tasks: infrastructure/main.yml
  tags: [infrastructure, services]

- name: Deploy development services
  import_tasks: development/main.yml
  tags: [development, services]

- name: Deploy media services
  import_tasks: media/main.yml
  tags: [media, services]

- name: Deploy productivity services
  import_tasks: productivity/main.yml
  tags: [productivity, services]

- name: Deploy monitoring services
  import_tasks: monitoring/main.yml
  tags: [monitoring, services]

- name: Deploy communication services
  import_tasks: communication/main.yml
  tags: [communication, services]