feat: add docker role

Author: bruzina

README.md

@@ -11,6 +11,7 @@ This Ansible collection provides a set of roles designed for configuring Kubuntu
 | [xebis.ansible.apt](roles/apt/README.md)                             | Deb package updates and upgrades using the apt package manager. Can optionally clean up unused packages and reboot the system if required. | `xebis.ansible.system`                                 |
 | [`xebis.ansible.coding_projects`](roles/coding_projects/README.md)   | Creates and clones coding projects to `~/Projects`                                                                                         | `xebis.ansible.apt`                                    |
 | `xebis.ansible.direnv`                                               | direnv and Bash config for direnv                                                                                                          | `xebis.ansible.apt`                                    |
+| `xebis.ansible.docker`                                               | Docker direnv                                                                                                                              | `xebis.ansible.apt`, `xebis.ansible.nftables_firewall` |
 | [xebis.ansible.grub](roles/grub/README.md)                           | GRUB menu configuration.                                                                                                                   |                                                        |
 | `xebis.ansible.fail2ban`                                             | Fail2ban IPS                                                                                                                               | `xebis.ansible.apt`                                    |
 | `xebis.ansible.google_chrome`                                        | Google Chrome (Stable)                                                                                                                     | `xebis.ansible.apt`                                    |

roles/docker/files/inet-fwd-docker.conf

@@ -0,0 +1,4 @@
+iifname == "docker0" counter accept # Allow traffic to and from Docker
+oifname == "docker0" counter accept
+iifgroup == "default" counter accept # Allow traffic to and from Docker networks
+oifgroup == "default" counter accept

roles/docker/meta/main.yaml

@@ -0,0 +1,4 @@
+---
+dependencies:
+  - role: xebis.ansible.apt # Expects updated apt cache
+  - role: xebis.ansible.nftables_firewall # Expects extensible nftables firewall

roles/docker/tasks/firewall.yaml

@@ -0,0 +1,10 @@
+---
+- name: Copy Docker firewall rules
+  become: true
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: /etc/nftables/{{ item }}
+    mode: u=rw,g=r,o=r
+  with_items:
+    - inet-fwd-docker.conf
+  notify: Validate and reload nftables firewall

roles/docker/tasks/main.yaml

@@ -0,0 +1,44 @@
+---
+- name: Import firewall tasks
+  ansible.builtin.import_tasks: firewall.yaml
+
+- name: Add Docker apt key
+  become: true
+  ansible.builtin.apt_key:
+    url: https://download.docker.com/linux/ubuntu/gpg
+    state: present
+
+- name: Add Docker apt repository
+  become: true
+  ansible.builtin.apt_repository:
+    repo: deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable
+    filename: docker
+    mode: u=rw,g=r,o=r
+    state: present
+  notify: Update deb packages
+
+- name: Enforce upgrade and reboot now rather than at the end of the playbook
+  ansible.builtin.meta: flush_handlers
+
+- name: Install Docker deb packages
+  become: true
+  ansible.builtin.apt:
+    name:
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io
+      - docker-buildx-plugin
+      - docker-compose-plugin
+    state: present
+  when: not ansible_check_mode
+
+- name: Clean up Docker - Prune everything
+  become: true
+  community.docker.docker_prune:
+    builder_cache: true
+    containers: true
+    images: true
+    images_filters:
+      dangling: false
+    networks: true
+    volumes: true

test.yaml

@@ -49,4 +49,5 @@
           - owner: xebis
             name: infra
     - role: xebis.ansible.direnv
+    - role: xebis.ansible.docker
     - role: xebis.ansible.visual_studio_code