el9-headless.yml

---
- name: EL 9 Headless
  hosts: el9headless
  vars:
    non_root_user: admiller
    flatpak_method: system
  tasks:
    - name: Import geerlingguy repo-epel
      ansible.builtin.import_role:
        name: geerlingguy.repo-epel

    - name: Package Install - EL 9
      ansible.builtin.yum:
        state: installed
        name: "{{ packages_el9 }}"

    - name: Package Install - EL 9 Headless
      ansible.builtin.yum:
        state: installed
        name: "{{ packages_el9_headless }}"


    # - name: Package Install - Common
    #   ansible.builtin.yum:
    #     state: installed
    #     name: "{{ packages_common }}"

    - name: Package Install - EPEL9 
      ansible.builtin.yum:
        state: installed
        name: "{{ packages_epel9 }}"

    - name: Ensure SELinux Enforcing
      ansible.posix.selinux:
        policy: targeted
        state: enforcing

    - name: Enable container_manage_cgroup for running systemd in podman containers
      ansible.posix.seboolean:
        name: container_manage_cgroup
        state: true
        persistent: true

    - name: Disable rpcbind because reasons
      ansible.builtin.systemd:
        name: "{{ item }}"
        state: stopped
        masked: true
        enabled: false
      loop:
        - rpcbind

    - name: Start and enable cockpit
      ansible.builtin.systemd:
        name: "cockpit"
        state: started
        masked: false
        enabled: true
          
    - name: Start and enable firewalld
      ansible.builtin.systemd:
        name: "firewalld"
        state: started
        masked: false
        enabled: true

    - name: Ensure various ports are open
      ansible.posix.firewalld:
        service: "{{ item }}"
        permanent: yes
        immediate: yes
        state: enabled
      loop:
        - cockpit

    - name: Make sure non_root_user user is in mock
      ansible.builtin.user:
        name: "{{ non_root_user }}" 
        groups: mock
        append: yes

    - name: Allow non-root user access to libvirt via polkit
      ansible.builtin.template:
        src: templates/non_root_user_libvirt_polkit.j2
        dest: /etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules
      notify:
        - reload polkit

    - name: Allow non-root user access to NetworkManager
      ansible.builtin.template:
        src: templates/network_manager_polkit.j2
        dest: /etc/polkit-1/rules.d/10-network-manager.pkla
      notify:
        - reload polkit

    - name: enable journald persistent storage
      ansible.builtin.file:
        path: /var/log/journal
        state: directory

    - name: setup BOINC client for world community grid when it's not a laptop
      ansible.builtin.import_role:
        name: worldcommunitygrid
      when:
        - ansible_virtualization_role != "guest"

  handlers:
    - name: reload polkit
      ansible.builtin.service:
        name: polkit
        state: restarted

# vim:ft=yaml.ansible