feat: add option to add custom unit override options (#5)

Reviewed-on: #5

.drone.jsonnet

@@ -15,18 +15,18 @@ local PipelineLinting = {
     },
     {
       name: 'python-format',
-      image: 'python:3.9',
+      image: 'python:3.11',
       environment: {
         PY_COLORS: 1,
       },
       commands: [
         'pip install -qq yapf',
-        '[ -z "$(find .  -type f -name *.py)" ] || (yapf -rd ./)',
+        '[ -z "$(find . -type f -name *.py)" ] || (yapf -rd ./)',
       ],
     },
     {
       name: 'python-flake8',
-      image: 'python:3.9',
+      image: 'python:3.11',
       environment: {
         PY_COLORS: 1,
       },
@@ -37,11 +37,11 @@ local PipelineLinting = {
     },
   ],
   trigger: {
-    ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'],
+    ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
   },
 };
 
-local PipelineDeployment(scenario='centos7') = {
+local PipelineDeployment(scenario='rocky9') = {
   kind: 'pipeline',
   name: 'testing-' + scenario,
   platform: {
@@ -58,7 +58,7 @@ local PipelineDeployment(scenario='centos7') = {
   steps: [
     {
       name: 'ansible-molecule',
-      image: 'thegeeklab/molecule:3',
+      image: 'thegeeklab/molecule:4',
       environment: {
         HCLOUD_TOKEN: { from_secret: 'hcloud_token' },
       },
@@ -71,7 +71,7 @@ local PipelineDeployment(scenario='centos7') = {
     'linting',
   ],
   trigger: {
-    ref: ['refs/heads/master', 'refs/tags/**'],
+    ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
   },
 };
 
@@ -107,15 +107,15 @@ local PipelineDocumentation = {
         target_branch: 'docs',
       },
       when: {
-        ref: ['refs/heads/master'],
+        ref: ['refs/heads/main'],
       },
     },
   ],
   trigger: {
-    ref: ['refs/heads/master', 'refs/tags/**', 'refs/pull/**'],
+    ref: ['refs/heads/main', 'refs/tags/**', 'refs/pull/**'],
   },
   depends_on: [
-    'testing-centos7',
+    'testing-rocky9',
   ],
 };
 
@@ -136,7 +136,7 @@ local PipelineNotification = {
       settings: {
         homeserver: { from_secret: 'matrix_homeserver' },
         roomid: { from_secret: 'matrix_roomid' },
-        template: 'Status: **{{ build.Status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.Link }}){{#if build.Branch}} ({{ build.Branch }}){{/if}} by {{ commit.Author }}<br/> Message: {{ commit.Message.Title }}',
+        template: 'Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}',
         username: { from_secret: 'matrix_username' },
         password: { from_secret: 'matrix_password' },
       },
@@ -147,13 +147,13 @@ local PipelineNotification = {
   ],
   trigger: {
     status: ['success', 'failure'],
-    ref: ['refs/heads/master', 'refs/tags/**'],
+    ref: ['refs/heads/main', 'refs/tags/**'],
   },
 };
 
 [
   PipelineLinting,
-  PipelineDeployment(scenario='centos7'),
+  PipelineDeployment(scenario='rocky9'),
   PipelineDocumentation,
   PipelineNotification,
 ]

.drone.yml

@@ -13,15 +13,15 @@ steps:
       - ansible-later
 
   - name: python-format
-    image: python:3.9
+    image: python:3.11
     commands:
       - pip install -qq yapf
-      - "[ -z \"$(find .  -type f -name *.py)\" ] || (yapf -rd ./)"
+      - "[ -z \"$(find . -type f -name *.py)\" ] || (yapf -rd ./)"
     environment:
       PY_COLORS: 1
 
   - name: python-flake8
-    image: python:3.9
+    image: python:3.11
     commands:
       - pip install -qq flake8
       - flake8
@@ -30,13 +30,13 @@ steps:
 
 trigger:
   ref:
-    - refs/heads/master
+    - refs/heads/main
     - refs/tags/**
     - refs/pull/**
 
 ---
 kind: pipeline
-name: testing-centos7
+name: testing-rocky9
 
 platform:
   os: linux
@@ -51,17 +51,18 @@ workspace:
 
 steps:
   - name: ansible-molecule
-    image: thegeeklab/molecule:3
+    image: thegeeklab/molecule:4
     commands:
-      - molecule test -s centos7
+      - molecule test -s rocky9
     environment:
       HCLOUD_TOKEN:
         from_secret: hcloud_token
 
 trigger:
   ref:
-    - refs/heads/master
+    - refs/heads/main
     - refs/tags/**
+    - refs/pull/**
 
 depends_on:
   - linting
@@ -98,16 +99,16 @@ steps:
         from_secret: gitea_username
     when:
       ref:
-        - refs/heads/master
+        - refs/heads/main
 
 trigger:
   ref:
-    - refs/heads/master
+    - refs/heads/main
     - refs/tags/**
     - refs/pull/**
 
 depends_on:
-  - testing-centos7
+  - testing-rocky9
 
 ---
 kind: pipeline
@@ -130,13 +131,13 @@ steps:
         from_secret: matrix_password
       roomid:
         from_secret: matrix_roomid
-      template: "Status: **{{ build.Status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.Link }}){{#if build.Branch}} ({{ build.Branch }}){{/if}} by {{ commit.Author }}<br/> Message: {{ commit.Message.Title }}"
+      template: "Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}"
       username:
         from_secret: matrix_username
 
 trigger:
   ref:
-    - refs/heads/master
+    - refs/heads/main
     - refs/tags/**
   status:
     - success
@@ -147,6 +148,6 @@ depends_on:
 
 ---
 kind: signature
-hmac: 7223650263350e2d70725d822ec216f71e262c1319c60a9d490a07e1b7f5d345
+hmac: 5ecb808a24d61708adad225a6fd1ffde1b8de1a477f513e21c5e2b14c3790e0d
 
 ...

.gitignore

@@ -9,3 +9,5 @@ __pycache__/
 *.py[cod]
 *$py.class
 
+# ---> Docs
+/_docs

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 Robert Kaussow <mail@thegeeklab.de>
+Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

defaults/main.yml

@@ -1,6 +1,10 @@
 ---
 dockerengine_packages:
-  - docker
+  - docker-ce
+  - docker-ce-cli
+  - containerd.io
+  - docker-buildx-plugin
+  - docker-compose-plugin
 
 # @var dockerengine_packages_extra:description: >
 # The role requires epel repository and pip to work. You can use
@@ -8,35 +12,55 @@ dockerengine_packages:
 # @end
 dockerengine_packages_extra: []
 
+dockerengine_ansible_deps:
+  - cryptography
+  - docker-compose
+  - docker
+
 dockerengine_service: docker
 
+# @var dockerengine_service_override_unit:description: >
+# Multiline string of options to add to the `systemd` service override unit section.
+# @end
+# @var dockerengine_service_override_unit: $ "_unset_"
+# @var dockerengine_service_override_unit:example: >
+# dockerengine_service_override_unit: |
+#   After=time-sync.target
+#   Requires=time-sync.target
+# @end
+
 dockerengine_docker_group_enabled: False
-dockerengine_secure_registries: []
-dockerengine_insecure_registries: []
-dockerengine_block_registries: []
+
+# @var dockerengine_registries:description: List of docker registries to auto login
+# @var dockerengine_registries:example: >
+# dockerengine_registries:
+#   - registry: myregistry.example.com (optional)
+#     username: docker
+#     password: secure
+#     reauthorize: False
+#     state: present
+# @end
+dockerengine_registries: []
 
 # @var dockerengine_http_proxy: $ "_unset_"
 # @var dockerengine_https_proxy: $ "_unset"
 # @var dockerengine_no_proxy: $ "_unset_"
 
-# @var dockerengine_storage_pvs: $ "_unset_"
-# @var dockerengine_storage_pvs:example: $ "/dev/sda"
-dockerengine_storage_vg: vg_docker
-dockerengine_storage_lv: lv_docker
-dockerengine_storage_size: 100G
-dockerengine_base_dir: /var/lib/docker
-
-dockerengine_cli_options:
-  - selinux-enabled
-  - log-driver=journald
-  - log-level=info
-  - signature-verification=false
-
 dockerengine_usernamespace_enabled: False
 dockerengine_nsremap_user: dockremap
 dockerengine_nsremap_range_start: 231072
 dockerengine_nsremap_range_length: 65536
 
+dockerengine_daemon_config:
+  - selinux-enabled: False
+  - log-driver: journald
+  - log-level: info
+  - live-restore: True
+
+dockerengine_daemon_config_extra: []
+# dockerengine_daemon_config_extra:
+#   - userns-remap: "{{ dockerengine_nsremap_user +':' + dockerengine_nsremap_user }}"
+
 # @var dockerengine_networks:description: List of additional docker networks to create.
 # @var dockerengine_networks:example: >
 # dockerengine_networks:

meta/main.yml

@@ -8,7 +8,7 @@ galaxy_info:
   # @meta description: >
   # [![Source Code](https://img.shields.io/badge/gitea-source%20code-blue?logo=gitea&logoColor=white)](https://gitea.rknet.org/ansible/xoxys.docker_engine)
   # [![Build Status](https://img.shields.io/drone/build/ansible/xoxys.docker_engine?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/ansible/xoxys.docker_engine)
-  # [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/ansible/xoxys.docker_engine/src/branch/master/LICENSE)
+  # [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/ansible/xoxys.docker_engine/src/branch/main/LICENSE)
   #
   # Setup docker engine.
   # @end

molecule/centos7/converge.yml

@@ -1,11 +0,0 @@
----
-- name: Converge
-  hosts: all
-  vars:
-    dockerengine_packages_extra:
-      - epel-release
-      - python-pip
-      - python-virtualenv
-
-  roles:
-    - role: xoxys.docker_engine

molecule/rocky9/converge.yml

@@ -0,0 +1,14 @@
+---
+- name: Converge
+  hosts: all
+  vars:
+    dockerengine_packages_extra:
+      - epel-release
+      - python3-pip
+      - python3-virtualenv
+  pre_tasks:
+    - name: Enable CodeReadyBuilder repository
+      command: dnf config-manager --set-enabled "crb"
+      changed_when: False
+  roles:
+    - role: xoxys.docker_engine

molecule/rocky9/molecule.yml

@@ -9,8 +9,8 @@ dependency:
 driver:
   name: delegated
 platforms:
-  - name: centos7-docker-engine
-    image: centos-7
+  - name: rocky9-docker-engine
+    image: rocky-9
     server_type: cx11
 lint: |
   /usr/local/bin/flake8

molecule/rocky9/tests/test_default.py

@@ -8,7 +8,7 @@ testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
 
 
 def test_docker_is_installed(host):
-    docker = host.package("docker")
+    docker = host.package("docker-ce")
     assert docker.is_installed
 
 

tasks/config.yml

@@ -7,21 +7,6 @@
       notify: __docker_restart
       when: dockerengine_docker_group_enabled | bool
 
-    - name: Deploy config files to setup environment
-      template:
-        src: "{{ item.src }}"
-        dest: "{{ item.dest }}"
-        owner: root
-        group: root
-        mode: 0644
-      loop:
-        - { src: 'etc/sysconfig/docker.j2', dest: '/etc/sysconfig/{{ dockerengine_service }}' }
-        - { src: 'etc/sysconfig/docker-storage-setup.j2', dest: '/etc/sysconfig/{{ dockerengine_service }}-storage-setup' }
-        - { src: 'etc/containers/registries.conf.j2', dest: '/etc/containers/registries.conf' }
-      loop_control:
-        label: "{{ item.dest }}"
-      notify: __docker_restart
-
     - name: Add namespace group
       group:
         name: "{{ dockerengine_nsremap_user }}"
@@ -51,12 +36,57 @@
         - /etc/subuid
         - /etc/subgid
 
+    - name: Create required directories
+      loop:
+        - name: /etc/systemd/system/docker.service.d
+          mode: "0755"
+        - name: /etc/docker
+          mode: "0755"
+      loop_control:
+        label: "{{ item.name }}"
+      file:
+        path: "{{ item.name }}"
+        state: directory
+        mode: "{{ item.mode }}"
+
+    - name: Write environment file
+      template:
+        src: etc/sysconfig/docker.j2
+        dest: /etc/sysconfig/docker
+        mode: 0600
+      notify: __docker_restart
+
+    - name: Write service override.conf
+      template:
+        src: etc/systemd/system/docker.service.d/override.conf.j2
+        dest: /etc/systemd/system/docker.service.d/override.conf
+        mode: 0644
+      notify: __docker_restart
+
+    - name: Deploy daemon config
+      copy:
+        content: "{{ (dockerengine_daemon_config | combine(dockerengine_daemon_config_extra)) | to_nice_json }}"
+        dest: /etc/docker/daemon.json
+        mode: 0600
+      notify: __docker_restart
+
     - name: Ensure docker engine is up and running
       service:
         name: "{{ dockerengine_service }}"
         enabled: True
         state: started
 
+    - name: Handle registry logins
+      docker_login:
+        registry: "{{ item.url | default(omit) }}"
+        username: "{{ item.username }}"
+        password: "{{ item.password }}"
+        reauthorize: "{{ item.reauthorize | default(False) }}"
+        state: '{{ item.state | default("present") }}'
+      loop: "{{ dockerengine_registries }}"
+      loop_control:
+        label: "{{ item.url | default('DockerHub') }}"
+
     - name: Create docker networks
       docker_network:
         name: "{{ item.name }}"

tasks/install.yml

@@ -1,5 +1,15 @@
 ---
 - block:
+    - name: Add Docker CE repository
+      yum_repository:
+        name: "docker-ce"
+        file: "Docker-CE"
+        description: "Docker CE Stable"
+        baseurl: "https://download.docker.com/linux/centos/{{ ansible_distribution_major_version }}/{{ ansible_architecture }}/stable"
+        gpgcheck: yes
+        enabled: yes
+        gpgkey: "https://download.docker.com/linux/rhel/gpg"
+
     - name: Install dependencies
       package:
         name: "{{ item }}"
@@ -10,7 +20,7 @@
       pip:
         name: "{{ item }}"
         virtualenv: /opt/python2/ansible-deps
-      loop: "{{ __docker_ansible_deps }}"
+      loop: "{{ dockerengine_ansible_deps }}"
 
     - name: Add docker-compose wrapper
       template:
@@ -20,6 +30,14 @@
         group: root
         mode: 0755
 
+    - name: Ensure to remove old docker packages
+      package:
+        name:
+          - docker
+          - docker-common
+          - docker-engine
+        state: absent
+
     - name: Install packages
       package:
         name: "{{ item }}"

templates/etc/containers/registries.conf.j2

@@ -1,27 +0,0 @@
-{{ ansible_managed | comment }}
-# This is a system-wide configuration file used to
-# keep track of registries for various container backends.
-# It adheres to TOML format and does not support recursive
-# lists of registries.
-
-# The default location for this configuration file is /etc/containers/registries.conf.
-
-# The only valid categories are: 'registries.search', 'registries.insecure',
-# and 'registries.block'.
-
-[registries.search]
-#registries = ['registry.access.redhat.com']
-registries = [{{ dockerengine_secure_registries | xoxys.general.wrap | join(',') }}]
-
-# If you need to access insecure registries, add the registry's fully-qualified name.
-# An insecure registry is one that does not have a valid SSL certificate or only does HTTP.
-[registries.insecure]
-registries = [{{ dockerengine_insecure_registries | xoxys.general.wrap | join(',') }}]
-
-
-# If you need to block pull access from a registry, uncomment the section below
-# and add the registries fully-qualified name.
-#
-# Docker only
-[registries.block]
-registries = [{{ dockerengine_block_registries | xoxys.general.wrap | join(',') }}]

templates/etc/sysconfig/docker-storage-setup.j2

@@ -1,10 +0,0 @@
-#jinja2: lstrip_blocks: True
-{{ ansible_managed | comment }}
-STORAGE_DRIVER=overlay2
-{% if dockerengine_storage_pvs is defined %}
-DEVS={{ dockerengine_storage_pvs }}
-CONTAINER_ROOT_LV_NAME={{ dockerengine_storage_lv }}
-CONTAINER_ROOT_LV_SIZE={{ dockerengine_storage_size }}
-CONTAINER_ROOT_LV_MOUNT_PATH={{ dockerengine_base_dir }}
-VG={{ dockerengine_storage_vg }}
-{% endif %}

templates/etc/sysconfig/docker.j2

@@ -1,33 +1,6 @@
+#jinja2: lstrip_blocks: True
 {{ ansible_managed | comment }}
-# Modify these options if you want to change the way the docker daemon runs
-OPTIONS='{{ dockerengine_cli_options | xoxys.general.prefix | join(' ') }}{{ ' --userns-remap='+dockerengine_nsremap_user+':'+dockerengine_nsremap_user if dockerengine_usernamespace_enabled | bool else '' }}'
-if [ -z "${DOCKER_CERT_PATH}" ]; then
-    DOCKER_CERT_PATH=/etc/docker
-fi
-
-# Do not add registries in this file anymore. Use /etc/containers/registries.conf
-# from the atomic-registries package.
-#
-
-# On an SELinux system, if you remove the --selinux-enabled option, you
-# also need to turn on the docker_transition_unconfined boolean.
-# setsebool -P docker_transition_unconfined 1
-
-# Location used for temporary files, such as those created by
-# docker load and build operations. Default is /var/lib/docker/tmp
-# Can be overriden by setting the following environment variable.
-# DOCKER_TMPDIR=/var/tmp
-
-# Controls the /etc/cron.daily/docker-logrotate cron job status.
-# To disable, uncomment the line below.
-# LOGROTATE=false
-
-# docker-latest daemon can be used by starting the docker-latest unitfile.
-# To use docker-latest client, uncomment below lines
-#DOCKERBINARY=/usr/bin/docker-latest
-#DOCKERDBINARY=/usr/bin/dockerd-latest
-#DOCKER_CONTAINERD_BINARY=/usr/bin/docker-containerd-latest
-#DOCKER_CONTAINERD_SHIM_BINARY=/usr/bin/docker-containerd-shim-latest
+OPTIONS='{{'--userns-remap=' + dockerengine_nsremap_user + ':' + dockerengine_nsremap_user if dockerengine_usernamespace_enabled | bool else '' }}'
 
 # Proxy settings
 {% if dockerengine_http_proxy is defined %}

templates/etc/systemd/system/docker.service.d/override.conf.j2

@@ -0,0 +1,12 @@
+#jinja2: lstrip_blocks: True
+{{ ansible_managed | comment }}
+{% if dockerengine_service_override_unit is defined %}
+[Unit]
+{{ dockerengine_service_override_unit }}
+{% endif %}
+[Service]
+EnvironmentFile=-/etc/sysconfig/docker
+ExecStart=
+ExecStart=/usr/bin/dockerd -H fd:// \
+    --containerd=/run/containerd/containerd.sock \
+    $OPTIONS

vars/main.yml

@@ -1,5 +0,0 @@
----
-__docker_ansible_deps:
-  - cryptography~=2.0
-  - docker-compose~=1.24.0
-  - docker