fedora-headless.yml

---
- name: Fedora Headless
  hosts: fedoraheadless
  vars:
    non_root_user: admiller
  tasks:

    - name: Package Install - Fedora
      ansible.builtin.dnf:
        state: installed
        name: "{{ packages_fedora }}"

    - name: Package Install - Common
      ansible.builtin.dnf:
        state: installed
        name: "{{ packages_common }}"

    - name: Ensure SELinux Enforcing
      ansible.posix.selinux:
        policy: targeted
        state: enforcing

    - name: Enable container_manage_cgroup for running systemd in podman containers
      ansible.posix.seboolean:
        name: container_manage_cgroup
        state: true
        persistent: true

    - name: Start and enable firewalld
      ansible.builtin.systemd:
        name: "firewalld"
        state: started
        masked: false
        enabled: true

    - name: Ensure various ports are open
      ansible.posix.firewalld:
        service: "{{ item }}"
        permanent: yes
        immediate: yes
        state: enabled
      loop:
        - cockpit

    - name: Make sure non_root_user user is in mock
      ansible.builtin.user:
        name: "{{ non_root_user }}" 
        groups: mock
        append: yes

    - name: Allow non-root user access to libvirt via polkit
      ansible.builtin.template:
        src: templates/non_root_user_libvirt_polkit.j2
        dest: /etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules
      notify:
        - reload polkit

    - name: Allow non-root user access to NetworkManager
      ansible.builtin.template:
        src: templates/network_manager_polkit.j2
        dest: /etc/polkit-1/rules.d/10-network-manager.pkla
      notify:
        - reload polkit

    - name: enable journald persistent storage
      ansible.builtin.file:
        path: /var/log/journal
        state: directory

    - name: setup BOINC client for world community grid when it's not a laptop
      ansible.builtin.import_role:
        name: worldcommunitygrid
      when:
        - ansible_virtualization_role != "guest"

  handlers:
    - name: reload polkit
      ansible.builtin.service:
        name: polkit
        state: restarted

# vim:ft=yaml.ansible