refactor: consolidate all roles into ansible/roles/ and update ansible.cfg

- Move all roles from playbooks/roles/ to roles/
- Update roles_path in ansible.cfg
- Add cast user to common role
- Create standalone podman role
- Add semaphore role with Podman + Quadlet support

ansible/ansible.cfg

@@ -209,7 +209,7 @@ private_key_file=~/.ssh/ansible
 remote_user=wed
 
 # (pathspec) Colon-separated paths in which Ansible will search for Roles.
-roles_path=/opt/git/homelab/ansible/playbooks/roles:/Users/rblundon/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
+roles_path=./roles
 
 # (string) Set the main callback used to display Ansible output. You can only have one at a time.
 # You can have many other callbacks, but just one can be in charge of stdout.

ansible/create_jarvis_user.yml

@@ -0,0 +1,6 @@
+---
+- name: Create jarvis user and deploy SSH key
+  hosts: all
+  become: true
+  roles:
+    - jarvis_user

ansible/playbooks/deploy_semaphore.yml

@@ -0,0 +1,6 @@
+---
+- name: Deploy Semaphore on figment
+  hosts: figment
+  become: true
+  roles:
+    - semaphore

ansible/playbooks/roles/common/tasks/main.yml

@@ -1,77 +0,0 @@
----
-# ------------------------------------------------------------------------------
-# FILE: roles/common/tasks/main.yml
-# DESCRIPTION: Baseline configuration applied to all managed Ubuntu hosts.
-#              Handles hostname, timezone, core packages, NTP, ansible user,
-#              and optional LVM root volume expansion.
-# ------------------------------------------------------------------------------
-
-- name: Set hostname
-  hostname:
-    name: "{{ inventory_hostname | replace('_', '-') }}"
-
-- name: Set timezone
-  timezone:
-    name: "{{ common_timezone }}"
-
-- name: Update apt cache
-  apt:
-    update_cache: yes
-    cache_valid_time: 3600
-
-- name: Install base utility packages
-  apt:
-    name: "{{ common_packages }}"
-    state: present
-
-- name: Install chrony
-  apt:
-    name: chrony
-    state: present
-
-- name: Configure chrony to use sundial
-  template:
-    src: chrony.conf.j2
-    dest: /etc/chrony/chrony.conf
-    mode: '0644'
-  notify: restart chrony
-
-- name: Ensure chrony is enabled and running
-  systemd:
-    name: chrony
-    state: started
-    enabled: yes
-
-- name: Ensure ansible user has passwordless sudo
-  lineinfile:
-    path: /etc/sudoers.d/{{ ansible_user }}
-    line: "{{ ansible_user }} ALL=(ALL) NOPASSWD:ALL"
-    create: yes
-    mode: '0440'
-    validate: 'visudo -cf %s'
-
-# ------------------------------------------------------------------------------
-# LVM root volume expansion
-# Extends the root PV to the full disk size and grows the LV + filesystem.
-# This codifies what was previously done manually after provisioning.
-# Runs only when common_expand_root_lvm is true (default: true).
-# Safe to re-run — pvresize and lvextend are idempotent when already at max.
-# ------------------------------------------------------------------------------
-
-- name: Expand root PV to full disk size
-  command: pvresize {{ common_root_pv }}
-  register: pvresize_result
-  changed_when: "'changed' in pvresize_result.stdout or pvresize_result.rc == 0"
-  when: common_expand_root_lvm | bool
-
-- name: Extend root LV to 100% of free VG space
-  lvol:
-    vg: "{{ common_root_vg }}"
-    lv: "{{ common_root_lv }}"
-    size: +100%FREE
-    resizefs: yes
-  when:
-    - common_expand_root_lvm | bool
-  ignore_errors: yes
-  # ignore_errors because lvextend returns non-zero when already at max size.
-  # resizefs: yes handles the resize2fs call inline — no separate task needed.

ansible/roles/common/tasks/main.yml

@@ -0,0 +1,21 @@
+- name: Create cast group
+  ansible.builtin.group:
+    name: cast
+    state: present
+    system: true
+
+- name: Create cast user
+  ansible.builtin.user:
+    name: cast
+    group: cast
+    shell: /bin/bash
+    create_home: true
+    state: present
+
+- name: Ensure cast user has passwordless sudo
+  ansible.builtin.lineinfile:
+    path: /etc/sudoers.d/cast
+    line: "cast ALL=(ALL) NOPASSWD:ALL"
+    create: yes
+    mode: '0440'
+    validate: 'visudo -cf %s'

ansible/roles/jarvis_user/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+jarvis_user: jarvis
+jarvis_group: jarvis
+jarvis_shell: /bin/bash
+jarvis_sudo_nopasswd: true

ansible/roles/jarvis_user/tasks/main.yml

@@ -0,0 +1,30 @@
+---
+- name: Create jarvis group
+  ansible.builtin.group:
+    name: "{{ jarvis_group }}"
+    state: present
+    system: false
+
+- name: Create jarvis user
+  ansible.builtin.user:
+    name: "{{ jarvis_user }}"
+    group: "{{ jarvis_group }}"
+    shell: "{{ jarvis_shell }}"
+    create_home: true
+    state: present
+
+- name: Deploy SSH public key
+  ansible.posix.authorized_key:
+    user: "{{ jarvis_user }}"
+    key: "{{ lookup('file', '~/.ssh/id_jarvis.pub') }}"
+    state: present
+    exclusive: true
+
+- name: Grant passwordless sudo
+  ansible.builtin.copy:
+    dest: "/etc/sudoers.d/{{ jarvis_user }}"
+    content: "{{ jarvis_user }} ALL=(ALL) NOPASSWD:ALL\n"
+    owner: root
+    group: root
+    mode: '0440'
+  when: jarvis_sudo_nopasswd | bool

ansible/roles/podman/defaults/main.yml

@@ -0,0 +1,18 @@
+---
+podman_packages:
+  - podman
+  - fuse-overlayfs
+  - slirp4netns
+  - containernetworking-plugins
+
+# Rootless user
+podman_rootless_user: cast
+
+# Registries
+podman_registries:
+  - prefix: "docker.io"
+    location: "docker.io"
+  - prefix: "quay.io"
+    location: "quay.io"
+  - prefix: "ghcr.io"
+    location: "ghcr.io"

ansible/roles/podman/tasks/main.yml

@@ -0,0 +1,49 @@
+---
+- name: Install Podman and dependencies
+  ansible.builtin.package:
+    name: "{{ podman_packages }}"
+    state: present
+
+- name: Enable lingering for rootless user
+  ansible.builtin.command:
+    cmd: loginctl enable-linger {{ podman_rootless_user }}
+  changed_when: false
+  ignore_errors: true
+
+- name: Configure subuid for rootless user
+  ansible.builtin.lineinfile:
+    path: /etc/subuid
+    line: "{{ podman_rootless_user }}:100000:65536"
+    create: yes
+    mode: '0644'
+
+- name: Configure subgid for rootless user
+  ansible.builtin.lineinfile:
+    path: /etc/subgid
+    line: "{{ podman_rootless_user }}:100000:65536"
+    create: yes
+    mode: '0644'
+
+- name: Create Quadlet directory
+  ansible.builtin.file:
+    path: /etc/containers/systemd
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
+- name: Deploy containers.conf
+  ansible.builtin.template:
+    src: containers.conf.j2
+    dest: /etc/containers/containers.conf
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: Deploy registries.conf
+  ansible.builtin.template:
+    src: registries.conf.j2
+    dest: /etc/containers/registries.conf
+    owner: root
+    group: root
+    mode: '0644'

ansible/roles/podman/templates/containers.conf.j2

@@ -0,0 +1,9 @@
+[containers]
+dns = ["sundial.local.mk-labs.cloud"]
+pids_limit = 2048
+log_driver = "journald"
+
+[engine]
+runtime = "crun"
+cgroup_manager = "systemd"
+events_logger = "journald"

ansible/roles/podman/templates/registries.conf.j2

@@ -0,0 +1,13 @@
+unqualified-search-registries = ["docker.io"]
+
+[[registry]]
+prefix = "docker.io"
+location = "docker.io"
+
+[[registry]]
+prefix = "quay.io"
+location = "quay.io"
+
+[[registry]]
+prefix = "ghcr.io"
+location = "ghcr.io"