debian.ansible.docker/docker.yml

---

- name: docker
  hosts: all
  tasks:

### Docker ###

    - name: Create docker Group
      ansible.builtin.group:
        name: docker
        state: present
        gid: 1003

    - name: Create docker User
      ansible.builtin.user:
        name: docker
        comment: docker User
        uid: 1003
        group: docker

    - name: Hide docker user from login screen
      blockinfile:
        path: /var/lib/AccountsService/users/docker
        mode: "0444"
        owner: root
        group: root
        create: yes
        block: |
          [User]
          SystemAccount=true          
        backup: no

    - name: Create docker dir
      ansible.builtin.file:
        path: /home/docker
        owner: docker
        group: docker
        state: directory
        mode: '0750'

    - name: Create docker-data dir
      ansible.builtin.file:
        path: /home/docker/var-lib-docker
        owner: root
        group: root
        state: directory
        mode: '0710'

    - name: Create /var/lib/docker -> /home/docker/var-lib-docker symlink
      ansible.builtin.file:
        src: /home/docker/var-lib-docker
        dest: /var/lib/docker
        owner: root
        group: root
        state: link

    - name: Remove packages for docker from default repo
      apt:
        name:
          - docker.io
          - docker-compose
          - containerd
          - runc
        state: absent
        update_cache: no
        install_recommends: no

    - name: Add signing key
      ansible.builtin.shell: curl -fsSL https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg | gpg --output  "/usr/share/keyrings/gpg-pub-docker.gpg" --dearmor
      args:
        creates: /home/docker/nextcloud.{{inventory_hostname}}/env

    #- name: Add signing key
    #  ansible.builtin.apt_key:
    #    url: "https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg"
    #    state: present

    - name: Add repository into sources list
      ansible.builtin.apt_repository:
        repo: "deb https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
        state: absent
        filename: docker       

    - name: Add repository into sources list
      ansible.builtin.apt_repository:
        repo: "deb [arch=amd64 signed-by=/usr/share/keyrings/gpg-pub-docker.gpg] https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
        state: present
        filename: docker

    - name: Packages for docker
      apt:
        name:
          - docker-ce
          - docker-ce-cli 
          - containerd.io 
          - docker-buildx-plugin 
          - docker-compose-plugin
          - bridge-utils
          - apache2-utils
          - python3-docker
        update_cache: yes
        install_recommends: no
    
    # https://github.com/nextcloud/docker/issues/1103
    - name: writing daemon.json (ipv6 settings) 
      copy:
        dest: "/etc/docker/daemon.json"
        content: |
          {
            "ipv6": true,
            "fixed-cidr-v6": "fdab::/64",
            "experimental": true, 
            "ip6tables": true
          }

    - name: /usr/local/sbin/autoupdate.d/docker.update
      blockinfile:
        path: /usr/local/sbin/autoupdate.d/docker.update
        mode: "0400"
        owner: root
        group: root
        create: yes
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          # fix for creating notify.sh directory by docker (volume) if not exists
          [ -d /usr/local/bin/notify.sh ] && rmdir /usr/local/bin/notify.sh

          g_echo_ok "check for updates"
          # Clean up docker images
          docker system prune -af
          find /home/docker -maxdepth 1 -mindepth 1 -type d | egrep -v "mailcow-dockerized$|.del$|.bak$|.old$|var-lib-docker$" | while read docker
          do
            [ -f "$docker/docker-compose.yml" ] || continue
            g_echo_ok "$docker"
            cd "${docker}"
            if docker -l warn compose --ansi never pull --include-deps 2>&1 | grep "download complete"
            then
              g_echo_warn "Installiere $docker Update"
              docker -l warn compose --ansi never down  >$g_tmp/down 2>&1 || g_echo_error "$docker: docker compose pull fehlgeschlagen: $(cat $g_tmp/down)"
              docker -l warn compose --ansi never up -d >$g_tmp/up 2>&1   || g_echo_error "$docker: docker compose up fehlgeschlagen: $(cat $g_tmp/up)"
            fi
            if [ -f Dockerfile ]
            then
              if docker -l warn compose --ansi never build --progress=plain --pull --no-cache --force-rm >$g_tmp/build 2>&1
              then
                docker -l warn compose --ansi never down  >$g_tmp/down 2>&1 || g_echo_error "$docker: docker compose pull fehlgeschlagen: $(cat $g_tmp/down)"
                docker -l warn compose --ansi never up -d >$g_tmp/up 2>&1   || g_echo_error "$docker: docker compose up fehlgeschlagen: $(cat $g_tmp/up)"
              else
                g_echo_error "$docker: docker compose build fehlgeschlagen: $(cat $g_tmp/build)"
              fi
            fi
          done          
        backup: yes
        validate: /bin/bash -n %s

    - name: /usr/local/sbin/backup.d/docker.backup
      blockinfile:
        path: /usr/local/sbin/backup.d/docker.backup
        mode: "0400"
        owner: root
        group: root
        create: yes
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          ### DB Backup
          g_echo_ok "Starte Backup von MySQL-Datenbanken (Docker)"
           
          DAYS=7
           
          TIMESTAMP=$(date +"%Y%m%d%H%M")
          CONTAINER=$(docker ps --format \{\{.Names\}\}:\{\{.Image\}\}| grep 'mysql\|mariadb' | cut -d":" -f1 | grep -v mailcow)
           
          mkdir -p $BACKUPDIR
          for i in $CONTAINER
          do
            # get credentials
            MARIADB_DATABASE=$(docker exec $i env | egrep "MARIADB_DATABASE|MYSQL_DATABASE" | tail -n1 |cut -d"=" -f2)
            MARIADB_PWD=$(docker exec $i env | egrep "MARIADB_PASSWORD|MYSQL_PASSWORD" | tail -n1 |cut -d"=" -f2)
            MARIADB_USR=$(docker exec $i env | egrep "MARIADB_USER|MYSQL_USER" | tail -n1 |cut -d"=" -f2)
            # get dump path
            docker exec $i /usr/bin/test -x /usr/bin/mariadb-dump && DBDUMPCMD=/usr/bin/mariadb-dump
            docker exec $i /usr/bin/test -x /usr/bin/mysqldump && DBDUMPCMD=/usr/bin/mysqldump
            if [ -z "$DBDUMPCMD" ]
            then
              g_echo_error "No dbdumpcmd found in container $i! No backup created!"
              continue
            fi
            g_echo "Sichere Datenbank $MARIADB_DATABASE DB aus $i";
            docker exec $i $DBDUMPCMD --no-tablespaces -u $MARIADB_USR -p$MARIADB_PWD $MARIADB_DATABASE 2>${g_tmp}/dberr | gzip > $BACKUPDIR/$i-$MARIADB_DATABASE-$TIMESTAMP.sql.gz || g_echo_error "DB-Backup von $MARIADB_DATABASE war nicht erfolgreich $(cat ${g_tmp}/dberr)"
            # dont delete last old backups!
            OLD_BACKUPS=$(ls -1 $BACKUPDIR/$i*.gz |wc -l)
            if [ $OLD_BACKUPS -gt $DAYS ]; then
              find $BACKUPDIR -name "$i*.gz" -daystart -mtime +$DAYS -delete
            fi
          done          
        backup: yes
        validate: /bin/bash -n %s

    - name: docker-compose command/alias for backward compatibility - now docker compose
      blockinfile:
        path: /usr/local/sbin/docker-compose
        mode: "0755"
        owner: root
        group: root
        create: yes
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          docker compose $@
        backup: yes
        validate: /bin/bash -n %s

    - name: /usr/local/sbin/docker-compose shebang
      lineinfile:
        path: /usr/local/sbin/docker-compose
        insertbefore: BOF
        line: "#!/bin/bash -e"