ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
36 lines
1.0 KiB
YAML
36 lines
1.0 KiB
YAML
---
|
|
# Shared Docker Engine install — used by both platform and lab-host roles (import_tasks from
|
|
# common, not duplicated). Follows Docker's own official apt-repo installation method.
|
|
|
|
- name: Add Docker's GPG key
|
|
ansible.builtin.get_url:
|
|
url: https://download.docker.com/linux/ubuntu/gpg
|
|
dest: /etc/apt/keyrings/docker.asc
|
|
mode: "0644"
|
|
register: docker_gpg
|
|
retries: 3
|
|
delay: 5
|
|
until: docker_gpg is succeeded
|
|
|
|
- name: Add Docker apt repository
|
|
ansible.builtin.apt_repository:
|
|
repo: "deb [arch={{ ansible_architecture | replace('x86_64','amd64') }} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
|
|
state: present
|
|
filename: docker
|
|
|
|
- name: Install Docker Engine + Compose plugin
|
|
ansible.builtin.apt:
|
|
name:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-compose-plugin
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Enable and start Docker
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
enabled: true
|
|
state: started
|