esh-pfi-infrastructure/playbooks/nh3-albok-host.yaml

# Base build for nh3-albok (VM 110 on nh3-pve-2, 10.100.50.44): the dedicated albok-service host.
#   scripts/elway infra-ops@10.100.50.44 --playbook playbooks/nh3-albok-host.yaml
# Order: playbooks/nh3-albok-vm.yaml (on nh3-pve-2) → bootstrap-infra-ops-user.yaml run AS vh → this
# → albok-service-host.yaml (ids + /srv/albok) → stacks/albok-service/README.md deploy steps.
#
# Built to docs/pfi/fleet-conventions.md: `vh` 1000 (cloud-init), `infra-ops` 850, `docker` gid 851
# created BEFORE docker-ce so the package adopts it, /opt/docker root:docker 2775.
#
# ⚠ This host exists to keep root-over-docker away from the albok store. So, unlike the general docker
#   hosts, it gets NO portainer/dockge/agent containers, NO socket mounts, and dockerd does NOT listen on
#   tcp/2375 (Homepage cannot discover it; the Homepage entry for albok is static in services.yaml).
#   Do not add any of those here. A host-level read of containers is `ssh` + `docker ps`.
steps:
  - name: take the bootstrap infra-ops key back off vh (vh keeps the operator's keys)
    sudo: true
    shell: |
      set -e
      f=/home/vh/.ssh/authorized_keys
      grep -v 'infra-ops@pfi-fleet' "$f" > "$f.new"
      test -s "$f.new"
      chown vh:vh "$f.new"; chmod 600 "$f.new"; mv "$f.new" "$f"
    when: "sudo -n grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys"

  - name: timezone America/Los_Angeles (the fleet's; trixie ships US/Pacific only in tzdata-legacy)
    sudo: true
    shell: timedatectl set-timezone America/Los_Angeles
    when: "[ \"$(timedatectl show -p Timezone --value)\" != America/Los_Angeles ]"

  - name: base packages (guest agent for vzdump freeze/thaw, rsync for the store move)
    sudo: true
    shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q qemu-guest-agent rsync jq curl ca-certificates gnupg
    when: "! dpkg -s qemu-guest-agent rsync jq >/dev/null 2>&1"

  - name: qemu-guest-agent running
    sudo: true
    shell: systemctl start qemu-guest-agent
    when: "! systemctl is-active --quiet qemu-guest-agent"

  - name: docker group pinned at gid 851 BEFORE docker-ce installs
    sudo: true
    shell: groupadd -g 851 docker
    when: "! getent group docker >/dev/null"

  - name: Docker's apt repo (trixie)
    sudo: true
    shell: |
      set -e
      install -d -m 0755 /etc/apt/keyrings
      curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg
      chmod a+r /etc/apt/keyrings/docker.gpg
      echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release; echo $VERSION_CODENAME) stable" \
        > /etc/apt/sources.list.d/docker.list
      apt-get update -qq
    creates: /etc/apt/sources.list.d/docker.list

  - name: docker-ce + compose plugin
    sudo: true
    shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
    when: "! dpkg -s docker-ce docker-compose-plugin >/dev/null 2>&1"

  - name: vh and infra-ops in docker
    sudo: true
    shell: usermod -aG docker vh && usermod -aG docker infra-ops
    when: "! id -nG infra-ops | grep -qw docker || ! id -nG vh | grep -qw docker"

  - name: deploy tree /opt/docker{,/compose,/conf} root:docker 2775
    sudo: true
    shell: |
      install -d -o root -g docker -m 2775 /opt/docker /opt/docker/compose /opt/docker/conf
    changed_when: "false"

  - name: traefik-net exists (the fleet compose convention names it; no traefik runs here)
    sudo: true
    shell: docker network create traefik-net
    when: "! sudo -n docker network inspect traefik-net >/dev/null 2>&1"

verify:
  - name: identities and groups match the fleet pin
    shell: |
      test "$(id -u vh)" = 1000 && test "$(id -u infra-ops)" = 850 && test "$(getent group docker | cut -d: -f3)" = 851
      id -nG infra-ops | grep -qw docker
    changed_when: "false"
  - name: vh no longer carries the infra-ops key
    sudo: true
    shell: "! grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys && grep -c . /home/vh/.ssh/authorized_keys"
    changed_when: "false"
  - name: dockerd up, listening on its unix socket only (nothing on tcp/2375 or 2376)
    sudo: true
    shell: |
      docker version --format '{{.Server.Version}}'
      ! ss -ltn | grep -E ':(2375|2376)\b'
    changed_when: "false"
  - name: guest agent active
    shell: systemctl is-active qemu-guest-agent
    changed_when: "false"