commit 24a703332b6097d4f3d040dc5ee76e92e936605c parent 667586cde21c7dd52bd77ff589d4adab130d823b Author: Hernâni Marques <hernani+magikoopa@vecirex.net> Date: Fri, 4 Sep 2026 22:47:18 +0200 fix: create Podman systemd drop-in dirs Diffstat:
| M | regional-currency-ng/roles/regional_currency/defaults/main.yml | | | 2 | ++ |
| A | regional-currency-ng/roles/regional_currency/tasks/container_systemd.yml | | | 57 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| M | regional-currency-ng/roles/regional_currency/tasks/main.yml | | | 4 | ++++ |
3 files changed, 63 insertions(+), 0 deletions(-)
diff --git a/regional-currency-ng/roles/regional_currency/defaults/main.yml b/regional-currency-ng/roles/regional_currency/defaults/main.yml @@ -22,6 +22,8 @@ regional_currency_exchange_privacy_file: /usr/share/taler-exchange/terms/exchang regional_currency_enable_exchange_terms: true regional_currency_enable_exchange_privacy: true regional_currency_coin_withdraw_duration: 1 month +# true in Podman lab: avoid systemd 226/NAMESPACE (PrivateTmp/ProtectSystem). +regional_currency_podman_systemd_relax: false regional_currency_apt_testing: false regional_currency_enable_nexus_services: false regional_currency_bank_token_rate: 30r/m diff --git a/regional-currency-ng/roles/regional_currency/tasks/container_systemd.yml b/regional-currency-ng/roles/regional_currency/tasks/container_systemd.yml @@ -0,0 +1,57 @@ +--- +# Opt-in Podman: mkdir *.service.d then drop-ins (copy makes no dirs; else 226/NAMESPACE). +- name: Ensure systemd drop-in directories for container services + ansible.builtin.file: + path: "/etc/systemd/system/{{ item }}.service.d" + state: directory + owner: root + group: root + mode: "0755" + loop: + - libeufin-bank + - taler-merchant-httpd + - taler-exchange-httpd + - taler-exchange-offline + - taler-exchange-secmod-rsa + - taler-exchange-secmod-eddsa + - taler-exchange-secmod-cs + - taler-exchange-transfer + - taler-exchange-wirewatch + - taler-exchange-aggregator + - taler-exchange-closer + - taler-exchange-expire + when: regional_currency_podman_systemd_relax | bool + +- name: Relax systemd namespace hardening for container services + ansible.builtin.copy: + dest: "/etc/systemd/system/{{ item }}.service.d/container.conf" + owner: root + group: root + mode: "0644" + content: | + [Service] + PrivateTmp=false + PrivateDevices=false + ProtectSystem=false + loop: + - libeufin-bank + - taler-merchant-httpd + - taler-exchange-httpd + - taler-exchange-offline + - taler-exchange-secmod-rsa + - taler-exchange-secmod-eddsa + - taler-exchange-secmod-cs + - taler-exchange-transfer + - taler-exchange-wirewatch + - taler-exchange-aggregator + - taler-exchange-closer + - taler-exchange-expire + when: regional_currency_podman_systemd_relax | bool + register: regional_currency_container_dropins + +- name: Reload systemd after container drop-ins + ansible.builtin.systemd: + daemon_reload: true + when: + - regional_currency_podman_systemd_relax | bool + - regional_currency_container_dropins is changed diff --git a/regional-currency-ng/roles/regional_currency/tasks/main.yml b/regional-currency-ng/roles/regional_currency/tasks/main.yml @@ -29,6 +29,10 @@ - name: Install packages ansible.builtin.import_tasks: packages.yml +- name: Adapt systemd units for Podman when requested + ansible.builtin.import_tasks: container_systemd.yml + when: regional_currency_podman_systemd_relax | bool + - name: Configure nginx ansible.builtin.import_tasks: nginx.yml