container_systemd.yml (1705B)
1 --- 2 # Opt-in Podman: mkdir *.service.d then drop-ins (copy makes no dirs; else 226/NAMESPACE). 3 - name: Ensure systemd drop-in directories for container services 4 ansible.builtin.file: 5 path: "/etc/systemd/system/{{ item }}.service.d" 6 state: directory 7 owner: root 8 group: root 9 mode: "0755" 10 loop: 11 - libeufin-bank 12 - taler-merchant-httpd 13 - taler-exchange-httpd 14 - taler-exchange-offline 15 - taler-exchange-secmod-rsa 16 - taler-exchange-secmod-eddsa 17 - taler-exchange-secmod-cs 18 - taler-exchange-transfer 19 - taler-exchange-wirewatch 20 - taler-exchange-aggregator 21 - taler-exchange-closer 22 - taler-exchange-expire 23 when: regional_currency_podman_systemd_relax | bool 24 25 - name: Relax systemd namespace hardening for container services 26 ansible.builtin.copy: 27 dest: "/etc/systemd/system/{{ item }}.service.d/container.conf" 28 owner: root 29 group: root 30 mode: "0644" 31 content: | 32 [Service] 33 PrivateTmp=false 34 PrivateDevices=false 35 ProtectSystem=false 36 loop: 37 - libeufin-bank 38 - taler-merchant-httpd 39 - taler-exchange-httpd 40 - taler-exchange-offline 41 - taler-exchange-secmod-rsa 42 - taler-exchange-secmod-eddsa 43 - taler-exchange-secmod-cs 44 - taler-exchange-transfer 45 - taler-exchange-wirewatch 46 - taler-exchange-aggregator 47 - taler-exchange-closer 48 - taler-exchange-expire 49 when: regional_currency_podman_systemd_relax | bool 50 register: regional_currency_container_dropins 51 52 - name: Reload systemd after container drop-ins 53 ansible.builtin.systemd: 54 daemon_reload: true 55 when: 56 - regional_currency_podman_systemd_relax | bool 57 - regional_currency_container_dropins is changed