chef-recipes/containers/portainer/tasks.yml

# code: language=ansible

---
- hosts: all
  name: Portainer container manager
  tasks:
    - name: Get containers UID
      ansible.builtin.command: "id -u containers"
      register: uid_containers
      changed_when: uid_containers.rc != 0

    - name: Stop running containers
      become_user: containers
      become: true
      ansible.builtin.systemd:
        scope: user
        name: container-{{ item }}.service
        state: stopped
      loop:
        - portainer
      failed_when: false

    - name: Pull portainer image
      become_user: containers
      become: true
      containers.podman.podman_image:
        name: docker.io/portainer/portainer-ce:latest

    - name: Create traefik-portainer network
      containers.podman.podman_network:
        name: traefik-portainer
        recreate: false
        state: "present"
      become_user: containers
      become: true

    - name: Create portainer data volume
      containers.podman.podman_volume:
        state: present
        name: portainer
      become_user: containers
      become: true

    - name: Create portainer instance
      become_user: containers
      become: true
      containers.podman.podman_container:
        name: portainer
        image: docker.io/portainer/portainer-ce:latest
        state: present
        security_opt:
          - label=type:container_runtime_t
        volume:
          - /run/user/{{ uid_containers.stdout }}/podman/podman.sock:/var/run/docker.sock:z
          - portainer:/data:Z
        network:
          - traefik-portainer
        label:
          io.containers.autoupdate: "registry"
          traefik.enable: "true"
          traefik.http.routers.portainer.entrypoints: "https"
          traefik.http.routers.portainer.rule: "Host(`{{ vault_domain }}`) && (PathPrefix(`/portainer/`) || Path(`/portainer`))"
          traefik.http.routers.portainer.tls: "true"
          traefik.http.routers.portainer.tls.certresolver: "wildcard"
          traefik.http.routers.portainer.service: "portainer"
          traefik.http.routers.portainer.middlewares: "force-trailing-slash@file,portainer-prefixstrip@docker"
          traefik.http.middlewares.portainer-prefixstrip.stripprefix.prefixes: "/portainer"
          traefik.http.services.portainer.loadbalancer.server.port: "9000"
          traefik.docker.network: "traefik-portainer"
        generate_systemd:
          path: /home/containers/.config/systemd/user/
          restart_policy: on-failure
          time: 3600
          names: true
          new: true

    - name: Start containers at boot
      become_user: containers
      become: true
      ansible.builtin.systemd:
        scope: user
        name: container-{{ item }}.service
        enabled: true
        state: started
        daemon_reload: true
      loop:
        - portainer