wulf-ansible/roles/docker/tasks/main.yml

---
# Remove conflicting packages
- name: Remove conflicting Docker packages
  apt:
    name:
      - docker.io
      - docker-doc
      - docker-compose
      - docker-compose-v2
      - podman-docker
      - containerd
      - runc
    state: absent

# Prerequisites
- name: Install Docker prerequisites
  apt:
    name:
      - ca-certificates
      - curl
      - gnupg
    state: present
    update_cache: true

# Keyrings directory
- name: Create Docker APT keyrings directory
  file:
    path: /etc/apt/keyrings
    state: directory
    mode: "0755"

# Docker GPG key
- name: Add Docker GPG key
  shell: |
    curl -fsSL https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
  args:
    creates: /etc/apt/keyrings/docker.gpg

# Docker repository
- name: Add Docker APT repository
  apt_repository:
    repo: >
      deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg]
      https://download.docker.com/linux/{{ ansible_distribution | lower }}
      {{ ansible_distribution_release }} stable
    filename: docker
    state: present
    update_cache: true

# Install Docker
- name: Install Docker Engine and plugins
  apt:
    name: "{{ docker_packages }}"
    state: present

# Docker daemon configuration
- name: Configure Docker daemon
  copy:
    dest: /etc/docker/daemon.json
    content: "{{ docker_daemon_config | to_nice_json }}"
    owner: root
    group: root
    mode: "0644"
  notify: Restart Docker

# Enable Docker
- name: Enable and start Docker
  systemd:
    name: docker
    enabled: true
    state: started

# Non-root Docker usage
- name: Add user to docker group
  user:
    name: "{{ docker_manage_user | default(ansible_user) }}"
    groups: docker
    append: true

# Kernel forwarding
- name: Enable IP forwarding
  sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    state: present
    reload: true

# Optional IPv6 disable
- name: Disable IPv6
  sysctl:
    name: "{{ item }}"
    value: "1"
    state: present
    reload: true
  loop:
    - net.ipv6.conf.all.disable_ipv6
    - net.ipv6.conf.default.disable_ipv6
  when: docker_disable_ipv6