---
# Remove conflicting packages (per Docker docs)
- name: Remove conflicting Docker packages
  apt:
    name:
      - docker.io
      - docker-doc
      - docker-compose
      - docker-compose-v2
      - podman-docker
      - containerd
      - runc
    state: absent

# Prerequisites
- name: Install Docker prerequisites
  apt:
    name:
      - ca-certificates
      - curl
      - gnupg
    state: present
    update_cache: true

# Keyrings directory
- name: Create Docker APT keyrings directory
  file:
    path: /etc/apt/keyrings
    state: directory
    mode: "0755"

# Docker GPG key (must be dearmored for apt signed-by)
- name: Add Docker GPG key
  shell: |
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
  args:
    creates: /etc/apt/keyrings/docker.gpg

# Docker repository
- name: Add Docker APT repository
  apt_repository:
    repo: >
      deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg]
      https://download.docker.com/linux/ubuntu
      {{ ansible_distribution_release }} stable
    filename: docker
    state: present

# Install Docker
- name: Install Docker Engine and plugins
  apt:
    name: "{{ docker_packages }}"
    state: present
    update_cache: true

# Docker daemon configuration
- name: Configure Docker daemon
  copy:
    dest: /etc/docker/daemon.json
    content: "{{ docker_daemon_config | to_nice_json }}"
    owner: root
    group: root
    mode: "0644"
  notify: Restart Docker

# Enable Docker
- name: Enable and start Docker
  systemd:
    name: docker
    enabled: true
    state: started

# Non-root Docker usage
- name: Add user to docker group
  user:
    name: "{{ ansible_user }}"
    groups: docker
    append: true

# Kernel forwarding (required)
- name: Enable IP forwarding
  sysctl:
    name: net.ipv4.ip_forward
    value: "1"
    state: present
    reload: true

# Optional IPv6 disable
- name: Disable IPv6 (optional)
  sysctl:
    name: "{{ item }}"
    value: "1"
    state: present
    reload: true
  loop:
    - net.ipv6.conf.all.disable_ipv6
    - net.ipv6.conf.default.disable_ipv6
  when: docker_disable_ipv6