todo-hetzner/ansible/roles/app/tasks/main.yml

---
- name: Look up application user
  ansible.builtin.getent:
    database: passwd
    key: "{{ app_user }}"

- name: Store application user ID
  ansible.builtin.set_fact:
    app_user_uid: "{{ ansible_facts.getent_passwd[app_user][1] }}"

- name: Create Quadlet directory
  ansible.builtin.file:
    path: "/home/{{ app_user }}/.config/containers/systemd"
    state: directory
    owner: "{{ app_user }}"
    group: "{{ app_user }}"
    mode: "0700"

- name: Install protected application environment
  ansible.builtin.template:
    src: app.env.j2
    dest: "/home/{{ app_user }}/.config/todo.env"
    owner: "{{ app_user }}"
    group: "{{ app_user }}"
    mode: "0600"
  no_log: true

- name: Authenticate to private registry
  ansible.builtin.command:
    argv:
      - podman
      - login
      - --username
      - "{{ registry_username }}"
      - --password-stdin
      - "{{ registry_server }}"
    stdin: "{{ registry_password }}"
  become_user: "{{ app_user }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ app_user_uid }}"
  changed_when: true
  no_log: true
  when:
    - registry_username is defined
    - registry_password is defined
    - registry_server is defined

- name: Install application Quadlet
  ansible.builtin.template:
    src: app-todo.container.j2
    dest: "/home/{{ app_user }}/.config/containers/systemd/app-todo.container"
    owner: "{{ app_user }}"
    group: "{{ app_user }}"
    mode: "0644"

- name: Reload application user manager
  ansible.builtin.command:
    argv: [systemctl, --user, daemon-reload]
  become_user: "{{ app_user }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ app_user_uid }}"
  changed_when: false

- name: Enable application service without starting it
  ansible.builtin.command:
    argv: [systemctl, --user, enable, app-todo.service]
  become_user: "{{ app_user }}"
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ app_user_uid }}"
  register: app_enable
  changed_when: "'Created symlink' in app_enable.stderr"