---
# docker_build_host — provision the docker engine on an arm64 build host (e.g. gandalf)
# for the native arm64 daily knoe-db image build (push → registry.knoe.dev). Builds run
# in a remote buildx builder (buildkit container) on this host; the dev workstation only
# orchestrates over ssh.
#
# These hosts double as k3s agents, so docker's own containerd coexists with k3s's
# embedded containerd (separate sockets: /run/containerd vs /run/k3s/containerd). The one
# real hazard is docker flipping the iptables FORWARD policy to DROP, which would sever
# k3s pod networking — so we hold it at ACCEPT. We deliberately let docker manage its own
# NAT/iptables otherwise, because the buildkit container needs outbound for registry pulls.

- name: Install docker engine (docker.io)
  ansible.builtin.apt:
    name: docker.io
    state: present
    update_cache: true

- name: Add the ansible user to the docker group (so buildx can drive docker over ssh)
  ansible.builtin.user:
    name: "{{ ansible_user | default('ansible') }}"
    groups: docker
    append: true

- name: Ensure docker is enabled and running
  ansible.builtin.service:
    name: docker
    enabled: true
    state: started

- name: Hold the iptables FORWARD policy at ACCEPT (protect k3s pod networking from docker)
  ansible.builtin.iptables:
    chain: FORWARD
    policy: ACCEPT
  when: "'k3s_agents' in group_names or 'k3s_servers' in group_names"