add docker lxc creation playbook

inventory/hosts.ini

@@ -7,3 +7,6 @@ gitea ansible_host=10.100.5.103 ansible_user=ansible ansible_python_interpreter=
 [proxmox_nodes]
 pve01 ansible_host=10.100.5.250 ansible_user=root ansible_python_interpreter=/usr/bin/python3
 pve02 ansible_host=10.100.5.251 ansible_user=root ansible_python_interpreter=/usr/bin/python3
+
+[docker_test]
+docker-test ansible_host=10.100.5.90 ansible_user=ansible ansible_python_interpreter=/usr/bin/python3

playbooks/create-docker-lxc.yml

@@ -0,0 +1,119 @@
+- name: Create Docker ready LXC
+  hosts: "{{ target_node }}"
+  become: false
+  gather_facts: false
+
+  vars:
+    lxc_ctid: 900
+    lxc_hostname: docker-test
+    lxc_ip: 10.100.5.90/24
+    lxc_gateway: 10.100.5.1
+    lxc_bridge: vmbr0
+    lxc_storage: proxmox-data-nfs
+    lxc_template_storage: proxmox-data-nfs
+    lxc_template: debian-13-standard_13.1-2_amd64.tar.zst
+    lxc_cores: 1
+    lxc_memory: 512
+    lxc_swap: 512
+    lxc_disk: 8
+
+  tasks:
+    - name: Check if CT already exists
+      command: pct status {{ lxc_ctid }}
+      register: ct_status
+      changed_when: false
+      failed_when: false
+
+    - name: Stop if CT already exists
+      fail:
+        msg: "CT {{ lxc_ctid }} already exists on this node. Stop to avoid overwrite."
+      when: ct_status.rc == 0
+
+    - name: Copy ansible public key to Proxmox node
+      copy:
+        content: "{{ lookup('file', '/root/.ssh/id_ed25519.pub') }}"
+        dest: /tmp/ansible-srv.pub
+        owner: root
+        group: root
+        mode: "0600"
+
+    - name: Create LXC container
+      command: >
+        pct create {{ lxc_ctid }}
+        {{ lxc_template_storage }}:vztmpl/{{ lxc_template }}
+        --hostname {{ lxc_hostname }}
+        --cores {{ lxc_cores }}
+        --memory {{ lxc_memory }}
+        --swap {{ lxc_swap }}
+        --rootfs {{ lxc_storage }}:{{ lxc_disk }}
+        --net0 name=eth0,bridge={{ lxc_bridge }},ip={{ lxc_ip }},gw={{ lxc_gateway }}
+        --ostype debian
+        --unprivileged 1
+        --features nesting=1,keyctl=1
+        --ssh-public-keys /tmp/ansible-srv.pub
+        --start 1
+      register: create_result
+
+    - name: Show create result
+      debug:
+        var: create_result.stdout_lines
+
+    - name: Wait a few seconds after first boot
+      pause:
+        seconds: 10
+
+    - name: Update package cache inside CT
+      command: pct exec {{ lxc_ctid }} -- apt update
+      changed_when: false
+
+    - name: Install base packages inside CT
+      command: >
+        pct exec {{ lxc_ctid }} --
+        apt install -y openssh-server sudo python3 curl ca-certificates gnupg nano
+      changed_when: true
+
+    - name: Enable SSH inside CT
+      command: pct exec {{ lxc_ctid }} -- systemctl enable --now ssh
+      changed_when: true
+
+    - name: Create ansible user inside CT
+      command: pct exec {{ lxc_ctid }} -- bash -c "id ansible || useradd -m -s /bin/bash ansible"
+      changed_when: true
+
+    - name: Create ansible ssh directory inside CT
+      command: pct exec {{ lxc_ctid }} -- mkdir -p /home/ansible/.ssh
+      changed_when: true
+
+    - name: Add ansible public key inside CT
+      command: >
+        pct exec {{ lxc_ctid }} -- bash -c
+        'echo "from=\"10.100.5.100\",no-agent-forwarding,no-X11-forwarding,no-port-forwarding {{ lookup("file", "/root/.ssh/id_ed25519.pub") }}" > /home/ansible/.ssh/authorized_keys'
+      changed_when: true
+
+    - name: Fix ssh permissions inside CT
+      command: >
+        pct exec {{ lxc_ctid }} -- bash -c
+        "chown -R ansible:ansible /home/ansible/.ssh &&
+        chmod 700 /home/ansible/.ssh &&
+        chmod 600 /home/ansible/.ssh/authorized_keys"
+      changed_when: true
+
+    - name: Configure sudo for ansible user inside CT
+      command: >
+        pct exec {{ lxc_ctid }} -- bash -c
+        "echo 'ansible ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/ansible &&
+        chmod 440 /etc/sudoers.d/ansible"
+      changed_when: true
+
+    - name: Check sudoers file inside CT
+      command: pct exec {{ lxc_ctid }} -- visudo -cf /etc/sudoers.d/ansible
+      changed_when: false
+
+    - name: Show final CT status
+      command: pct status {{ lxc_ctid }}
+      register: final_status
+      changed_when: false
+
+    - name: Show final status
+      debug:
+        var: final_status.stdout