fix: podman connect

roles/podman/README.md

@@ -6,9 +6,8 @@ Installs and configures Podman for container management with support for Docker
 
 - Installs Podman, podman-compose, and crun (OCI runtime)
 - Configurable logging backend (journald or k8s-file)
-- External network creation for service isolation
 - Container registry search configuration
-- Shared projects directory for compose files
+- Shared projects directory for Kubernetes YAML files
 
 ## Container Logging
 
@@ -22,19 +21,6 @@ Installs and configures Podman for container management with support for Docker
 
 Switch via `podman_log_driver` variable.
 
-## External Networks
-
-Define networks in inventory for persistent, isolated container networks:
-
-```yaml
-podman_external_networks:
-  - name: immich
-    subnet: 172.20.0.0/16
-    gateway: 172.20.0.1
-```
-
-Networks persist across container restarts and compose rebuilds.
-
 ## Hands-on Commands
 
 ```bash
@@ -53,8 +39,14 @@ podman inspect <container> | jq '.[0].HostConfig.LogConfig'
 # Test configuration
 podman run --rm alpine echo "OK"
 
-# List networks
-podman network ls
+# Play Kubernetes YAML
+podman play kube --replace /path/to/pod.yaml
+
+# Stop pod
+podman play kube --down /path/to/pod.yaml
+
+# List pods
+podman pod ls
 ```
 
 ## References

roles/podman/defaults/main.yml

@@ -7,14 +7,6 @@ podman_unqualified_search_registries:
   - quay.io
   - ghcr.io
 
-# Podman bridge network configuration
-# Define the network where containers will operate
-# Leave empty to use Podman's default dynamic network assignment
-# Example: "10.89.0.0/24" if you want to explicitly set it
-podman_subnet: ""
-# Podman bridge gateway IP (typically .1 of the bridge network)
-# Used by services that need to bind to the bridge interface
-
 # OCI Runtime
 # crun (default, modern C runtime - fast) or runc (original Go runtime)
 podman_runtime: crun
@@ -26,14 +18,3 @@ podman_log_driver: journald
 # k8s-file driver settings (only used when podman_log_driver: k8s-file)
 podman_log_max_size: 10mb # Max size per log file before rotation
 podman_log_max_files: 5 # Max number of rotated log files to keep
-
-# Each network should define: name, subnet, gateway
-# podman_external_networks: []
-# Example:
-# podman_external_networks:
-#   - name: immich
-#     subnet: 172.20.0.0/16
-#     gateway: 172.20.0.1
-#   - name: nextcloud
-#     subnet: 172.21.0.0/16
-#     gateway: 172.21.0.1

roles/podman/tasks/main.yml

@@ -7,6 +7,35 @@
       - crun
     state: present
 
+- name: Check if tun module is available
+  ansible.builtin.stat:
+    path: "/lib/modules/{{ ansible_kernel }}/modules.builtin"
+  register: kernel_modules
+
+- name: Load tun kernel module for rootless Podman networking
+  community.general.modprobe:
+    name: tun
+    state: present
+  when: kernel_modules.stat.exists
+  register: tun_loaded
+  ignore_errors: true
+
+- name: Ensure tun module loads on boot
+  ansible.builtin.copy:
+    content: "tun\n"
+    dest: /etc/modules-load.d/tun.conf
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Warn user about reboot requirement for tun module
+  ansible.builtin.debug:
+    msg: |
+      WARNING: tun kernel module could not be loaded (kernel modules not available).
+      A REBOOT IS REQUIRED for the tun module to load and enable Pasta networking.
+      After reboot, rootless Podman containers will have better network performance.
+  when: not kernel_modules.stat.exists or (tun_loaded is defined and tun_loaded is failed)
+
 - name: Enable Podman service
   ansible.builtin.systemd:
     name: podman.service
@@ -35,12 +64,3 @@
     owner: root
     group: root
     mode: "0644"
-
-- name: Create external Podman networks
-  containers.podman.podman_network:
-    name: "{{ item.name }}"
-    subnet: "{{ item.subnet }}"
-    gateway: "{{ item.gateway }}"
-    state: present
-  loop: "{{ podman_external_networks | default([]) }}"
-  when: podman_external_networks is defined and podman_external_networks | length > 0

roles/podman/templates/containers.conf.j2

@@ -27,3 +27,7 @@ runtime = "{{ podman_runtime }}"
 
 # Default network backend
 network_backend = "netavark"
+
+[network]
+# Default rootless network command (pasta for better performance)
+default_rootless_network_cmd = "pasta"