---
- name: ✅ Ensure '{{ SYS_SVC_DOCKER_DIR }}' exists
  file:
    path: "{{ SYS_SVC_DOCKER_DIR }}"
    state: directory
    mode: "0755"

- name: 📦 Install fuse-overlayfs in container
  ansible.builtin.package: # nocheck: dynamic-package - package set assembled at runtime for the nested runtime
    name: fuse-overlayfs
    state: present
  notify: container-manager-restart

- name: 🧮 Compute and set Docker daemon MTU (container)
  include_tasks: "_mtu.yml"

- name: 🔎 Read the docker daemon config already on this host
  ansible.builtin.slurp:
    src: "{{ SYS_SVC_DOCKER_DAEMON }}"
  register: sys_svc_container_daemon_before
  failed_when: false
  changed_when: false

- name: "📦 Carry a data-root someone else already set"
  ansible.builtin.set_fact:
    SYS_SVC_CONTAINER_DATA_ROOT: >-
      {{ (sys_svc_container_daemon_before.content | b64decode | from_json).get('data-root', '')
         if sys_svc_container_daemon_before.content is defined
            and sys_svc_container_daemon_before.content | length > 0
         else '' }}
  changed_when: false

- name: 🔧 Configure docker daemon storage driver (container)
  include_tasks: "daemon_config.yml"

- name: 🔎 Check if TCP MSS clamp to PMTU is already present (container)
  ansible.builtin.command:
    argv:
      - iptables
      - -t
      - mangle
      - -C
      - FORWARD
      - -p
      - tcp
      - --tcp-flags
      - SYN,RST
      - SYN
      - -j
      - TCPMSS
      - --clamp-mss-to-pmtu
  register: mss_clamp_check
  changed_when: false
  failed_when: false

- name: ✅ Ensure TCP MSS clamping to PMTU on FORWARD (container)
  ansible.builtin.command:
    argv:
      - iptables
      - -t
      - mangle
      - -A
      - FORWARD
      - -p
      - tcp
      - --tcp-flags
      - SYN,RST
      - SYN
      - -j
      - TCPMSS
      - --clamp-mss-to-pmtu
  when:
    - mss_clamp_check.rc != 0
    - mss_clamp_check.stderr is not search('Permission denied')