roles/Zigbee2MQTT: Deploy using Podman

Zigbee2MQTT is very similar to ZwaveJS2Mqtt: it is a daemon process that
communicates with the Zigbee radio and integrates with Home Assistant
using MQTT.  Naturally, I decided to deploy it in the same way as
ZwaveJS2Mqtt, using a systemd unit to run it in a container with Podman.

homeassistant.yml

@@ -7,6 +7,8 @@
     tags: mosquitto
   - role: zwavejs2mqtt
     tags: zwavejs2mqtt
+  - role: zigbee2mqtt
+    tags: zigbee2mqtt
   tasks:
   - name: ensure homeassistant is running
     service:

roles/zigbee2mqtt/defaults/main.yml

@@ -0,0 +1,6 @@
+zigbee2mqtt_container_device: /dev/ttyACM0
+zigbee2mqtt_serial_adapter: deconz
+zigbee2mqtt_permit_join: true
+zigbee2mqtt_mqtt:
+  base_topic: zigbee2mqtt
+  server: mqtt://localhost

roles/zigbee2mqtt/handlers/main.yml

@@ -0,0 +1,6 @@
+- name: reload systemd
+  command: systemctl daemon-reload
+- name: restart zigbee2mqtt
+  service:
+    name: zigbee2mqtt
+    state: restarted

roles/zigbee2mqtt/tasks/main.yml

@@ -0,0 +1,68 @@
+- name: ensure podman is installed
+  package:
+    name: '{{ zigbee2mqtt_podman_packages }}'
+    state: present
+  tags:
+  - install
+
+- name: ensure zigbee2mqtt user exists
+  user:
+    name: zigbee2mqtt
+    system: true
+    home: /var/lib/zigbee2mqtt
+    groups:
+    - dialout
+    createhome: false
+  register: zigbee2mqtt_user
+  tags:
+  - user
+
+- name: ensure zigbee2mqtt data directory exists
+  file:
+    path: /var/lib/zigbee2mqtt
+    owner: zigbee2mqtt
+    group: zigbee2mqtt
+    mode: '0755'
+    state: directory
+  tags:
+  - datadir
+
+- name: ensure zigbee2mqtt container image is available
+  podman_image:
+    name: docker.io/koenkk/zigbee2mqtt
+    tag: latest
+    state: present
+  notify:
+  - restart zigbee2mqtt
+  tags:
+  - container-image
+  - container
+
+- name: ensure zigbee2mqtt systemd unit is installed
+  template:
+    src: zigbee2mqtt.service.j2
+    dest: /etc/systemd/system/zigbee2mqtt.service
+    mode: '0644'
+  notify:
+  - reload systemd
+  - restart zigbee2mqtt
+  tags:
+  - service
+  - systemd
+- name: ensure zigbee2mqtt starts at boot
+  service:
+    name: zigbee2mqtt
+    enabled: true
+  tags:
+  - service
+
+- name: ensure zigbee2mqtt is configured
+  template:
+    src: configuration.yaml.j2
+    dest: /var/lib/zigbee2mqtt/configuration.yaml
+    owner: zigbee2mqtt
+    group: zigbee2mqtt
+    mode: '0600'
+    force: false
+  notify:
+  - restart zigbee2mqtt

roles/zigbee2mqtt/templates/configuration.yaml.j2

@@ -0,0 +1 @@
+{{ zigbee2mqtt_config|to_nice_yaml(indent=2) }}

roles/zigbee2mqtt/templates/zigbee2mqtt.service.j2

@@ -0,0 +1,26 @@
+[Unit]
+Description=Zigbee2MQTT
+
+[Service]
+Type=notify
+NotifyAccess=all
+ExecStartPre=/usr/bin/setfacl -m zigbee2mqtt:rw {{ zigbee2mqtt_device }}
+ExecStartPre=-/usr/bin/podman container rm --ignore -f zigbee2mqtt
+ExecStart=/usr/bin/podman run \
+    --pull never \
+    --sdnotify=conmon --cgroups=no-conmon \
+    --rm \
+    --network=host \
+    --name zigbee2mqtt \
+    -v /var/lib/zigbee2mqtt:/app/data:Z \
+    --uidmap 0:{{ zigbee2mqtt_user.uid }}:1 \
+    --gidmap 0:{{ zigbee2mqtt_user.group }}:1 \
+    --uidmap 1:5100001:1024 \
+    --gidmap 1:5100001:1024 \
+    --device {{ zigbee2mqtt_device }}:{{ zigbee2mqtt_container_device }}:rw \
+    docker.io/koenkk/zigbee2mqtt:latest
+ProtectSystem=full
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target

roles/zigbee2mqtt/vars/main.yml

@@ -0,0 +1,10 @@
+zigbee2mqtt_podman_packages:
+- podman
+zigbee2mqtt_config:
+  homeassistant: true
+  permit_join: '{{ zigbee2mqtt_permit_join|bool }}'
+  mqtt: >-
+    {{ zigbee2mqtt_mqtt }}
+  serial:
+    adapter: '{{ zigbee2mqtt_serial_adapter }}'
+    port: '{{ zigbee2mqtt_container_device }}'