add playbook to install Docker and configure ACL for shared folder

playbooks/install-standard-docker.yml

@@ -0,0 +1,72 @@
+---
+- name: Install Docker, Compose plugin, and set ACL for shared folder
+  hosts: all
+  become: true
+  gather_facts: true
+
+  vars:
+    docker_acl_path: "/opt/docker"
+
+  tasks:
+    - name: Install prerequisites
+      apt:
+        name:
+          - apt-transport-https
+          - ca-certificates
+          - curl
+          - gnupg
+          - lsb-release
+          - acl
+        state: present
+        update_cache: true
+
+    - name: Add Docker’s official GPG key
+      ansible.builtin.apt_key:
+        url: https://download.docker.com/linux/ubuntu/gpg
+        state: present
+
+    - name: Set up Docker repository
+      ansible.builtin.apt_repository:
+        repo: "deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_lsb.codename }} stable"
+        state: present
+        filename: docker
+
+    - name: Install Docker Engine and Compose plugin
+      apt:
+        name:
+          - docker-ce
+          - docker-ce-cli
+          - containerd.io
+          - docker-buildx-plugin
+          - docker-compose-plugin
+        state: latest
+        update_cache: true
+
+    - name: Ensure docker group exists
+      group:
+        name: docker
+        state: present
+
+    - name: Ensure Docker service is enabled and started
+      systemd:
+        name: docker
+        enabled: true
+        state: started
+
+    - name: Ensure Docker base folder exists
+      file:
+        path: "{{ docker_acl_path }}"
+        state: directory
+        owner: root
+        group: docker
+        mode: "0775"
+
+    - name: Check for existing default ACL on folder
+      command: getfacl --access --default {{ docker_acl_path }}
+      register: facl_check
+      changed_when: false
+      failed_when: false
+
+    - name: Set default ACL for docker group if not already set
+      command: setfacl -d -m g:docker:rwx {{ docker_acl_path }}
+      when: "'group:docker:rwx' not in facl_check.stdout"