first part of config

roles/portainer-deploy/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: deploy portainer
+  shell: >
+    docker stack deploy
+    --compose-file /srv/portainer-stack.yml
+    --prune
+    portainer

roles/portainer-deploy/tasks/main.yml

@@ -0,0 +1,13 @@
+---
+- name: Create public network.
+  shell:
+    docker network create -d overlay public
+  register: create_network
+  failed_when: create_network.rc not in [ 0, 1 ]
+  changed_when: create_network.rc == 0
+
+- name: Copy over the Portainer stack file.
+  template:
+    src: portainer-stack.yml.j2
+    dest: /srv/portainer-stack.yml
+  notify: deploy portainer

roles/portainer-deploy/templates/portainer-stack.yml.j2

@@ -0,0 +1,49 @@
+# vim: ft=yaml
+version: '3'
+
+services:
+  app:
+    image: 'portainer/portainer-ce:2.11.0-alpine'
+    command: '-H tcp://tasks.agent:9001 --tlsskipverify'
+
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.role == manager
+      labels:
+        - 'traefik.enable=true'
+        - 'traefik.http.routers.portainer.rule=Host(`{{ portainer_domain }}`)'
+        - 'traefik.http.routers.portainer.service=portainer'
+        - 'traefik.http.services.portainer.loadbalancer.server.port=9000'
+        - 'traefik.http.routers.portainer.tls=true'
+        - 'traefik.http.routers.portainer.tls.certresolver=letsEncrypt'
+
+    networks:
+      - default
+      - public
+    volumes:
+      - 'data:/data'
+    ports:
+      - '8000:8000'
+
+  agent:
+    image: 'portainer/agent:2.9.3-alpine'
+
+    deploy:
+      mode: global
+      placement:
+        constraints:
+          - node.platform.os == linux
+
+    volumes:
+      - '/var/run/docker.sock:/var/run/docker.sock'
+      - '/var/lib/docker/volumes:/var/lib/docker/volumes'
+
+networks:
+  public:
+    external: true
+
+volumes:
+  data: