deploy hermes

ansible/playbooks/roles/common/tasks/main.yml

@@ -1,8 +1,9 @@
+---
 # ------------------------------------------------------------------------------
 # FILE: roles/common/tasks/main.yml
-# DESCRIPTION: Baseline configuration applied to all managed hosts.
-#              Handles hostname, timezone, core packages, NTP, and
-#              ansible user setup.
+# DESCRIPTION: Baseline configuration applied to all managed Ubuntu hosts.
+#              Handles hostname, timezone, core packages, NTP, ansible user,
+#              and optional LVM root volume expansion.
 # ------------------------------------------------------------------------------
 
 - name: Set hostname
@@ -10,7 +11,7 @@
     name: "{{ inventory_hostname | replace('_', '-') }}"
 
 - name: Set timezone
-  community.general.timezone:
+  timezone:
     name: "{{ common_timezone }}"
 
 - name: Update apt cache
@@ -41,7 +42,7 @@
     state: started
     enabled: yes
 
-- name: Ensure ansible user has sudo without password
+- name: Ensure ansible user has passwordless sudo
   lineinfile:
     path: /etc/sudoers.d/{{ ansible_user }}
     line: "{{ ansible_user }} ALL=(ALL) NOPASSWD:ALL"
@@ -49,33 +50,28 @@
     mode: '0440'
     validate: 'visudo -cf %s'
 
-# --- Step-CA SSH certificate enrollment ---
-- name: Enroll host in step-ca SSH CA
-  include_tasks: step_ca_client.yml
+# ------------------------------------------------------------------------------
+# LVM root volume expansion
+# Extends the root PV to the full disk size and grows the LV + filesystem.
+# This codifies what was previously done manually after provisioning.
+# Runs only when common_expand_root_lvm is true (default: true).
+# Safe to re-run — pvresize and lvextend are idempotent when already at max.
+# ------------------------------------------------------------------------------
 
-- name: Create authorized principals directory
-  ansible.builtin.file:
-    path: /etc/ssh/auth_principals
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
+- name: Expand root PV to full disk size
+  command: pvresize {{ common_root_pv }}
+  register: pvresize_result
+  changed_when: "'changed' in pvresize_result.stdout or pvresize_result.rc == 0"
+  when: common_expand_root_lvm | bool
 
-- name: Create authorized principals files
-  ansible.builtin.copy:
-    content: "{{ item.principals | join('\n') }}\n"
-    dest: "/etc/ssh/auth_principals/{{ item.local_user }}"
-    owner: root
-    group: root
-    mode: '0644'
-  loop: "{{ step_ca_principal_mappings }}"
-  notify: restart sshd
-
-- name: Configure sshd AuthorizedPrincipalsFile
-  ansible.builtin.lineinfile:
-    path: /etc/ssh/sshd_config
-    line: "AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u"
-    regexp: "^#?AuthorizedPrincipalsFile"
-    state: present
-  notify: restart sshd
-   
+- name: Extend root LV to 100% of free VG space
+  lvol:
+    vg: "{{ common_root_vg }}"
+    lv: "{{ common_root_lv }}"
+    size: +100%FREE
+    resizefs: yes
+  when:
+    - common_expand_root_lvm | bool
+  ignore_errors: yes
+  # ignore_errors because lvextend returns non-zero when already at max size.
+  # resizefs: yes handles the resize2fs call inline — no separate task needed.