JARVISandClaude Opus 5.5
15aeb8e222
- provision-agent-host.yml: multica_pat now comes from vault_multica_pats[inventory_hostname_short], one daemon-<host> token per host. A pre_task asserts the key exists (never prints the value) so a missing entry fails by host name instead of as a no_log "censored". - provision-wong-host.yml: spaceship-earth only. Grows the root partition, PV and LV/filesystem with growpart + community.general.lvg/lvol; idempotent (second run changed=0). Then applies obsidian_headless. - roles/obsidian_headless: Obsidian's official headless Sync client (obsidian-headless 0.0.14) as system user obsync under a sandboxed systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/ and wip/ obsync-only, inbox/ granted to multica via access + default ACLs, vault root traverse-only. Verifies the isolation as multica. Sign-in to Obsidian Sync stays manual (see the role README). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
65 lines
3.1 KiB
YAML
65 lines
3.1 KiB
YAML
---
|
|
# =============================================================================
|
|
# obsidian_headless — defaults
|
|
#
|
|
# Runs Obsidian's official headless Sync client (`ob`, npm obsidian-headless)
|
|
# as a dedicated unprivileged user under a systemd unit, and lays out the vault
|
|
# folder so that other local users reach only the folders granted to them.
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Service account
|
|
# -----------------------------------------------------------------------------
|
|
# Holds the Obsidian account token (~/.config/obsidian-headless/auth_token) and
|
|
# the per-vault sync state, so its home is private.
|
|
obsidian_headless_user: obsync
|
|
obsidian_headless_group: obsync
|
|
obsidian_headless_home: "/var/lib/{{ obsidian_headless_user }}"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Client
|
|
# -----------------------------------------------------------------------------
|
|
# Pinned. The package is in open beta and versions move quickly.
|
|
obsidian_headless_version: "0.0.14"
|
|
obsidian_headless_npm_prefix: "{{ obsidian_headless_home }}/.npm-global"
|
|
# Node.js is NOT installed by this role. It expects the runtime that
|
|
# multica_agent_host already puts on this host. obsidian-headless needs >= 22.
|
|
obsidian_headless_node_bin_dir: /usr/local/bin
|
|
obsidian_headless_node_min_version: "22.0.0"
|
|
# Where `ob` is linked, so `sudo -u obsync -H ob ...` works without a PATH.
|
|
obsidian_headless_link_dir: /usr/local/bin
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Vault
|
|
# -----------------------------------------------------------------------------
|
|
obsidian_headless_vault_path: /srv/obsidian/vault
|
|
# Shown in Sync version history. Applied by the manual `ob sync-setup`.
|
|
obsidian_headless_device_name: "{{ inventory_hostname_short }}"
|
|
|
|
# Top-level folders only obsidian_headless_user may enter (0700, no ACL).
|
|
obsidian_headless_private_folders: []
|
|
|
|
# Top-level folders another local user may read and write. Granted with named
|
|
# ACL entries plus matching DEFAULT entries, so files and folders Sync creates
|
|
# later inherit the grant. Everything not listed here is private: the unit runs
|
|
# with UMask=0077, and the vault root grants listed users traverse (--x) only,
|
|
# never list.
|
|
# - path: inbox
|
|
# user: multica
|
|
obsidian_headless_shared_folders: []
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Service
|
|
# -----------------------------------------------------------------------------
|
|
obsidian_headless_service_name: obsidian-sync
|
|
# Enabled either way; started only once `ob login` and `ob sync-setup` have
|
|
# been done by hand. Its Condition*= lines keep it inert until then.
|
|
obsidian_headless_service_enabled: true
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Verification
|
|
# -----------------------------------------------------------------------------
|
|
# Prove the isolation as the shared users themselves: read/write in their
|
|
# folders, denied in every private folder and on listing the vault root.
|
|
obsidian_headless_verify: true
|