JARVISandClaude Opus 5.5
15aeb8e222
- provision-agent-host.yml: multica_pat now comes from vault_multica_pats[inventory_hostname_short], one daemon-<host> token per host. A pre_task asserts the key exists (never prints the value) so a missing entry fails by host name instead of as a no_log "censored". - provision-wong-host.yml: spaceship-earth only. Grows the root partition, PV and LV/filesystem with growpart + community.general.lvg/lvol; idempotent (second run changed=0). Then applies obsidian_headless. - roles/obsidian_headless: Obsidian's official headless Sync client (obsidian-headless 0.0.14) as system user obsync under a sandboxed systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/ and wip/ obsync-only, inbox/ granted to multica via access + default ACLs, vault root traverse-only. Verifies the isolation as multica. Sign-in to Obsidian Sync stays manual (see the role README). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
28 lines
805 B
YAML
28 lines
805 B
YAML
---
|
|
# Not `always`: that would also fire under unrelated tags of the calling
|
|
# playbook (e.g. --tags wong_disk). Every tag of this role carries it instead.
|
|
- name: Preflight
|
|
ansible.builtin.import_tasks: preflight.yml
|
|
tags: [obsidian, obsidian_user, obsidian_install, obsidian_layout, obsidian_service, obsidian_verify]
|
|
|
|
- name: Service account
|
|
ansible.builtin.import_tasks: user.yml
|
|
tags: [obsidian_user]
|
|
|
|
- name: Client
|
|
ansible.builtin.import_tasks: install.yml
|
|
tags: [obsidian_install]
|
|
|
|
- name: Vault layout
|
|
ansible.builtin.import_tasks: layout.yml
|
|
tags: [obsidian_layout]
|
|
|
|
- name: Service
|
|
ansible.builtin.import_tasks: service.yml
|
|
tags: [obsidian_service]
|
|
|
|
- name: Verify
|
|
ansible.builtin.import_tasks: verify.yml
|
|
when: obsidian_headless_verify | bool
|
|
tags: [obsidian_verify]
|