JARVISandClaude Opus 5.5
15aeb8e222
- provision-agent-host.yml: multica_pat now comes from vault_multica_pats[inventory_hostname_short], one daemon-<host> token per host. A pre_task asserts the key exists (never prints the value) so a missing entry fails by host name instead of as a no_log "censored". - provision-wong-host.yml: spaceship-earth only. Grows the root partition, PV and LV/filesystem with growpart + community.general.lvg/lvol; idempotent (second run changed=0). Then applies obsidian_headless. - roles/obsidian_headless: Obsidian's official headless Sync client (obsidian-headless 0.0.14) as system user obsync under a sandboxed systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/ and wip/ obsync-only, inbox/ granted to multica via access + default ACLs, vault root traverse-only. Verifies the isolation as multica. Sign-in to Obsidian Sync stays manual (see the role README). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
---
|
|
- name: Preflight | Read the Node.js version
|
|
ansible.builtin.command:
|
|
argv: ["{{ obsidian_headless_node_bin_dir }}/node", "--version"]
|
|
register: _obh_node
|
|
changed_when: false
|
|
failed_when: false
|
|
check_mode: false
|
|
|
|
- name: Preflight | Require Node.js new enough for obsidian-headless
|
|
ansible.builtin.assert:
|
|
that:
|
|
- _obh_node.rc == 0
|
|
- (_obh_node.stdout | trim | regex_replace('^v', '')) is version(obsidian_headless_node_min_version, '>=')
|
|
fail_msg: >-
|
|
{{ obsidian_headless_node_bin_dir }}/node is missing or older than
|
|
{{ obsidian_headless_node_min_version }} (found:
|
|
{{ _obh_node.stdout | default('nothing') | trim }}). This role uses the
|
|
runtime multica_agent_host installs; run provision-agent-host.yml first.
|
|
quiet: true
|
|
|
|
- name: Preflight | Look up the users granted shared folders
|
|
ansible.builtin.getent:
|
|
database: passwd
|
|
key: "{{ item }}"
|
|
loop: "{{ obsidian_headless_shared_folders | map(attribute='user') | unique | list }}"
|
|
|
|
- name: Preflight | Require shared folders to stay disjoint from private ones
|
|
ansible.builtin.assert:
|
|
that:
|
|
- obsidian_headless_shared_folders | map(attribute='path') | intersect(obsidian_headless_private_folders) | length == 0
|
|
fail_msg: A folder cannot be both private and shared.
|
|
quiet: true
|