JARVISandClaude Opus 5.5
15aeb8e222
- provision-agent-host.yml: multica_pat now comes from vault_multica_pats[inventory_hostname_short], one daemon-<host> token per host. A pre_task asserts the key exists (never prints the value) so a missing entry fails by host name instead of as a no_log "censored". - provision-wong-host.yml: spaceship-earth only. Grows the root partition, PV and LV/filesystem with growpart + community.general.lvg/lvol; idempotent (second run changed=0). Then applies obsidian_headless. - roles/obsidian_headless: Obsidian's official headless Sync client (obsidian-headless 0.0.14) as system user obsync under a sandboxed systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/ and wip/ obsync-only, inbox/ granted to multica via access + default ACLs, vault root traverse-only. Verifies the isolation as multica. Sign-in to Obsidian Sync stays manual (see the role README). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
1.1 KiB
YAML
32 lines
1.1 KiB
YAML
---
|
|
- name: Service | Install the unit
|
|
ansible.builtin.template:
|
|
src: obsidian-sync.service.j2
|
|
dest: "/etc/systemd/system/{{ obsidian_headless_service_name }}.service"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: restart obsidian sync
|
|
|
|
- name: Service | Enable it at boot
|
|
ansible.builtin.systemd_service:
|
|
name: "{{ obsidian_headless_service_name }}"
|
|
enabled: "{{ obsidian_headless_service_enabled | bool }}"
|
|
daemon_reload: true
|
|
|
|
# Starting it before the manual sign-in would be a no-op (its conditions fail)
|
|
# that reports "changed" on every run. Start it only once it can actually sync.
|
|
- name: Service | Check whether the manual sign-in and vault setup are done
|
|
ansible.builtin.find:
|
|
paths: "{{ obsidian_headless_home }}/.config/obsidian-headless/sync"
|
|
file_type: directory
|
|
register: _obh_sync_configs
|
|
|
|
- name: Service | Start it once a vault is set up
|
|
ansible.builtin.systemd_service:
|
|
name: "{{ obsidian_headless_service_name }}"
|
|
state: started
|
|
when:
|
|
- obsidian_headless_service_enabled | bool
|
|
- _obh_sync_configs.matched | default(0) > 0
|