71 lines
2.0 KiB
YAML
71 lines
2.0 KiB
YAML
# roles/claude_code/tasks/apt.yml
|
|
---
|
|
- name: Create apt keyrings directory
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
mode: "0755"
|
|
owner: root
|
|
group: root
|
|
become: true
|
|
|
|
- name: Download Anthropic release signing key
|
|
ansible.builtin.get_url:
|
|
url: "{{ claude_code_apt_key_url }}"
|
|
dest: "{{ claude_code_apt_key_path }}"
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
become: true
|
|
|
|
- name: Read key fingerprint
|
|
ansible.builtin.shell:
|
|
cmd: |
|
|
set -o pipefail
|
|
gpg --show-keys --with-colons {{ claude_code_apt_key_path | quote }} | awk -F':' '/^fpr/ {print $10; exit}'
|
|
executable: /bin/bash
|
|
register: claude_code_key_fpr
|
|
changed_when: false
|
|
check_mode: false
|
|
become: true
|
|
|
|
- name: Refuse to continue if the key fingerprint does not match
|
|
ansible.builtin.assert:
|
|
that:
|
|
- claude_code_key_fpr.stdout | trim | upper == claude_code_apt_key_fingerprint | upper
|
|
fail_msg: >-
|
|
Signing key fingerprint mismatch: got '{{ claude_code_key_fpr.stdout | trim }}',
|
|
expected '{{ claude_code_apt_key_fingerprint }}'. Removing the key file.
|
|
quiet: true
|
|
register: claude_code_key_check
|
|
ignore_errors: true
|
|
|
|
- name: Remove untrusted key file
|
|
ansible.builtin.file:
|
|
path: "{{ claude_code_apt_key_path }}"
|
|
state: absent
|
|
become: true
|
|
when: claude_code_key_check is failed
|
|
|
|
- name: Stop if key check failed
|
|
ansible.builtin.fail:
|
|
msg: "{{ claude_code_key_check.msg }}"
|
|
when: claude_code_key_check is failed
|
|
|
|
- name: Configure Claude Code apt repository
|
|
ansible.builtin.apt_repository:
|
|
repo: >-
|
|
deb [signed-by={{ claude_code_apt_key_path }}]
|
|
{{ claude_code_apt_repo_base }}/{{ claude_code_apt_channel }}
|
|
{{ claude_code_apt_channel }} main
|
|
filename: claude-code
|
|
state: present
|
|
update_cache: true
|
|
become: true
|
|
|
|
- name: Install claude-code package
|
|
ansible.builtin.apt:
|
|
name: claude-code
|
|
state: "{{ claude_code_package_state }}"
|
|
become: true
|