JARVISandClaude Opus 5.5
15aeb8e222
- provision-agent-host.yml: multica_pat now comes from vault_multica_pats[inventory_hostname_short], one daemon-<host> token per host. A pre_task asserts the key exists (never prints the value) so a missing entry fails by host name instead of as a no_log "censored". - provision-wong-host.yml: spaceship-earth only. Grows the root partition, PV and LV/filesystem with growpart + community.general.lvg/lvol; idempotent (second run changed=0). Then applies obsidian_headless. - roles/obsidian_headless: Obsidian's official headless Sync client (obsidian-headless 0.0.14) as system user obsync under a sandboxed systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/ and wip/ obsync-only, inbox/ granted to multica via access + default ACLs, vault root traverse-only. Verifies the isolation as multica. Sign-in to Obsidian Sync stays manual (see the role README). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
40 lines
1.3 KiB
YAML
40 lines
1.3 KiB
YAML
---
|
|
- name: Install | Read the installed client version
|
|
ansible.builtin.slurp:
|
|
src: "{{ obsidian_headless_npm_prefix }}/lib/node_modules/obsidian-headless/package.json"
|
|
register: _obh_pkg
|
|
failed_when: false
|
|
|
|
- name: Install | Decide whether an install is needed
|
|
ansible.builtin.set_fact:
|
|
_obh_needs_install: >-
|
|
{{ _obh_pkg.content is not defined
|
|
or (_obh_pkg.content | b64decode | from_json).version != obsidian_headless_version }}
|
|
|
|
- name: Install | Install the pinned client as the service user
|
|
ansible.builtin.command:
|
|
argv:
|
|
- "{{ obsidian_headless_node_bin_dir }}/npm"
|
|
- install
|
|
- --global
|
|
- --prefix
|
|
- "{{ obsidian_headless_npm_prefix }}"
|
|
- --no-fund
|
|
- --no-audit
|
|
- "obsidian-headless@{{ obsidian_headless_version }}"
|
|
become: true
|
|
become_user: "{{ obsidian_headless_user }}"
|
|
environment:
|
|
HOME: "{{ obsidian_headless_home }}"
|
|
PATH: "{{ obsidian_headless_node_bin_dir }}:/usr/bin:/bin"
|
|
when: _obh_needs_install | bool
|
|
changed_when: true
|
|
notify: restart obsidian sync
|
|
|
|
- name: Install | Link ob onto the default PATH
|
|
ansible.builtin.file:
|
|
src: "{{ obsidian_headless_npm_prefix }}/bin/ob"
|
|
dest: "{{ obsidian_headless_link_dir }}/ob"
|
|
state: link
|
|
force: true
|