JARVISandClaude Opus 5.5
15aeb8e222
- provision-agent-host.yml: multica_pat now comes from vault_multica_pats[inventory_hostname_short], one daemon-<host> token per host. A pre_task asserts the key exists (never prints the value) so a missing entry fails by host name instead of as a no_log "censored". - provision-wong-host.yml: spaceship-earth only. Grows the root partition, PV and LV/filesystem with growpart + community.general.lvg/lvol; idempotent (second run changed=0). Then applies obsidian_headless. - roles/obsidian_headless: Obsidian's official headless Sync client (obsidian-headless 0.0.14) as system user obsync under a sandboxed systemd unit with UMask=0077. Vault at /srv/obsidian/vault: everpure/ and wip/ obsync-only, inbox/ granted to multica via access + default ACLs, vault root traverse-only. Verifies the isolation as multica. Sign-in to Obsidian Sync stays manual (see the role README). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.3 KiB
Django/Jinja
35 lines
1.3 KiB
Django/Jinja
# {{ ansible_managed }}
|
|
[Unit]
|
|
Description=Obsidian Headless Sync ({{ obsidian_headless_vault_path }})
|
|
Documentation=https://obsidian.md/help/sync/headless
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
# Inert until `ob login` and `ob sync-setup` have been run by hand.
|
|
ConditionPathExists={{ obsidian_headless_home }}/.config/obsidian-headless/auth_token
|
|
ConditionDirectoryNotEmpty={{ obsidian_headless_home }}/.config/obsidian-headless/sync
|
|
|
|
[Service]
|
|
Type=simple
|
|
User={{ obsidian_headless_user }}
|
|
Group={{ obsidian_headless_group }}
|
|
# Everything Sync creates is private unless it lands under a folder with a
|
|
# default ACL (the shared folders), where the umask does not apply.
|
|
UMask=0077
|
|
Environment=HOME={{ obsidian_headless_home }}
|
|
Environment=PATH={{ obsidian_headless_node_bin_dir }}:/usr/bin:/bin
|
|
WorkingDirectory={{ obsidian_headless_vault_path }}
|
|
ExecStart={{ obsidian_headless_link_dir }}/ob sync --continuous --path {{ obsidian_headless_vault_path }}
|
|
Restart=on-failure
|
|
RestartSec=30
|
|
# 2: missing encryption key, 3: no sync configuration. Both need a human.
|
|
RestartPreventExitStatus=2 3
|
|
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ReadWritePaths={{ obsidian_headless_vault_path }} {{ obsidian_headless_home }}
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|