infra/ansible/playbooks/bootstrap-dashboard-pve-token.yml

---
# ============================================================================
# Выпуск read-only Proxmox-токена для виджета Proxmox в Homepage-дашборде.
#
# Создаёт пользователя homepage@pve, роль PVEAuditor на / и privsep-токен
# homepage@pve!dashboard. Секрет пишется в КОРНЕВОЙ .env как
# DASHBOARD_PVE_API_USER / DASHBOARD_PVE_API_TOKEN_ID /
# DASHBOARD_PVE_API_TOKEN_SECRET — оттуда его читает playbooks/dashboard.yml
# через lookup('env', ...).
#
# Парный к playbooks/bootstrap-monitoring-pve-token.yml. Отдельный принципал,
# чтобы дашборд не зависел от кредов замороженного стека Prometheus.
#
# Запуск: make bootstrap-dashboard-token
# ============================================================================
- name: Create read-only Proxmox token for the Homepage dashboard
  hosts: mini-pc
  gather_facts: false
  vars:
    dashboard_pve_user: homepage@pve
    dashboard_pve_token_id: dashboard
    # .env лежит в корне репозитория, playbook_dir — это ansible/playbooks.
    dashboard_pve_env_file: "{{ playbook_dir }}/../../.env"
    dashboard_pve_rotate_existing_token: false
  tasks:
    - name: Read existing Proxmox users
      ansible.builtin.command: pveum user list --output-format json
      register: dashboard_pve_users_raw
      changed_when: false

    - name: Create the dashboard Proxmox user
      ansible.builtin.command: >-
        pveum user add {{ dashboard_pve_user }}
        --comment 'Read-only Homepage dashboard user'
      when: dashboard_pve_user not in (dashboard_pve_users_raw.stdout | from_json | map(attribute='userid') | list)

    - name: Grant PVEAuditor role to the dashboard user
      ansible.builtin.command: >-
        pveum acl modify / -user {{ dashboard_pve_user }} -role PVEAuditor
      changed_when: false

    - name: Read the dashboard user tokens
      ansible.builtin.command: >-
        pveum user token list {{ dashboard_pve_user }} --output-format json
      register: dashboard_pve_tokens_raw
      changed_when: false

    - name: Refuse to overwrite an existing dashboard token
      ansible.builtin.assert:
        that:
          - dashboard_pve_token_id not in (dashboard_pve_tokens_raw.stdout | from_json | map(attribute='tokenid') | list)
        fail_msg: >-
          Existing dashboard token secret cannot be recovered safely. Rotate it
          explicitly (-e dashboard_pve_rotate_existing_token=true) before rerunning.
      when: not dashboard_pve_rotate_existing_token | bool

    - name: Rotate the existing dashboard token explicitly
      ansible.builtin.command: >-
        pveum user token remove {{ dashboard_pve_user }} {{ dashboard_pve_token_id }}
      when:
        - dashboard_pve_rotate_existing_token | bool
        - dashboard_pve_token_id in (dashboard_pve_tokens_raw.stdout | from_json | map(attribute='tokenid') | list)

    - name: Create the separated dashboard token
      ansible.builtin.command: >-
        pveum user token add {{ dashboard_pve_user }} {{ dashboard_pve_token_id }}
        --privsep 1 --comment 'Homepage Proxmox widget' --output-format json
      register: dashboard_pve_token_created
      no_log: true

    - name: Grant PVEAuditor role to the separated dashboard token
      ansible.builtin.command: >-
        pveum acl modify / -token {{ dashboard_pve_user }}!{{ dashboard_pve_token_id }} -role PVEAuditor
      changed_when: false

    - name: Store the dashboard token variables in the root .env
      ansible.builtin.lineinfile:
        path: "{{ dashboard_pve_env_file }}"
        regexp: "^export {{ item.name }}="
        line: "export {{ item.name }}='{{ item.value }}'"
        create: false
      loop:
        - name: DASHBOARD_PVE_API_USER
          value: "{{ dashboard_pve_user }}"
        - name: DASHBOARD_PVE_API_TOKEN_ID
          value: "{{ dashboard_pve_token_id }}"
        - name: DASHBOARD_PVE_API_TOKEN_SECRET
          value: "{{ (dashboard_pve_token_created.stdout | from_json).value }}"
      delegate_to: localhost
      vars:
        ansible_connection: local
        ansible_become: false
      no_log: true