DmitryandClaude Opus 5
c676be81ec
Commit the accumulated infrastructure work that was living only in the working tree: monitoring stack, emergency access/bot, gyro allocator, grimmory, adguard, backup audit and the OpenCode agent definitions. Also ignore Python bytecode, local archives and Nix/direnv artifacts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTocXkGUUazHdKKd3r9k71
78 lines
2.1 KiB
YAML
78 lines
2.1 KiB
YAML
---
|
|
- name: Bootstrap emergency bot control identity
|
|
ansible.builtin.import_tasks: bootstrap.yml
|
|
|
|
- name: Validate emergency bot inputs
|
|
ansible.builtin.assert:
|
|
that:
|
|
- emergency_bot_token is match('^[0-9]+:[A-Za-z0-9_-]+$')
|
|
- emergency_bot_allowed_user_ids is match('^[0-9]+(,[0-9]+)*$')
|
|
- emergency_mini_pc_host_key is match('^ssh-(ed25519|rsa|ecdsa-[^ ]+) [A-Za-z0-9+/=]+( [A-Za-z0-9@._:-]+)?$')
|
|
fail_msg: Set EMERGENCY_BOT_TOKEN, EMERGENCY_ALLOWED_USER_IDS and EMERGENCY_MINI_PC_HOST_KEY.
|
|
no_log: true
|
|
|
|
- name: Install emergency bot dependencies
|
|
ansible.builtin.apt:
|
|
name:
|
|
- ca-certificates
|
|
- openssh-client
|
|
- python3
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Create emergency bot configuration directory
|
|
ansible.builtin.file:
|
|
path: "{{ emergency_bot_config_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Pin mini-pc SSH host key
|
|
ansible.builtin.copy:
|
|
dest: "{{ emergency_bot_state_dir }}/known_hosts"
|
|
content: "mini-pc-emergency {{ emergency_mini_pc_host_key }}\n"
|
|
owner: "{{ emergency_bot_user }}"
|
|
group: "{{ emergency_bot_user }}"
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Install emergency bot runtime
|
|
ansible.builtin.template:
|
|
src: emergency_bot.py.j2
|
|
dest: /usr/local/libexec/emergency-bot
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
notify: Restart emergency bot
|
|
|
|
- name: Install emergency bot environment
|
|
ansible.builtin.template:
|
|
src: emergency-bot.env.j2
|
|
dest: "{{ emergency_bot_config_dir }}/bot.env"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
notify: Restart emergency bot
|
|
|
|
- name: Install emergency bot systemd unit
|
|
ansible.builtin.template:
|
|
src: emergency-bot.service.j2
|
|
dest: /etc/systemd/system/emergency-bot.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify:
|
|
- Reload systemd
|
|
- Restart emergency bot
|
|
|
|
- name: Enable and start emergency bot
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: Enable and start emergency bot
|
|
ansible.builtin.systemd_service:
|
|
name: emergency-bot.service
|
|
enabled: true
|
|
state: started
|