From e17b469ea8c7da8e01e3a4979c5009e3bc1ef7d5 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sat, 20 Dec 2025 23:19:11 -0700 Subject: [PATCH 01/27] feat: migrate from aap-libvirt-infra - Update repo references to ansible-project-libvirt - Rename AAP resources from libvirt-infra to libvirt - Use ghcr.io/makeitworkcloud/runner:latest container - Update ansible-lint to v25.12.1 - Add community.sops to requirements.yml - Remove deprecated jinja2_native from ansible.cfg - Exclude playbooks/ and vars/ from ansible-lint (vault-encrypted) --- .github/workflows/check.yml | 33 ++ .github/workflows/deploy.yml | 32 ++ .gitignore | 4 + .pre-commit-config.yaml | 18 + .sops.yaml | 3 + LICENSE | 674 +++++++++++++++++++++++++++++++++ Makefile | 4 + ansible.cfg | 2 + cd/setup_aap_project.yml | 267 +++++++++++++ playbooks/configure_runner.yml | 108 ++++++ playbooks/configure_torwww.yml | 222 +++++++++++ requirements.yml | 4 + scripts/vault.bash | 2 + secrets/secrets.yaml | 23 ++ vars/configure_runner.yml | 13 + vars/configure_torwww.yml | 9 + 16 files changed, 1418 insertions(+) create mode 100644 .github/workflows/check.yml create mode 100644 .github/workflows/deploy.yml create mode 100644 .gitignore create mode 100644 .pre-commit-config.yaml create mode 100644 .sops.yaml create mode 100644 LICENSE create mode 100644 Makefile create mode 100644 ansible.cfg create mode 100755 cd/setup_aap_project.yml create mode 100755 playbooks/configure_runner.yml create mode 100755 playbooks/configure_torwww.yml create mode 100644 requirements.yml create mode 100755 scripts/vault.bash create mode 100644 secrets/secrets.yaml create mode 100644 vars/configure_runner.yml create mode 100644 vars/configure_torwww.yml diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml new file mode 100644 index 0000000..18e09c7 --- /dev/null +++ b/.github/workflows/check.yml @@ -0,0 +1,33 @@ +name: Check + +on: + pull_request: + branches: + - main + workflow_dispatch: + +permissions: + contents: read + pull-requests: write + +jobs: + check: + name: Pre-commit & Ansible Check + runs-on: ubuntu-latest + container: + image: ghcr.io/makeitworkcloud/runner:latest + env: + SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }} + ANSIBLE_VAULT_PASSWORD_FILE: ./scripts/vault.bash + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Install Ansible collections + run: ansible-galaxy collection install -r requirements.yml + + - name: Run pre-commit + run: pre-commit run --all-files + + - name: Check AAP deployment (dry-run) + run: ansible-playbook cd/setup_aap_project.yml --check --diff diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 0000000..d467aca --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,32 @@ +name: Deploy + +on: + push: + branches: + - main + workflow_dispatch: + +permissions: + contents: read + +jobs: + deploy: + name: Deploy AAP Content + runs-on: ubuntu-latest + container: + image: ghcr.io/makeitworkcloud/runner:latest + env: + SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }} + ANSIBLE_VAULT_PASSWORD_FILE: ./scripts/vault.bash + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Install Ansible collections + run: ansible-galaxy collection install -r requirements.yml + + - name: Run pre-commit + run: pre-commit run --all-files + + - name: Deploy AAP Content + run: ansible-playbook cd/setup_aap_project.yml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d17f39f --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +**/*.ansible +**/*.swp +**/*.log +**/1 \ No newline at end of file diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..0347558 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,18 @@ +repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v6.0.0 + hooks: + - id: check-case-conflict + - id: check-merge-conflict + - id: check-symlinks + - id: check-vcs-permalinks + - id: destroyed-symlinks + - id: detect-private-key + - id: mixed-line-ending + - repo: https://github.com/ansible/ansible-lint + rev: v25.12.1 + hooks: + - id: ansible-lint + additional_dependencies: + - ansible + args: [--exclude=secrets/, --exclude=vars/, --exclude=playbooks/] diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..8967c45 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,3 @@ +--- +creation_rules: + - age: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..f288702 --- /dev/null +++ b/LICENSE @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..4c97067 --- /dev/null +++ b/Makefile @@ -0,0 +1,4 @@ +ANSIBLE_VAULT_PASSWORD_FILE := "./scripts/vault.bash" + +commit: + @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) git commit \ No newline at end of file diff --git a/ansible.cfg b/ansible.cfg new file mode 100644 index 0000000..e9bb3ed --- /dev/null +++ b/ansible.cfg @@ -0,0 +1,2 @@ +[defaults] +deprecation_warnings = False diff --git a/cd/setup_aap_project.yml b/cd/setup_aap_project.yml new file mode 100755 index 0000000..c70a52b --- /dev/null +++ b/cd/setup_aap_project.yml @@ -0,0 +1,267 @@ +#!/usr/bin/env ansible-playbook +# File: setup_aap_project.yml +# GitHub: https://github.com/makeitworkcloud/ansible-project-libvirt +# Description: This playbook creates the libvirt project in Ansible Automation Platform (AAP). +# Notes: +# - The instance being managed has issues registering Automation Hub with the Hybrid Cloud Console. +# The proprietary Red Hat AAP collection(s) cannot be imported or registered for usage. +# - The awx.awx collection automatically appends `/api/v2` to the endpoint, which does not work with AAP. +# The default Ansible Controller endpoint is `/api/controller/v2`. +# Therefore, the ansible.builtin.uri module is used instead. +# - Thanks, Red Hat. +# Author: +# _| +# _| _| _|_|_| _|_| _|_|_|_| _|_| +# _|_| _| _| _| _| _| _| _| +# _| _| _| _| _| _| _| _| _| +# _| _| _| _| _|_| _|_| _|_| +--- +- name: Load SOPS values + hosts: localhost + gather_facts: false + tasks: + - name: Load vars task + community.sops.load_vars: + file: ../secrets/secrets.yaml + +- name: Deploy AAP content via API + hosts: localhost + tasks: + - name: Create libvirt project + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/projects/" + method: POST + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + body_format: json + body: + name: "libvirt" + description: "Created via URI module" + scm_type: "git" + scm_url: "https://github.com/makeitworkcloud/ansible-project-libvirt.git" + organization: 1 + status_code: + - 201 + - 400 + register: project_result + + - name: Get project if POST failed + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/projects/?name=libvirt&organization=1" + method: GET + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + status_code: 200 + register: project_get + + - name: Trigger Project Sync (Update) + ansible.builtin.uri: + url: >- + {{ 'https://' ~ hostvars['localhost']['controller_host'] ~ '/api/controller/v2/projects/' + ~ project_get.json.results[0].id ~ '/update/' }} + method: POST + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + body_format: json + headers: + Content-Type: "application/json" + status_code: 202 + return_content: true + register: sync_result + + - name: Create Inventory + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/inventories/" + method: POST + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + body_format: json + body: + name: "libvirt" + description: "Created via REST API" + organization: "1" + status_code: + - 201 + - 400 + register: inventory_result + + - name: Get inventory id + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/inventories/?name=libvirt&organization=1" + method: GET + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + status_code: 200 + register: inventory_get + + - name: Add host to inventory + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/hosts/" + method: POST + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + body_format: json + body: + name: "{{ hostvars['localhost']['libvirt_host'] }}" + inventory: "{{ inventory_result.json.id | default }}" + variables: | + ansible_host: {{ hostvars['localhost']['libvirt_fqdn'] }} + status_code: + - 201 + - 400 + validate_certs: false + register: host_result + + - name: Create Machine Credential (SSH key) in AAP + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/credentials/" + method: POST + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + body_format: json + body: + name: "libvirt SSH" + description: "https://github.com/makeitworkcloud/ansible-project-libvirt/" + credential_type: "1" + organization: "1" + inputs: + username: "{{ hostvars['localhost']['libvirt_ssh_user'] }}" + ssh_key_data: "{{ hostvars['localhost']['libvirt_ssh_private_key'] }}" + status_code: + - 201 + - 400 + validate_certs: false + register: cred_result + + - name: Get machine credential id + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/credentials/?name=libvirt%20SSH&organization=1&credential_type=1" + method: GET + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + status_code: 200 + register: cred_get + + - name: Create Vault Credential in AAP + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/credentials/" + method: POST + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + body_format: json + body: + name: "libvirt Vault" + description: "Credential for unlocking Ansible Vault files" + credential_type: "3" + organization: "1" + inputs: + vault_password: "{{ hostvars['localhost']['vault_password'] }}" + status_code: + - 201 + - 400 + validate_certs: false + register: vault_cred_result + + - name: Get vault credential id + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/credentials/?name=libvirt%20Vault&organization=1&credential_type=3" + method: GET + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + status_code: 200 + register: vault_cred_get + + - name: Find all files in playbooks/ directory + ansible.builtin.find: + paths: ../playbooks/ + file_type: file + patterns: '*.yml,*.yaml' + recurse: false + register: found_playbooks + + - name: Create job templates for each playbook + ansible.builtin.uri: + url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/job_templates/" + method: POST + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + body_format: json + body: + name: "{{ item.path | basename | regex_replace('\\.yml$', '') }}" + description: "Job template for {{ item.path | basename }}" + job_type: "run" + inventory: "{{ inventory_get.json.results[0].id | int }}" + project: "{{ project_get.json.results[0].id | int }}" + playbook: "playbooks/{{ item.path | basename }}" + organization: "1" + status_code: + - 201 + - 400 + loop: "{{ found_playbooks.files }}" + register: job_template_results + + - name: Get job template ids + ansible.builtin.uri: + url: >- + {{ 'https://' ~ hostvars['localhost']['controller_host'] ~ '/api/controller/v2/job_templates/?name=' + ~ (item.path | basename | regex_replace('\.yml$', '')) ~ '&organization=1' }} + method: GET + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + status_code: 200 + loop: "{{ found_playbooks.files }}" + loop_control: + extended: true + register: job_template_gets + + - name: Attach Machine credential to job template + ansible.builtin.uri: + url: >- + {{ 'https://' ~ hostvars['localhost']['controller_host'] ~ '/api/controller/v2/job_templates/' + ~ job_template_gets.results[ansible_loop.index0].json.results[0].id ~ '/credentials/' }} + method: POST + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + body_format: json + body: + id: "{{ cred_get.json.results[0].id | int }}" + status_code: + - 204 + - 400 + register: attach_cred + loop: "{{ found_playbooks.files }}" + loop_control: + extended: true + + - name: Attach Vault credential to job template + ansible.builtin.uri: + url: >- + {{ 'https://' ~ hostvars['localhost']['controller_host'] ~ '/api/controller/v2/job_templates/' + ~ job_template_gets.results[ansible_loop.index0].json.results[0].id ~ '/credentials/' }} + method: POST + user: "{{ hostvars['localhost']['controller_username'] }}" + password: "{{ hostvars['localhost']['controller_password'] }}" + force_basic_auth: true + body_format: json + body: + id: "{{ vault_cred_get.json.results[0].id | int }}" + status_code: + - 204 + - 400 + register: attach_vault_cred + loop: "{{ found_playbooks.files }}" + loop_control: + extended: true diff --git a/playbooks/configure_runner.yml b/playbooks/configure_runner.yml new file mode 100755 index 0000000..a041180 --- /dev/null +++ b/playbooks/configure_runner.yml @@ -0,0 +1,108 @@ +#!/usr/bin/env ansible-playbook +# File: configure_runner.yml +# GitHub: https://github.com/makeitworkcloud/ansible-project-libvirt/playbooks/configure_runner.yml +# Description: This playbook configures a pre-provisioned GitHub Actions runner. +# Author: +# _| +# _| _| _|_|_| _|_| _|_|_|_| _|_| +# _|_| _| _| _| _| _| _| _| +# _| _| _| _| _| _| _| _| _| +# _| _| _| _| _|_| _|_| _|_| +--- +- name: Configure a pre-provisioned GitHub Actions runner + hosts: runner + gather_facts: false + vars_files: + - ../vars/configure_runner.yml + tasks: + - name: Wait for port 22 to be open on the runner + ansible.builtin.wait_for: + host: "{{ runner_ipv4_addr }}" + port: 22 + timeout: 300 + state: started + delegate_to: "{{ libvirt_host }}" + + - name: Get latest GitHub Actions runner version + ansible.builtin.uri: + url: https://api.github.com/repos/actions/runner/releases/latest + return_content: true + register: actions_runner_json_reponse + + - name: Get GitHub runner registration token + ansible.builtin.uri: + url: "https://api.github.com/orgs/{{ github_org }}/actions/runners/registration-token" + method: POST + headers: + Authorization: "Bearer {{ github_pat }}" + Accept: "application/vnd.github+json" + body_format: json + return_content: true + status_code: + - 200 + - 201 + register: github_runner_token + + - name: Set registration token fact + ansible.builtin.set_fact: + runner_registration_token: "{{ github_runner_token.json.token }}" + + - name: Download GitHub Actions runner + ansible.builtin.get_url: + url: >- + {{ 'https://github.com/actions/runner/releases/download/' ~ actions_runner_json_reponse.json.tag_name + ~ '/actions-runner-linux-x64-' ~ actions_runner_json_reponse.json.tag_name[1:] ~ '.tar.gz' }} + dest: "/home/{{ runner_ssh_user }}/actions-runner-linux-x64-{{ actions_runner_json_reponse.json.tag_name[1:] }}.tar.gz" + owner: "{{ runner_ssh_user }}" + mode: '0644' + + - name: Create actions-runner directory + ansible.builtin.file: + path: "/home/{{ runner_ssh_user }}/actions-runner" + state: directory + owner: "{{ runner_ssh_user }}" + group: "{{ runner_ssh_user }}" + mode: '0755' + + - name: Extract GitHub Actions runner + ansible.builtin.unarchive: + src: "/home/{{ runner_ssh_user }}/actions-runner-linux-x64-{{ actions_runner_json_reponse.json.tag_name[1:] }}.tar.gz" + dest: "/home/{{ runner_ssh_user }}/actions-runner" + remote_src: true + owner: "{{ runner_ssh_user }}" + + - name: Set random id string + ansible.builtin.set_fact: + random_id: "{{ lookup('community.general.random_string', length=4, numbers=false, special=false) }}" + + - name: Configure GitHub Actions runner + ansible.builtin.shell: + cmd: | + ./config.sh --name libvirt-{{ random_id }} \ + --unattended --labels libvirt --url https://github.com/{{ github_org }} --token {{ runner_registration_token }} + chdir: "/home/{{ runner_ssh_user }}/actions-runner" + creates: "/home/{{ runner_ssh_user }}/actions-runner/.runner" + changed_when: true + + - name: Install GitHub Actions runner as a service + ansible.builtin.command: + cmd: | + ./svc.sh install + chdir: "/home/{{ runner_ssh_user }}/actions-runner" + creates: "/etc/systemd/system/actions.runner.{{ github_org }}.libvirt-*.service" + become: true + changed_when: true + + - name: Disable SELinux + ansible.posix.selinux: + state: disabled + become: true + notify: Reboot the runner to apply SELinux changes + + handlers: + - name: Reboot the runner to apply SELinux changes + ansible.builtin.reboot: + msg: "Rebooting to apply SELinux changes" + pre_reboot_delay: 10 + reboot_timeout: 300 + become: true diff --git a/playbooks/configure_torwww.yml b/playbooks/configure_torwww.yml new file mode 100755 index 0000000..6c5cbad --- /dev/null +++ b/playbooks/configure_torwww.yml @@ -0,0 +1,222 @@ +#!/usr/bin/env ansible-playbook +# File: configure_torwww.yml +# GitHub: https://github.com/makeitworkcloud/ansible-project-libvirt/playbooks/configure_torwww.yml +# Description: This playbook configures a pre-provisioned Onion web mirror. +# Author: +# _| +# _| _| _|_|_| _|_| _|_|_|_| _|_| +# _|_| _| _| _| _| _| _| _| +# _| _| _| _| _| _| _| _| _| +# _| _| _| _| _|_| _|_| _|_| +--- +- name: Configure a pre-provisioned Onion web mirror + hosts: torwww + gather_facts: false + vars_files: + - ../vars/configure_torwww.yml + tasks: + - name: Wait for port 22 to be open on the node + ansible.builtin.wait_for: + host: "{{ torwww_ipv4_addr }}" + port: 22 + timeout: 300 + state: started + delegate_to: "{{ libvirt_host }}" + + - name: Wait for user nginx to be created on the node + ansible.builtin.wait_for: + path: /etc/passwd + search_regex: "^nginx:" + timeout: 300 + + - name: Propagate /var/www + ansible.builtin.file: + path: /var/www + state: directory + owner: nginx + group: nginx + mode: "0755" + become: true + + - name: Propagate /var/www/html + ansible.builtin.file: + path: /var/www/html + state: directory + owner: nginx + group: nginx + mode: "0755" + become: true + + - name: Change server in /etc/nginx/nginx.conf + ansible.builtin.lineinfile: + path: /etc/nginx/nginx.conf + regexp: "^ listen 80;$" + line: " listen 127.0.0.1:80;" + become: true + + - name: Remove IPV6 in /etc/nginx/nginx.conf + ansible.builtin.lineinfile: + path: /etc/nginx/nginx.conf + regexp: "^ listen [::]:80;" + state: absent + become: true + + - name: Change web dir in /etc/nginx/nginx.conf + ansible.builtin.lineinfile: + path: /etc/nginx/nginx.conf + regexp: "^ root /usr/share/nginx/html;" + line: " root /var/www/html;" + become: true + + - name: Copy git config file + ansible.builtin.copy: + content: | + location ~ /\. { + deny all; + } + dest: /etc/nginx/default.d/git.conf + owner: nginx + group: nginx + mode: "0644" + become: true + + - name: Clone git repo + ansible.builtin.git: + repo: https://github.com/makeitworkcloud/www.git + dest: /var/www/html + version: main + become: true + become_user: nginx + + - name: Cronjob to sync repo + ansible.builtin.cron: + name: "git-clone" + minute: "*/15" + user: nginx + job: "cd /var/www/html && git pull" + become: true + + - name: Start & Enable nginx + ansible.builtin.systemd: + name: nginx.service + state: started + enabled: true + become: true + + - name: Start & Enable warp-svc service + ansible.builtin.systemd: + name: warp-svc.service + enabled: true + state: started + become: true + + - name: Register WARP, accept TOS and connect + ansible.builtin.expect: + command: bash -c 'warp-cli registration new && warp-cli connect' + responses: + 'Accept Terms of Service and Privacy Policy\? \[y/N\] ': 'y' + timeout: 30 + echo: false + changed_when: false + become: true + become_user: "{{ torwww_username }}" + register: warp_register + failed_when: warp_register.rc != 0 and 'Old registration is still around' not in warp_register.stdout + + - name: Verify WARP is on + ansible.builtin.uri: + url: "https://cloudflare.com/cdn-cgi/trace" + return_content: true + register: cloudflare_trace + until: "'warp=on' in cloudflare_trace.content" + retries: 10 + delay: 1 + + - name: Enable ControlPort + ansible.builtin.lineinfile: + path: "/etc/tor/torrc" + regexp: "^#ControlPort 9051$" + line: "ControlPort 9051" + become: true + + - name: Enable HiddenServiceDir + ansible.builtin.lineinfile: + path: "/etc/tor/torrc" + line: "HiddenServiceDir /var/lib/tor/hidden_service/" + state: present + insertafter: "^############### This section is just for location-hidden services ###$" + become: true + + - name: Define HiddenServiceVersion + ansible.builtin.lineinfile: + path: "/etc/tor/torrc" + line: "HiddenServiceVersion 3" + state: present + insertafter: "^HiddenServiceDir /var/lib/tor/hidden_service/$" + become: true + + - name: Enable Web HiddenServicePort + ansible.builtin.lineinfile: + path: "/etc/tor/torrc" + line: "HiddenServicePort 80 127.0.0.1:80" + state: present + insertafter: "^HiddenServiceVersion 3$" + become: true + + - name: Ensure tor.service.d directory exists + ansible.builtin.file: + path: /etc/systemd/system/tor.service.d + state: directory + owner: root + group: root + mode: '0755' + become: true + + - name: Ensure tor.service starts after warp-svc.service + ansible.builtin.copy: + dest: /etc/systemd/system/tor.service.d/override.conf + content: | + [Unit] + After=warp-svc.service + Requires=warp-svc.service + owner: root + group: root + mode: '0644' + become: true + + - name: Reload systemd daemon + ansible.builtin.systemd: + daemon_reload: true + become: true + + - name: "Start & Enable Tor" + ansible.builtin.systemd: + name: tor.service + state: started + enabled: true + become: true + + - name: Get Onion address + ansible.builtin.command: + cmd: cat /var/lib/tor/hidden_service/hostname + changed_when: false + become: true + register: onion_address + + - name: Show Onion address + ansible.builtin.debug: + var: onion_address.stdout + + - name: Disable SELinux + ansible.posix.selinux: + state: disabled + become: true + notify: Reboot the node to apply SELinux changes + + handlers: + - name: Reboot the node to apply SELinux changes + ansible.builtin.reboot: + msg: "Rebooting to apply SELinux changes" + pre_reboot_delay: 10 + reboot_timeout: 300 + become: true diff --git a/requirements.yml b/requirements.yml new file mode 100644 index 0000000..5f9cd11 --- /dev/null +++ b/requirements.yml @@ -0,0 +1,4 @@ +collections: + - name: community.general + - name: community.sops + - name: ansible.posix diff --git a/scripts/vault.bash b/scripts/vault.bash new file mode 100755 index 0000000..4391e5d --- /dev/null +++ b/scripts/vault.bash @@ -0,0 +1,2 @@ +#!/bin/bash +sops decrypt secrets/secrets.yaml | grep vault_password | awk '{print $2}' diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml new file mode 100644 index 0000000..c4bc66c --- /dev/null +++ b/secrets/secrets.yaml @@ -0,0 +1,23 @@ +vault_password: ENC[AES256_GCM,data:CNFW2c9Y26eImiDduRUBbOVTggk=,iv:MRRmWL5+tJ2Yv6CkX9feyAd5Pe4FJMbD98jqXsQs7xE=,tag:uaqcUGJhvNX1Rw2yjmn41g==,type:str] +controller_host: ENC[AES256_GCM,data:M1oOw6X/4BPlplB7coKjP5PfyAS8ZAi9,iv:cDOEgnmH7Bcnxg5v2l8KEmUeQ4ZIg4QRoZuTcGhqDxQ=,tag:WhhA873zfHJrcPOwHQOVnw==,type:str] +controller_username: ENC[AES256_GCM,data:zqw1fj0=,iv:Mnp84xLIJ4rl3MBzGLSDyle1Cy/lmmQ212Wna4yPBHc=,tag:hTivFUQz4k+UoH+FhHfclQ==,type:str] +controller_password: ENC[AES256_GCM,data:5JmX70D+/KJjcDM49HWFkfzHN/9GND2qJ7WPFr1Vrqk=,iv:1dJii9AQam1Tttr4jDpx0+OUJ3ps7IbOuKEF8+ZU4uk=,tag:IDdUm42jG6sqLU6g79N+4g==,type:str] +libvirt_host: ENC[AES256_GCM,data:HXioDg==,iv:MECYKMEvoy/ahuuVP06BagecSMlY3KysD9zIg2MmBKE=,tag:TTxXzZDaSsoQJlkGnURSvw==,type:str] +libvirt_fqdn: ENC[AES256_GCM,data:/IoHo3W+Jcv5iSK84V+Ut6HTN8tD,iv:NX4qcZTdTfaYkfeFAeHjUri/5KQaerj/3VrAp5eIPuE=,tag:qSB09jDpbGyqs3avbTViJg==,type:str] +libvirt_ssh_user: ENC[AES256_GCM,data:dLVEkA==,iv:EOaggoFjXDlqcNlktXYYZL2XIwXp0y146FykZbXY4UQ=,tag:MacD95SeEMD8uxYKzO/NJQ==,type:str] +libvirt_ssh_private_key: ENC[AES256_GCM,data:mOyTfMDUdiqXfZ0bCmGUM6UpHkZIEDpnlxlrH0n4JrKFbjv8qs4SfOQfPNeZLV0PNGpwbdESYW/gKozfUohHrLdJxtp55896w+8K+fQa/oUIRwh8WZsxO8kxW6+CUIInt5/uEOf5TqR4xyJ7dFTkqhZ4qfs32e6fDNQed2N64x7etNm+dcncvP4JLGCu3rGb1fzg9aeG4ktg4s1MzP7/VCm9PiQe1GOM9ZdZAEu6iVRFO4AIcKdsT60BoY5ijeU8cchEwaudPWDYEHernBQHXteAgPBy82x+AjQX5E/ckty248Zy2oQeBvd/5PyBbHRcNGnRrxXw/XeTcS0bF6dROHFBn3XKl5ZVdkXeAbpM6hewdYNj2A3wwtb9bXFstoIpSFYjcnZD48plUZ7OdH0SM5y95KyK8UZRFqGkYynbpFBlTRPWB0QJFnSHBNwt/ZZgGHSf14QTCdTEsAFmGaBGf6psI/nB5eu/skIXenWvhJ85byDx8s95zH8b2aCii+Ov6s5wEf9gqUjQrfLgfsZ4RD14r45pFIcNSPir1XNDGdD5FYpdBwY1o6DntHj9+WX46MgQfKNqraVWQl2owQzdfI8jB5+5GFZnm/tCAZ58V02emKUBwgQxT8o3WkaSii1E4bkwjGEWgaDWC04KAU4DAQYqolgZ+EIVrC90UW86fFife+a8ZI+MFEXq8h7FRS5R15tzaUyKjaimdGD7jD80iovMRh76uaNXZ4oCMxbUBG9gUR+s7vXoLOSJJo7kwIfS9M7lUPCpgN8rybe+KUFZZFwCQrcynIRjrCOY1Usqux/T0Cmoqs+aDAsi7u4N7Pghc55s6D0tgZGHql79UPRKmsNC/i97sNMZREJnyFDu9lv7ighW4943xCJomiovyF6jmovFMhnoHL78PQPdFaFkt/vcI7QCD/OJO80FYXzSXhdfDU2sUuvx2oroVE2/oOMwKzVRNg6KO1s1jRgUJrbmP/uIQeUkgqeMPzDr/GZTKSYcc8waTkM+4WSx4/FEbQVJBuWXwqCzW5FZeRfy1OoLNHamG57d6hTLwHvX3OG2b/Q88ex3l0BWYWJDdPzbUjfqs3B4Qi4O/zQD9mA0tamdJSKh4gNAtMKRKgjA10JUr2j7pR9uVghvpUscc+AWFjebJp13ZLlUdvM5pkCg9DXA1wk6F3hYXUaQr790yxZFnTztEljt4BeWWtNZOBjOqMn8lcXHhaMLEGeesRyOebAxcIkZrdor0Ku47mA2jhngV9evVIC/CT/qZt0LUHpJam3sPYaQTAmIEq18Jq7PvglesDLRSGLE9zC6Oj9OgNqmW+JcnFv/8anaQI8Rwfgv6odL2b/satNDx44HqDPfyRtythlSK1o2YCrTTlHDnqrUaOu847ebbEroKJ0WOJTqdmHsmrZFM2g4hLV6lHg+3dLrphbzluVDk70fY1UbnXKzX5KBqS5I0j/tOmFJu8++/QEIBCZiNBIb3j/Jj6PgbeNir7xS1H99eC23rUNHSux0SrMwKnj/lMOGty75CjuuRyMZ7eo9QVB0gUordz10UyQHzIYbYf0dXE8yZ6PhjoWOH8LSZZ47Gua5ns2XQzSQGSXDnwvoVNj7DrMtRGpT3wdBqruiQ44V4LlZqx1uOYKH7Tn6QjoLzYM4BGQ8btPHRgJ0sul9Qh/CKBZLmZOrlDKrHnF9tHwemaKjyvB+8mvkoKo9BG/1Ey/N0dhggSGfOeBt1NnU+xHxYs1D9RbzfjaZ8pLra+R7vOzpXjLxN8eQ0Is2VmWOjac6o0OTmZltfvS9+lUKFuwDKsGhSTOWgVNjU2PdPGWfmmu+3WpKvzlRq4FlYkfB0T0B6iJnv3wWSrVZ6m/1Ezynsu517hPrBJQDsJVsvXvR5+9J0g7BPsaYlrMW90B5rwQB4z8K+V+7x9to3Yyfvr4PldWYbayTWb2MMbw8jICkq9hkiBHpXMhlbV8oMQ9HUzw/Aee+WTQADzuk/4BPKZxCJ3mPDkphudVWQJZ/eQZaeXKLWlIdcQD0ZYO4XtnAVnXxFcpEEaAiE2VRldTWsFF/yYXY8z5ppFVAfLdBOu8dUiUJYq7861owcWEK6EjIpHtqpCJsWx/0QAWrx3zyAfbYv93jQXOylCdKddUq8XUyMP8+HTZu1BHVjELjS/ZUEzcU30gTV8hHGZcTAsdxOXGgU9E1g0nO9a6Bm9FX8a4wj+V2zhr+rCxjJQPeBmt9DeM4BQWW52VkSNGUY1h79L1UKxZcAtRaw6zhHAu4huNVLGdhZI1ccdOhT6SbwdkOsQLcPFYPz4CAdzyf/5+HRQbgSHzc5og9Dw6yj85Eg5o7ZcIN1ppdd9NqrTCTTu4tMG7B+/gb9kNOznLzCVLibbT+Tabun4OebwiYGTNVSPgXgD/pu2zMwItTYaQva3wqpewaqSjXH7PaVLavmFJaE60RqKdcaWgRCG9wGc+lFVgjNI7PmLGqD2NmTAgZMFCDj6ffYZEhL93oWeqnXNsCqhN7E/FSCbdQVqfrC0dcal/coxBFpZ28oNYYgyyt/YzF9kgrC1I6ecQqygBDq2Yv1kxgP26rXZEW91VcRSzKNUSxvpoP0N0R05Ex5S3IOUX3n/f0sH32Jk7AG354qKiQTLWf1G9c3x+724SKec6m5jnRJCi2riKE4CX5BxulAiGcm0+j3Rm3Uc9N1IYzkHyEyOrxes7KInmmLZpqmIjVJSIKRJKqNkG622pbL4Q3Q6oYpAmZemLHv2wZa0E2gss3z7CQHr/MGhWDsqVUaq5vzxTF0YRIi/+995WvzzmDVsurBfffgtSwYXwTElh8xIMZHnPNu5BQjTzKpME3W0Vg9q1quZ+joWfedyJSiTk1/ns7R9dNCYk4q/R5ynWljMzRZhjOQLwjJXFQe23lNC7FTVQYI7BJ9Wfiv/TH45Th4FkCkspaBunf3sbaYqsR2XjORtrv/zjF3WqvDewcyYlwHo4FrmjvZPfaZkRoWbaR5fl3DTcz5bIkIleUHlrqhhJfE4ThLQ0jnn3/Rq+xEytqGJ2CscUOoL100tTfwuoly1lanvm3CgT2wkQ1YOlfz/7xsGzYHL6bsT9g6Y/3HKxcWvSQCPTG1/FRjIf989uFmZW8gDtdiqoFz4oFgN9tIEr8gMQZuZ6IlXeFTpBVUAcUOrh6/JdoZNuD83/Ch9xFPcNCwHQjmmEzO6FiPBa9sCzw95/lni6RO+BoEDQcZNgAJfeIFBzTLGkW/L8qbIsAAIz2BsyaFKIkGbXZ6TH/wt1epXO4SSAVOsxr8w3E810sJGD1ZRsnpdPr5vlbTVX78wGg3pxrYNn7mMg/I1cAFGa6RTlPv65aXWfVbDNY8NgnmXp7nGw4UdXYevUcQjMGqqyqLoLMOyrbTb05WySJgNET4+AxU7T2Yg9wPONnEKb4GxiGh2HyikAuAj5YWy2g5dZ5SvS+h1cR3UEhFP3TW6BB0xUaQyifVraqln/Sb/B+3SF280RQynsOs5nZf8Ybg/E0UF8ac4srIcPOAtf1XW/wSUZ2wdE/+j6D8HMYe69qliKwlOS/GepBglsKcBFg8x2cMwabjZtu8Ces+DZOruCar/MPBA3KQubRnJacalGI/WFuXVFsLnh9jAoVPWOcIjrafBRlMcUOZKEtgoRpDg0ToimVN42LcWyGrJPEmnrZ49kD3uU340eSTLoOae1NSXPpaJmLLgDYIJC61S2/J/NCSntuiIGLj8WQ50a6XUHuPYR71wV2npb7BJtHeu2QvCenMe3QcmnVDVLhQlk0lXoy6AVlLEd8tcXWE/+DaMDn1JsD/E2M5WWGZt4oZvzXeJDIlt8XOoa8WX2YGFClI9q3qBTcQRNI67J/XvUmTMQJFIfOk6ETZWuvIplkhkCJnCqSaUwTvVLCEQZ3BYAKH11fcbBjl39KzvlN1L3+UGcFudNJS4ObJ9YKRtNi2zqMeKYbw3w+PcR1DYRi4HqadV11INbaOK+s2lONNizqrPbQisL87M17kkw/F5WsQT1IJVVLXl5V5kqscsNZ4u8qzYWGnxp2u2/M8q5Rz0ZJ84s/Kq27jx8t2YaRsWD45PfEBl2N7JIan79yWXauaE7G3lL+7n3Pb2o+lgTR/673k6rlYBKpVkPvQU6hy33yx2NocqFp5SlSXCxNTea6jltH2wjQlueOYZr7gkIfVQLjOIYmmHxNtu+/ofpWo5JyVukIb1XmM8lvHL80M8wAdvlhqZUIXOoGGp3MujMApyGqCR3oUUiP90Esc9UcjwV6GYRCbvbZAorfoFvbKleN7eZa/NjWu71CsGsStvlMtwN+7IbF4WYDxcGVrOXx9J0Ei09ubVZcfkkRs6wKUNL7PxKho37nbwbhUwDaAZpbd7/jH3uHYL6HpbQ7ez7E5NTqqS3A+i1NJFitGGd6zS2EYtONIziOgKs3PVhzbEzvTLvpZWaDZ1YLW9BqzXomyLxGBxmTglWca9wxeHwFiWT4FHHh0jQeRf20fu26,iv:gRWQHN+9pVAtlg5xJZhh80010gfDu7l1+NYfP6kGhjA=,tag:9+Rvs5RV7/N4mjANsh4yhQ==,type:str] +sops: + age: + - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqa1V4WGpuWGVlY2xMcVk5 + QlJFeHk3ZjdrcVpnRDFRSmlRQ2FTZnE4WTFRCjQ5UmRONDV3a2xTc3Mya0wvekN6 + RmJrQ09nZzk4VkZxRGlremcrUWU1Z2MKLS0tIHpFZFVpV3lpOUJNSDFwdDRpazJK + d2pVcDh3cDNqY1gzSVR5Z2NXcld1Qm8KRdv8vKhMBi1R8fGIphdmY4pfHV1sAqSb + nAXWA6Ut5/KAPIluSnBtWFkcakulcXYT01XorziztVS0X4nJDzEvMg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-09-25T20:50:28Z" + mac: ENC[AES256_GCM,data:DVHVZL9sxNoXOSv68dLTSN+MITN02VxtjE15JA2PVOP7X248EWOFExSuf++nv+/th6mOn8UxPnNbTLSbO0FXd+2kKsZx7LnWFguXk1IPTWtYLKvWPGLDK9tl4KoT3y0x/HjPvcog1zAotNXq4uYLhxw2hrQeVCw1xWjGYKewdRc=,iv:dOuaZL7p4UE2Jd9mn91yC3BhAV1315dtnLUJd0x4CBE=,tag:CThaqDxL+Voejy7ItokV+Q==,type:str] + unencrypted_suffix: _unencrypted + version: 3.10.2 diff --git a/vars/configure_runner.yml b/vars/configure_runner.yml new file mode 100644 index 0000000..30fbc66 --- /dev/null +++ b/vars/configure_runner.yml @@ -0,0 +1,13 @@ +$ANSIBLE_VAULT;1.1;AES256 +63643564643431623139336330326437663337383961353439376336616531323830333439633037 +3161656265333734303163633061353830386539663031620a643335613237376333653431396639 +64353761623361363230616237303339633030373033376566656434653231623965326462333634 +6564396165333363610a346363323138623737393538363665343230313761353263363332646564 +38373637373365326337353434356337626365623162663534613237346230346431326665346439 +36666635313865363161363136303531623435323665643865323731383131386130346530366131 +32353063643561653434303238653365326135383037326462313831323637623739393164356663 +61663363383338393563663834336564313934643061653336663230373036366434363663323134 +39623136313766383035616462333130393865613237653133653064363231353837323964616638 +36336366626261363531616633383363633332313962663937393536363664613838316537393833 +32636632343630373365383065653238383638326264353633383737643935653337656365326437 +61303964646234613931 diff --git a/vars/configure_torwww.yml b/vars/configure_torwww.yml new file mode 100644 index 0000000..fb2d6c5 --- /dev/null +++ b/vars/configure_torwww.yml @@ -0,0 +1,9 @@ +$ANSIBLE_VAULT;1.1;AES256 +61653865336663613134373330636330633063373163393264376139366238653832333161653161 +3062353137316431343762613438666637363139626136660a333539313264623430636465363366 +61663166326363366263323364656134663165363732363134626365656262393633616537326131 +3765323437343832300a363564646434323435373862653934393166623534303332393532616132 +64323837383235306365646463623832343764306261363934343436616266316538326463393632 +37623036333635623964356231356666303366333530326563363031386664313066306533613065 +61653935333162396464666134366461326533306235353632633936333561363661373636396366 +34386561633037373964 From e1479fb2edbe36297117a34effd646524a3936c3 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sat, 20 Dec 2025 23:23:57 -0700 Subject: [PATCH 02/27] fix: use system python for ansible-lint pre-commit hook Alpine 3.21 has Python 3.12, not 3.13 --- .pre-commit-config.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0347558..e61c8a6 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -13,6 +13,7 @@ repos: rev: v25.12.1 hooks: - id: ansible-lint + language_version: python3 additional_dependencies: - ansible args: [--exclude=secrets/, --exclude=vars/, --exclude=playbooks/] From 8c3f6b6226795099307cc9318f5ea713358eaaf5 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sat, 20 Dec 2025 23:27:16 -0700 Subject: [PATCH 03/27] fix: remove ansible-playbook --check from CI API-based playbook cannot dry-run - dependent variables undefined when tasks skip --- .github/workflows/check.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 18e09c7..2734275 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -12,7 +12,7 @@ permissions: jobs: check: - name: Pre-commit & Ansible Check + name: Pre-commit runs-on: ubuntu-latest container: image: ghcr.io/makeitworkcloud/runner:latest @@ -28,6 +28,3 @@ jobs: - name: Run pre-commit run: pre-commit run --all-files - - - name: Check AAP deployment (dry-run) - run: ansible-playbook cd/setup_aap_project.yml --check --diff From 0087338c174bee4f26ffdf6b74d7445b1155e0dc Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 08:02:39 -0700 Subject: [PATCH 04/27] refactor: replace URI calls with awx.awx collection modules - Rewrite setup playbook using awx.awx.project, inventory, host, credential, job_template - Move to .setup_project.yml (hidden from AAP playbook discovery) - Restore --check --diff in CI workflow - Add awx.awx to requirements.yml - Use CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX for AAP compatibility --- .github/workflows/check.yml | 5 +- .github/workflows/deploy.yml | 2 +- .setup_project.yml | 107 ++++++++++++++ cd/setup_aap_project.yml | 267 ----------------------------------- requirements.yml | 1 + 5 files changed, 113 insertions(+), 269 deletions(-) create mode 100644 .setup_project.yml delete mode 100755 cd/setup_aap_project.yml diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 2734275..44da64b 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -12,7 +12,7 @@ permissions: jobs: check: - name: Pre-commit + name: Pre-commit & Ansible Check runs-on: ubuntu-latest container: image: ghcr.io/makeitworkcloud/runner:latest @@ -28,3 +28,6 @@ jobs: - name: Run pre-commit run: pre-commit run --all-files + + - name: Check AAP deployment (dry-run) + run: ansible-playbook .setup_project.yml --check --diff diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index d467aca..575ccaf 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -29,4 +29,4 @@ jobs: run: pre-commit run --all-files - name: Deploy AAP Content - run: ansible-playbook cd/setup_aap_project.yml + run: ansible-playbook .setup_project.yml diff --git a/.setup_project.yml b/.setup_project.yml new file mode 100644 index 0000000..67cf9a4 --- /dev/null +++ b/.setup_project.yml @@ -0,0 +1,107 @@ +#!/usr/bin/env ansible-playbook +# File: .setup_project.yml +# GitHub: https://github.com/makeitworkcloud/ansible-project-libvirt +# Description: Creates the libvirt project in Ansible Automation Platform (AAP). +# Author: +# _| +# _| _| _|_|_| _|_| _|_|_|_| _|_| +# _|_| _| _| _| _| _| _| _| +# _| _| _| _| _| _| _| _| _| +# _| _| _| _| _|_| _|_| _|_| +--- +- name: Deploy AAP content + hosts: localhost + gather_facts: false + environment: + CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX: /api/controller/ + vars: + aap_project_name: libvirt + aap_organization: Default + module_defaults: + group/awx.awx.controller: + controller_host: "{{ controller_host }}" + controller_username: "{{ controller_username }}" + controller_password: "{{ controller_password }}" + validate_certs: true + pre_tasks: + - name: Load SOPS secrets + community.sops.load_vars: + file: secrets/secrets.yaml + + tasks: + - name: Create project + awx.awx.project: + name: "{{ aap_project_name }}" + description: "Managed by ansible-project-libvirt" + organization: "{{ aap_organization }}" + scm_type: git + scm_url: https://github.com/makeitworkcloud/ansible-project-libvirt.git + scm_update_on_launch: true + state: present + + - name: Sync project + awx.awx.project_update: + name: "{{ aap_project_name }}" + wait: true + timeout: 300 + + - name: Create inventory + awx.awx.inventory: + name: "{{ aap_project_name }}" + description: "Managed by ansible-project-libvirt" + organization: "{{ aap_organization }}" + state: present + + - name: Add libvirt host to inventory + awx.awx.host: + name: "{{ libvirt_host }}" + inventory: "{{ aap_project_name }}" + variables: + ansible_host: "{{ libvirt_fqdn }}" + state: present + + - name: Create SSH credential + awx.awx.credential: + name: "{{ aap_project_name }} SSH" + description: "SSH key for libvirt host" + organization: "{{ aap_organization }}" + credential_type: Machine + inputs: + username: "{{ libvirt_ssh_user }}" + ssh_key_data: "{{ libvirt_ssh_private_key }}" + state: present + + - name: Create Vault credential + awx.awx.credential: + name: "{{ aap_project_name }} Vault" + description: "Ansible Vault password" + organization: "{{ aap_organization }}" + credential_type: Vault + inputs: + vault_password: "{{ vault_password }}" + state: present + + - name: Find playbooks + ansible.builtin.find: + paths: playbooks/ + patterns: "*.yml,*.yaml" + file_type: file + recurse: false + register: found_playbooks + + - name: Create job templates + awx.awx.job_template: + name: "{{ item.path | basename | regex_replace('\\.ya?ml$', '') }}" + description: "Job template for {{ item.path | basename }}" + organization: "{{ aap_organization }}" + project: "{{ aap_project_name }}" + inventory: "{{ aap_project_name }}" + playbook: "playbooks/{{ item.path | basename }}" + job_type: run + credentials: + - "{{ aap_project_name }} SSH" + - "{{ aap_project_name }} Vault" + state: present + loop: "{{ found_playbooks.files }}" + loop_control: + label: "{{ item.path | basename }}" diff --git a/cd/setup_aap_project.yml b/cd/setup_aap_project.yml deleted file mode 100755 index c70a52b..0000000 --- a/cd/setup_aap_project.yml +++ /dev/null @@ -1,267 +0,0 @@ -#!/usr/bin/env ansible-playbook -# File: setup_aap_project.yml -# GitHub: https://github.com/makeitworkcloud/ansible-project-libvirt -# Description: This playbook creates the libvirt project in Ansible Automation Platform (AAP). -# Notes: -# - The instance being managed has issues registering Automation Hub with the Hybrid Cloud Console. -# The proprietary Red Hat AAP collection(s) cannot be imported or registered for usage. -# - The awx.awx collection automatically appends `/api/v2` to the endpoint, which does not work with AAP. -# The default Ansible Controller endpoint is `/api/controller/v2`. -# Therefore, the ansible.builtin.uri module is used instead. -# - Thanks, Red Hat. -# Author: -# _| -# _| _| _|_|_| _|_| _|_|_|_| _|_| -# _|_| _| _| _| _| _| _| _| -# _| _| _| _| _| _| _| _| _| -# _| _| _| _| _|_| _|_| _|_| ---- -- name: Load SOPS values - hosts: localhost - gather_facts: false - tasks: - - name: Load vars task - community.sops.load_vars: - file: ../secrets/secrets.yaml - -- name: Deploy AAP content via API - hosts: localhost - tasks: - - name: Create libvirt project - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/projects/" - method: POST - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - body_format: json - body: - name: "libvirt" - description: "Created via URI module" - scm_type: "git" - scm_url: "https://github.com/makeitworkcloud/ansible-project-libvirt.git" - organization: 1 - status_code: - - 201 - - 400 - register: project_result - - - name: Get project if POST failed - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/projects/?name=libvirt&organization=1" - method: GET - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - status_code: 200 - register: project_get - - - name: Trigger Project Sync (Update) - ansible.builtin.uri: - url: >- - {{ 'https://' ~ hostvars['localhost']['controller_host'] ~ '/api/controller/v2/projects/' - ~ project_get.json.results[0].id ~ '/update/' }} - method: POST - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - body_format: json - headers: - Content-Type: "application/json" - status_code: 202 - return_content: true - register: sync_result - - - name: Create Inventory - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/inventories/" - method: POST - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - body_format: json - body: - name: "libvirt" - description: "Created via REST API" - organization: "1" - status_code: - - 201 - - 400 - register: inventory_result - - - name: Get inventory id - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/inventories/?name=libvirt&organization=1" - method: GET - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - status_code: 200 - register: inventory_get - - - name: Add host to inventory - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/hosts/" - method: POST - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - body_format: json - body: - name: "{{ hostvars['localhost']['libvirt_host'] }}" - inventory: "{{ inventory_result.json.id | default }}" - variables: | - ansible_host: {{ hostvars['localhost']['libvirt_fqdn'] }} - status_code: - - 201 - - 400 - validate_certs: false - register: host_result - - - name: Create Machine Credential (SSH key) in AAP - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/credentials/" - method: POST - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - body_format: json - body: - name: "libvirt SSH" - description: "https://github.com/makeitworkcloud/ansible-project-libvirt/" - credential_type: "1" - organization: "1" - inputs: - username: "{{ hostvars['localhost']['libvirt_ssh_user'] }}" - ssh_key_data: "{{ hostvars['localhost']['libvirt_ssh_private_key'] }}" - status_code: - - 201 - - 400 - validate_certs: false - register: cred_result - - - name: Get machine credential id - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/credentials/?name=libvirt%20SSH&organization=1&credential_type=1" - method: GET - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - status_code: 200 - register: cred_get - - - name: Create Vault Credential in AAP - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/credentials/" - method: POST - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - body_format: json - body: - name: "libvirt Vault" - description: "Credential for unlocking Ansible Vault files" - credential_type: "3" - organization: "1" - inputs: - vault_password: "{{ hostvars['localhost']['vault_password'] }}" - status_code: - - 201 - - 400 - validate_certs: false - register: vault_cred_result - - - name: Get vault credential id - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/credentials/?name=libvirt%20Vault&organization=1&credential_type=3" - method: GET - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - status_code: 200 - register: vault_cred_get - - - name: Find all files in playbooks/ directory - ansible.builtin.find: - paths: ../playbooks/ - file_type: file - patterns: '*.yml,*.yaml' - recurse: false - register: found_playbooks - - - name: Create job templates for each playbook - ansible.builtin.uri: - url: "https://{{ hostvars['localhost']['controller_host'] }}/api/controller/v2/job_templates/" - method: POST - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - body_format: json - body: - name: "{{ item.path | basename | regex_replace('\\.yml$', '') }}" - description: "Job template for {{ item.path | basename }}" - job_type: "run" - inventory: "{{ inventory_get.json.results[0].id | int }}" - project: "{{ project_get.json.results[0].id | int }}" - playbook: "playbooks/{{ item.path | basename }}" - organization: "1" - status_code: - - 201 - - 400 - loop: "{{ found_playbooks.files }}" - register: job_template_results - - - name: Get job template ids - ansible.builtin.uri: - url: >- - {{ 'https://' ~ hostvars['localhost']['controller_host'] ~ '/api/controller/v2/job_templates/?name=' - ~ (item.path | basename | regex_replace('\.yml$', '')) ~ '&organization=1' }} - method: GET - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - status_code: 200 - loop: "{{ found_playbooks.files }}" - loop_control: - extended: true - register: job_template_gets - - - name: Attach Machine credential to job template - ansible.builtin.uri: - url: >- - {{ 'https://' ~ hostvars['localhost']['controller_host'] ~ '/api/controller/v2/job_templates/' - ~ job_template_gets.results[ansible_loop.index0].json.results[0].id ~ '/credentials/' }} - method: POST - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - body_format: json - body: - id: "{{ cred_get.json.results[0].id | int }}" - status_code: - - 204 - - 400 - register: attach_cred - loop: "{{ found_playbooks.files }}" - loop_control: - extended: true - - - name: Attach Vault credential to job template - ansible.builtin.uri: - url: >- - {{ 'https://' ~ hostvars['localhost']['controller_host'] ~ '/api/controller/v2/job_templates/' - ~ job_template_gets.results[ansible_loop.index0].json.results[0].id ~ '/credentials/' }} - method: POST - user: "{{ hostvars['localhost']['controller_username'] }}" - password: "{{ hostvars['localhost']['controller_password'] }}" - force_basic_auth: true - body_format: json - body: - id: "{{ vault_cred_get.json.results[0].id | int }}" - status_code: - - 204 - - 400 - register: attach_vault_cred - loop: "{{ found_playbooks.files }}" - loop_control: - extended: true diff --git a/requirements.yml b/requirements.yml index 5f9cd11..6513025 100644 --- a/requirements.yml +++ b/requirements.yml @@ -1,4 +1,5 @@ collections: + - name: awx.awx - name: community.general - name: community.sops - name: ansible.posix From 5d8443c783e9d40666ccdf2f5375419b89d9c914 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 08:04:50 -0700 Subject: [PATCH 05/27] fix: split plays so secrets load before module_defaults evaluation --- .setup_project.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.setup_project.yml b/.setup_project.yml index 67cf9a4..96e21c5 100644 --- a/.setup_project.yml +++ b/.setup_project.yml @@ -9,6 +9,14 @@ # _| _| _| _| _| _| _| _| _| # _| _| _| _| _|_| _|_| _|_| --- +- name: Load SOPS secrets + hosts: localhost + gather_facts: false + tasks: + - name: Load SOPS secrets + community.sops.load_vars: + file: secrets/secrets.yaml + - name: Deploy AAP content hosts: localhost gather_facts: false @@ -23,11 +31,6 @@ controller_username: "{{ controller_username }}" controller_password: "{{ controller_password }}" validate_certs: true - pre_tasks: - - name: Load SOPS secrets - community.sops.load_vars: - file: secrets/secrets.yaml - tasks: - name: Create project awx.awx.project: From e53a38992949a684d674efe234a6191ef46af9dc Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 08:13:26 -0700 Subject: [PATCH 06/27] refactor: split CI into pre-commit and ansible-check jobs - Pre-commit job runs basic hooks (skips ansible-lint) - Ansible-check job installs collections, runs ansible-lint, runs --check --diff - Enable ansible-lint for playbooks/ directory - Add Makefile targets: lint, check, commit (all set ANSIBLE_VAULT_PASSWORD_FILE) - Add .envrc for direnv users --- .envrc | 1 + .github/workflows/check.yml | 21 +++++++++++++++++---- .pre-commit-config.yaml | 2 +- Makefile | 7 +++++++ 4 files changed, 26 insertions(+), 5 deletions(-) create mode 100644 .envrc diff --git a/.envrc b/.envrc new file mode 100644 index 0000000..aff3a7d --- /dev/null +++ b/.envrc @@ -0,0 +1 @@ +export ANSIBLE_VAULT_PASSWORD_FILE=./scripts/vault.bash diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 44da64b..8e069ed 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -11,8 +11,21 @@ permissions: pull-requests: write jobs: - check: - name: Pre-commit & Ansible Check + pre-commit: + name: Pre-commit (basic hooks) + runs-on: ubuntu-latest + container: + image: ghcr.io/makeitworkcloud/runner:latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Run pre-commit (skip ansible-lint) + run: SKIP=ansible-lint pre-commit run --all-files + + ansible-check: + name: Ansible Lint & Check + needs: pre-commit runs-on: ubuntu-latest container: image: ghcr.io/makeitworkcloud/runner:latest @@ -26,8 +39,8 @@ jobs: - name: Install Ansible collections run: ansible-galaxy collection install -r requirements.yml - - name: Run pre-commit - run: pre-commit run --all-files + - name: Run ansible-lint + run: ansible-lint --exclude=secrets/ --exclude=vars/ - name: Check AAP deployment (dry-run) run: ansible-playbook .setup_project.yml --check --diff diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e61c8a6..24b95ae 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -16,4 +16,4 @@ repos: language_version: python3 additional_dependencies: - ansible - args: [--exclude=secrets/, --exclude=vars/, --exclude=playbooks/] + args: [--exclude=secrets/, --exclude=vars/] diff --git a/Makefile b/Makefile index 4c97067..ed72b04 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,11 @@ ANSIBLE_VAULT_PASSWORD_FILE := "./scripts/vault.bash" +lint: + @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) pre-commit run --all-files + +check: + @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) pre-commit run --all-files + @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) ansible-playbook .setup_project.yml --check --diff + commit: @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) git commit \ No newline at end of file From 1601aee84b91585b1bdd023f6c9b3550a8607396 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 08:14:55 -0700 Subject: [PATCH 07/27] fix: run ansible-lint via pre-commit in CI for consistency --- .github/workflows/check.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 8e069ed..035fa62 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -39,8 +39,8 @@ jobs: - name: Install Ansible collections run: ansible-galaxy collection install -r requirements.yml - - name: Run ansible-lint - run: ansible-lint --exclude=secrets/ --exclude=vars/ + - name: Run pre-commit (all hooks) + run: pre-commit run --all-files - name: Check AAP deployment (dry-run) run: ansible-playbook .setup_project.yml --check --diff From a35227f92430cc88a2d54cf81173e6ddf1e6e1f7 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 08:17:16 -0700 Subject: [PATCH 08/27] refactor: single CI job with PR comment for ansible check output - Merge pre-commit and ansible-check into single job - Capture ansible-playbook --check --diff output - Truncate to 1000 lines for safety - Post as PR comment using github-script --- .github/workflows/check.yml | 47 +++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 17 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 035fa62..0c20ed7 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -11,21 +11,8 @@ permissions: pull-requests: write jobs: - pre-commit: - name: Pre-commit (basic hooks) - runs-on: ubuntu-latest - container: - image: ghcr.io/makeitworkcloud/runner:latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Run pre-commit (skip ansible-lint) - run: SKIP=ansible-lint pre-commit run --all-files - - ansible-check: - name: Ansible Lint & Check - needs: pre-commit + check: + name: Pre-commit & Ansible Check runs-on: ubuntu-latest container: image: ghcr.io/makeitworkcloud/runner:latest @@ -39,8 +26,34 @@ jobs: - name: Install Ansible collections run: ansible-galaxy collection install -r requirements.yml - - name: Run pre-commit (all hooks) + - name: Run pre-commit run: pre-commit run --all-files - name: Check AAP deployment (dry-run) - run: ansible-playbook .setup_project.yml --check --diff + id: check + run: | + ansible-playbook .setup_project.yml --check --diff 2>&1 | tee check-output.txt || true + + tail -n 1000 check-output.txt > check-output-truncated.txt + mv check-output-truncated.txt check-output.txt + + - name: Comment PR with Check Output + if: github.event_name == 'pull_request' + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const fs = require('fs'); + const checkOutput = fs.readFileSync('check-output.txt', 'utf8'); + + const output = `#### Ansible Check (dry-run) + \`\`\` + ${checkOutput} + \`\`\` + `; + github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body: output + }); From 4142a7a23e86874146931463c4ccce3526cd05ea Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 08:22:12 -0700 Subject: [PATCH 09/27] fix: skip project sync in check mode, disable scm_update_on_launch - Project sync fails in check mode when project doesn't exist yet - Disable scm_update_on_launch since CI handles sync --- .setup_project.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.setup_project.yml b/.setup_project.yml index 96e21c5..d49c4e1 100644 --- a/.setup_project.yml +++ b/.setup_project.yml @@ -39,7 +39,7 @@ organization: "{{ aap_organization }}" scm_type: git scm_url: https://github.com/makeitworkcloud/ansible-project-libvirt.git - scm_update_on_launch: true + scm_update_on_launch: false state: present - name: Sync project @@ -47,6 +47,7 @@ name: "{{ aap_project_name }}" wait: true timeout: 300 + when: not ansible_check_mode - name: Create inventory awx.awx.inventory: From 67d582967387c41c2894b3fcc65aa03e5584dc38 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 08:35:44 -0700 Subject: [PATCH 10/27] fix: suppress localhost inventory warning in CI and Makefile --- .github/workflows/check.yml | 1 + Makefile | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 0c20ed7..515cf60 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -19,6 +19,7 @@ jobs: env: SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }} ANSIBLE_VAULT_PASSWORD_FILE: ./scripts/vault.bash + ANSIBLE_LOCALHOST_WARNING: False steps: - name: Checkout uses: actions/checkout@v4 diff --git a/Makefile b/Makefile index ed72b04..4808611 100644 --- a/Makefile +++ b/Makefile @@ -1,11 +1,12 @@ ANSIBLE_VAULT_PASSWORD_FILE := "./scripts/vault.bash" +ANSIBLE_LOCALHOST_WARNING := False lint: @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) pre-commit run --all-files check: @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) pre-commit run --all-files - @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) ansible-playbook .setup_project.yml --check --diff + @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) ANSIBLE_LOCALHOST_WARNING=$(ANSIBLE_LOCALHOST_WARNING) ansible-playbook .setup_project.yml --check --diff commit: @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) git commit \ No newline at end of file From ea12997eb4759fbd5098ff605a65cee45c37a045 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 08:38:35 -0700 Subject: [PATCH 11/27] refactor: update PR comments instead of creating new ones --- .github/workflows/check.yml | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 515cf60..2a5bc6e 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -38,23 +38,26 @@ jobs: tail -n 1000 check-output.txt > check-output-truncated.txt mv check-output-truncated.txt check-output.txt + - name: Find existing comment + if: github.event_name == 'pull_request' + uses: peter-evans/find-comment@v3 + id: fc + with: + issue-number: ${{ github.event.pull_request.number }} + comment-author: 'github-actions[bot]' + body-includes: '' + - name: Comment PR with Check Output if: github.event_name == 'pull_request' - uses: actions/github-script@v7 + uses: peter-evans/create-or-update-comment@v4 with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const fs = require('fs'); - const checkOutput = fs.readFileSync('check-output.txt', 'utf8'); - - const output = `#### Ansible Check (dry-run) - \`\`\` - ${checkOutput} - \`\`\` - `; - github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: output - }); + comment-id: ${{ steps.fc.outputs.comment-id }} + issue-number: ${{ github.event.pull_request.number }} + body-path: check-output.txt + body-prefix: | + + #### Ansible Check (dry-run) + ``` + body-suffix: | + ``` + edit-mode: replace From d351151536d3f8d421e4b6c23ea94846c2a1ef0f Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 08:50:59 -0700 Subject: [PATCH 12/27] fix: suppress inventory warnings and improve CI failure handling - Add ANSIBLE_INVENTORY_UNPARSED_WARNING to suppress 'No inventory was parsed' warning - Use continue-on-error pattern in check workflow to capture output before failing - Add apply target to Makefile --- .github/workflows/check.yml | 10 ++++++++-- .github/workflows/deploy.yml | 2 ++ Makefile | 6 +++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 2a5bc6e..e9e6570 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -19,7 +19,8 @@ jobs: env: SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }} ANSIBLE_VAULT_PASSWORD_FILE: ./scripts/vault.bash - ANSIBLE_LOCALHOST_WARNING: False + ANSIBLE_LOCALHOST_WARNING: "false" + ANSIBLE_INVENTORY_UNPARSED_WARNING: "false" steps: - name: Checkout uses: actions/checkout@v4 @@ -32,8 +33,9 @@ jobs: - name: Check AAP deployment (dry-run) id: check + continue-on-error: true run: | - ansible-playbook .setup_project.yml --check --diff 2>&1 | tee check-output.txt || true + ansible-playbook .setup_project.yml --check --diff 2>&1 | tee check-output.txt tail -n 1000 check-output.txt > check-output-truncated.txt mv check-output-truncated.txt check-output.txt @@ -61,3 +63,7 @@ jobs: body-suffix: | ``` edit-mode: replace + + - name: Fail if check failed + if: steps.check.outcome == 'failure' + run: exit 1 diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 575ccaf..5f0d465 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -18,6 +18,8 @@ jobs: env: SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }} ANSIBLE_VAULT_PASSWORD_FILE: ./scripts/vault.bash + ANSIBLE_LOCALHOST_WARNING: "false" + ANSIBLE_INVENTORY_UNPARSED_WARNING: "false" steps: - name: Checkout uses: actions/checkout@v4 diff --git a/Makefile b/Makefile index 4808611..d16bc03 100644 --- a/Makefile +++ b/Makefile @@ -1,12 +1,16 @@ ANSIBLE_VAULT_PASSWORD_FILE := "./scripts/vault.bash" ANSIBLE_LOCALHOST_WARNING := False +ANSIBLE_INVENTORY_UNPARSED_WARNING := False lint: @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) pre-commit run --all-files check: @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) pre-commit run --all-files - @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) ANSIBLE_LOCALHOST_WARNING=$(ANSIBLE_LOCALHOST_WARNING) ansible-playbook .setup_project.yml --check --diff + @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) ANSIBLE_LOCALHOST_WARNING=$(ANSIBLE_LOCALHOST_WARNING) ANSIBLE_INVENTORY_UNPARSED_WARNING=$(ANSIBLE_INVENTORY_UNPARSED_WARNING) ansible-playbook .setup_project.yml --check --diff + +apply: + @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) ANSIBLE_LOCALHOST_WARNING=$(ANSIBLE_LOCALHOST_WARNING) ANSIBLE_INVENTORY_UNPARSED_WARNING=$(ANSIBLE_INVENTORY_UNPARSED_WARNING) ansible-playbook .setup_project.yml commit: @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) git commit \ No newline at end of file From 2f18e28ff42eb2156fea173965f6cc5caf60f2ff Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 09:35:20 -0700 Subject: [PATCH 13/27] fix: embed HTML marker in comment body for find-comment to work --- .github/workflows/check.yml | 41 ++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index e9e6570..2c07a9e 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -1,4 +1,4 @@ -name: Check +name: check on: pull_request: @@ -12,7 +12,6 @@ permissions: jobs: check: - name: Pre-commit & Ansible Check runs-on: ubuntu-latest container: image: ghcr.io/makeitworkcloud/runner:latest @@ -22,48 +21,52 @@ jobs: ANSIBLE_LOCALHOST_WARNING: "false" ANSIBLE_INVENTORY_UNPARSED_WARNING: "false" steps: - - name: Checkout + - name: checkout uses: actions/checkout@v4 - - name: Install Ansible collections + - name: dependencies run: ansible-galaxy collection install -r requirements.yml - - name: Run pre-commit + - name: lint run: pre-commit run --all-files - - name: Check AAP deployment (dry-run) + - name: check id: check continue-on-error: true run: | ansible-playbook .setup_project.yml --check --diff 2>&1 | tee check-output.txt - tail -n 1000 check-output.txt > check-output-truncated.txt mv check-output-truncated.txt check-output.txt - - name: Find existing comment + - name: prepare-comment + id: prepare-comment + run: | + { + echo '' + echo '#### Ansible Check (dry-run)' + echo '```' + cat check-output.txt + echo '```' + } > comment-body.md + + - name: find-comment if: github.event_name == 'pull_request' uses: peter-evans/find-comment@v3 - id: fc + id: find-comment with: issue-number: ${{ github.event.pull_request.number }} comment-author: 'github-actions[bot]' body-includes: '' - - name: Comment PR with Check Output + - name: comment if: github.event_name == 'pull_request' uses: peter-evans/create-or-update-comment@v4 with: - comment-id: ${{ steps.fc.outputs.comment-id }} + comment-id: ${{ steps.find-comment.outputs.comment-id }} issue-number: ${{ github.event.pull_request.number }} - body-path: check-output.txt - body-prefix: | - - #### Ansible Check (dry-run) - ``` - body-suffix: | - ``` + body-path: comment-body.md edit-mode: replace - - name: Fail if check failed + - name: fail-on-error if: steps.check.outcome == 'failure' run: exit 1 From 75d01d891984e54d6381091baed4819bdb5915ec Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 09:40:11 -0700 Subject: [PATCH 14/27] test: verify PR comment update From 7a72fc86d4e2079ec9bc8ad182574f44e93d5db7 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 09:41:25 -0700 Subject: [PATCH 15/27] fix: skip prepare-comment step for non-PR events --- .github/workflows/check.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 2c07a9e..9257766 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -39,7 +39,7 @@ jobs: mv check-output-truncated.txt check-output.txt - name: prepare-comment - id: prepare-comment + if: github.event_name == 'pull_request' run: | { echo '' From e97736ac276de547cd420c25c8dc203bbcc3655f Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 09:46:25 -0700 Subject: [PATCH 16/27] refactor: delete and recreate PR comment for fresh timestamp --- .github/workflows/check.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 9257766..ee4fb9d 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -58,14 +58,18 @@ jobs: comment-author: 'github-actions[bot]' body-includes: '' + - name: delete-comment + if: github.event_name == 'pull_request' && steps.find-comment.outputs.comment-id != '' + run: gh api repos/${{ github.repository }}/issues/comments/${{ steps.find-comment.outputs.comment-id }} -X DELETE + env: + GH_TOKEN: ${{ github.token }} + - name: comment if: github.event_name == 'pull_request' uses: peter-evans/create-or-update-comment@v4 with: - comment-id: ${{ steps.find-comment.outputs.comment-id }} issue-number: ${{ github.event.pull_request.number }} body-path: comment-body.md - edit-mode: replace - name: fail-on-error if: steps.check.outcome == 'failure' From 59a42179c5b330a5fa1bed8dced4b721e9be83a4 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 09:49:31 -0700 Subject: [PATCH 17/27] refactor: use johanwulf/replace-comment action --- .github/workflows/check.yml | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index ee4fb9d..8a65da9 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -49,26 +49,12 @@ jobs: echo '```' } > comment-body.md - - name: find-comment - if: github.event_name == 'pull_request' - uses: peter-evans/find-comment@v3 - id: find-comment - with: - issue-number: ${{ github.event.pull_request.number }} - comment-author: 'github-actions[bot]' - body-includes: '' - - - name: delete-comment - if: github.event_name == 'pull_request' && steps.find-comment.outputs.comment-id != '' - run: gh api repos/${{ github.repository }}/issues/comments/${{ steps.find-comment.outputs.comment-id }} -X DELETE - env: - GH_TOKEN: ${{ github.token }} - - name: comment if: github.event_name == 'pull_request' - uses: peter-evans/create-or-update-comment@v4 + uses: johanwulf/replace-comment@v1 with: issue-number: ${{ github.event.pull_request.number }} + body-includes: '' body-path: comment-body.md - name: fail-on-error From 52ab685415052da7e6ff62e52a529c1d22458d2a Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 09:50:25 -0700 Subject: [PATCH 18/27] fix: use full version tag v1.0.0 for replace-comment --- .github/workflows/check.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 8a65da9..07f17ef 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -51,7 +51,7 @@ jobs: - name: comment if: github.event_name == 'pull_request' - uses: johanwulf/replace-comment@v1 + uses: johanwulf/replace-comment@v1.0.0 with: issue-number: ${{ github.event.pull_request.number }} body-includes: '' From af0bae24e6791cfcf86c9567fc968465dd095aaf Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 17:15:37 -0700 Subject: [PATCH 19/27] refactor: migrate from AAP to AWX - Remove AAP-specific CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX - Rename aap_* variables to awx_* - Update comments and play names --- .setup_project.yml | 40 +++++++++++++++++++--------------------- 1 file changed, 19 insertions(+), 21 deletions(-) diff --git a/.setup_project.yml b/.setup_project.yml index d49c4e1..e4ff7ab 100644 --- a/.setup_project.yml +++ b/.setup_project.yml @@ -1,7 +1,7 @@ #!/usr/bin/env ansible-playbook # File: .setup_project.yml # GitHub: https://github.com/makeitworkcloud/ansible-project-libvirt -# Description: Creates the libvirt project in Ansible Automation Platform (AAP). +# Description: Creates the libvirt project in AWX. # Author: # _| # _| _| _|_|_| _|_| _|_|_|_| _|_| @@ -17,14 +17,12 @@ community.sops.load_vars: file: secrets/secrets.yaml -- name: Deploy AAP content +- name: Deploy AWX content hosts: localhost gather_facts: false - environment: - CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX: /api/controller/ vars: - aap_project_name: libvirt - aap_organization: Default + awx_project_name: libvirt + awx_organization: Default module_defaults: group/awx.awx.controller: controller_host: "{{ controller_host }}" @@ -34,9 +32,9 @@ tasks: - name: Create project awx.awx.project: - name: "{{ aap_project_name }}" + name: "{{ awx_project_name }}" description: "Managed by ansible-project-libvirt" - organization: "{{ aap_organization }}" + organization: "{{ awx_organization }}" scm_type: git scm_url: https://github.com/makeitworkcloud/ansible-project-libvirt.git scm_update_on_launch: false @@ -44,31 +42,31 @@ - name: Sync project awx.awx.project_update: - name: "{{ aap_project_name }}" + name: "{{ awx_project_name }}" wait: true timeout: 300 when: not ansible_check_mode - name: Create inventory awx.awx.inventory: - name: "{{ aap_project_name }}" + name: "{{ awx_project_name }}" description: "Managed by ansible-project-libvirt" - organization: "{{ aap_organization }}" + organization: "{{ awx_organization }}" state: present - name: Add libvirt host to inventory awx.awx.host: name: "{{ libvirt_host }}" - inventory: "{{ aap_project_name }}" + inventory: "{{ awx_project_name }}" variables: ansible_host: "{{ libvirt_fqdn }}" state: present - name: Create SSH credential awx.awx.credential: - name: "{{ aap_project_name }} SSH" + name: "{{ awx_project_name }} SSH" description: "SSH key for libvirt host" - organization: "{{ aap_organization }}" + organization: "{{ awx_organization }}" credential_type: Machine inputs: username: "{{ libvirt_ssh_user }}" @@ -77,9 +75,9 @@ - name: Create Vault credential awx.awx.credential: - name: "{{ aap_project_name }} Vault" + name: "{{ awx_project_name }} Vault" description: "Ansible Vault password" - organization: "{{ aap_organization }}" + organization: "{{ awx_organization }}" credential_type: Vault inputs: vault_password: "{{ vault_password }}" @@ -97,14 +95,14 @@ awx.awx.job_template: name: "{{ item.path | basename | regex_replace('\\.ya?ml$', '') }}" description: "Job template for {{ item.path | basename }}" - organization: "{{ aap_organization }}" - project: "{{ aap_project_name }}" - inventory: "{{ aap_project_name }}" + organization: "{{ awx_organization }}" + project: "{{ awx_project_name }}" + inventory: "{{ awx_project_name }}" playbook: "playbooks/{{ item.path | basename }}" job_type: run credentials: - - "{{ aap_project_name }} SSH" - - "{{ aap_project_name }} Vault" + - "{{ awx_project_name }} SSH" + - "{{ awx_project_name }} Vault" state: present loop: "{{ found_playbooks.files }}" loop_control: From bfdaecc057e2f325ca3dfc017278021b6b745cc6 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 17:17:06 -0700 Subject: [PATCH 20/27] chore: align pre-commit config and fix trailing newlines --- .ansible-lint | 6 ++++++ .gitignore | 2 +- .pre-commit-config.yaml | 9 +++++++-- Makefile | 2 +- 4 files changed, 15 insertions(+), 4 deletions(-) create mode 100644 .ansible-lint diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 0000000..75dee12 --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,6 @@ +--- +exclude_paths: + - .cache/ + - .github/ + - secrets/ + - vars/ diff --git a/.gitignore b/.gitignore index d17f39f..0a47f07 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,4 @@ **/*.ansible **/*.swp **/*.log -**/1 \ No newline at end of file +**/1 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 24b95ae..c60e3c3 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,4 +1,9 @@ repos: + - repo: https://github.com/compilerla/conventional-pre-commit + rev: v4.0.0 + hooks: + - id: conventional-pre-commit + stages: [commit-msg] - repo: https://github.com/pre-commit/pre-commit-hooks rev: v6.0.0 hooks: @@ -8,12 +13,12 @@ repos: - id: check-vcs-permalinks - id: destroyed-symlinks - id: detect-private-key + - id: end-of-file-fixer - id: mixed-line-ending + - id: trailing-whitespace - repo: https://github.com/ansible/ansible-lint rev: v25.12.1 hooks: - id: ansible-lint - language_version: python3 additional_dependencies: - ansible - args: [--exclude=secrets/, --exclude=vars/] diff --git a/Makefile b/Makefile index d16bc03..917259c 100644 --- a/Makefile +++ b/Makefile @@ -13,4 +13,4 @@ apply: @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) ANSIBLE_LOCALHOST_WARNING=$(ANSIBLE_LOCALHOST_WARNING) ANSIBLE_INVENTORY_UNPARSED_WARNING=$(ANSIBLE_INVENTORY_UNPARSED_WARNING) ansible-playbook .setup_project.yml commit: - @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) git commit \ No newline at end of file + @ANSIBLE_VAULT_PASSWORD_FILE=$(ANSIBLE_VAULT_PASSWORD_FILE) git commit From c8c9cf0f77799ea8e3c534f97958b8ef5b123beb Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 17:20:41 -0700 Subject: [PATCH 21/27] fix: downgrade pre-commit-hooks to v5.0.0 for Python 3.12 compat --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index c60e3c3..2a635c0 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -5,7 +5,7 @@ repos: - id: conventional-pre-commit stages: [commit-msg] - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v6.0.0 + rev: v5.0.0 hooks: - id: check-case-conflict - id: check-merge-conflict From fcca7b434fa3f9207f2383039ed7992090896d3a Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 17:21:53 -0700 Subject: [PATCH 22/27] fix: add setup-python for Python 3.13, restore pre-commit-hooks v6.0.0 --- .github/workflows/check.yml | 5 +++++ .pre-commit-config.yaml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 07f17ef..3c194e6 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -24,6 +24,11 @@ jobs: - name: checkout uses: actions/checkout@v4 + - name: setup python + uses: actions/setup-python@v5 + with: + python-version: '3.13' + - name: dependencies run: ansible-galaxy collection install -r requirements.yml diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 2a635c0..c60e3c3 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -5,7 +5,7 @@ repos: - id: conventional-pre-commit stages: [commit-msg] - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v5.0.0 + rev: v6.0.0 hooks: - id: check-case-conflict - id: check-merge-conflict From f433754cb92f80d7a7f9ad30e3e3f152df4ba293 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 17:24:26 -0700 Subject: [PATCH 23/27] fix: install python3.13 via dnf in container --- .github/workflows/check.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 3c194e6..1de9b56 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -24,10 +24,10 @@ jobs: - name: checkout uses: actions/checkout@v4 - - name: setup python - uses: actions/setup-python@v5 - with: - python-version: '3.13' + - name: install python 3.13 + run: | + dnf install -y python3.13 + ln -sf /usr/bin/python3.13 /usr/local/bin/python3.13 - name: dependencies run: ansible-galaxy collection install -r requirements.yml From 7dd2d7b5afba35793e6e5a8989dc36ab5e2b1566 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 17:25:17 -0700 Subject: [PATCH 24/27] fix: use setup-python and pip install pre-commit --- .github/workflows/check.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 1de9b56..4119cdf 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -24,10 +24,13 @@ jobs: - name: checkout uses: actions/checkout@v4 - - name: install python 3.13 - run: | - dnf install -y python3.13 - ln -sf /usr/bin/python3.13 /usr/local/bin/python3.13 + - name: setup python + uses: actions/setup-python@v5 + with: + python-version: '3.13' + + - name: install pre-commit + run: pip install pre-commit - name: dependencies run: ansible-galaxy collection install -r requirements.yml From 5b245e27f57293d9a4089fa3a316a3d4fd3e9806 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 17:26:41 -0700 Subject: [PATCH 25/27] fix: use --break-system-packages for pip install --- .github/workflows/check.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 4119cdf..bdab7fe 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -30,7 +30,7 @@ jobs: python-version: '3.13' - name: install pre-commit - run: pip install pre-commit + run: pip install --break-system-packages pre-commit - name: dependencies run: ansible-galaxy collection install -r requirements.yml From efe73540d225abdb785f115ecab6a4cb03a7e653 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 17:37:52 -0700 Subject: [PATCH 26/27] refactor: split lint and check jobs, use pre-commit/action --- .github/workflows/check.yml | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index bdab7fe..cd895a7 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -11,10 +11,25 @@ permissions: pull-requests: write jobs: + lint: + runs-on: ubuntu-latest + steps: + - name: checkout + uses: actions/checkout@v4 + + - name: setup python + uses: actions/setup-python@v5 + with: + python-version: '3.13' + + - name: pre-commit + uses: pre-commit/action@v3.0.1 + check: runs-on: ubuntu-latest container: image: ghcr.io/makeitworkcloud/runner:latest + needs: [lint] env: SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }} ANSIBLE_VAULT_PASSWORD_FILE: ./scripts/vault.bash @@ -24,20 +39,9 @@ jobs: - name: checkout uses: actions/checkout@v4 - - name: setup python - uses: actions/setup-python@v5 - with: - python-version: '3.13' - - - name: install pre-commit - run: pip install --break-system-packages pre-commit - - name: dependencies run: ansible-galaxy collection install -r requirements.yml - - name: lint - run: pre-commit run --all-files - - name: check id: check continue-on-error: true From aee5cedc2eaecf266b6c07b6aa74561569097109 Mon Sep 17 00:00:00 2001 From: xnoto Date: Sun, 21 Dec 2025 17:40:51 -0700 Subject: [PATCH 27/27] fix: exclude playbooks from ansible-lint (vault-encrypted vars) --- .ansible-lint | 1 + 1 file changed, 1 insertion(+) diff --git a/.ansible-lint b/.ansible-lint index 75dee12..73a203f 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -4,3 +4,4 @@ exclude_paths: - .github/ - secrets/ - vars/ + - playbooks/