fix(ansible): replace steward key on reprovision + distinct agent update path
Provisioning review corrections + the matching frontend, plus breadcrumb header integration. - provision.yml: authorize the managed pubkey with a regexp match on the ' steward-managed' comment so rotating the key REPLACES the host's steward key in place instead of stacking a second authorized entry. Hand-added keys (other comments) are untouched. - update.yml (new): refresh agent.py + restart only. Does NOT rotate the token or rewrite /etc/steward-agent.conf — the host keeps its identity. Asserts the agent is already installed and fails clearly otherwise. - host_agent /update route: runs update.yml as the managed steward user (no token minting). Token rotation stays a deliberate action. - settings/ansible/generate-key honors a safe relative `next` redirect, so an inline trigger elsewhere returns to its page. - Host Agents settings: reworked into a clear lifecycle — an intro card that explains it runs Ansible to deploy the agent (+ inline "generate managed key" warning/trigger when none exists), then three labelled cards: 1 Provision, 2 Install/enroll, 3 Update. Each explains what it does. - base.html: breadcrumb now renders as a kicker line directly above the page title (moved below alerts, tightened margin) so nested and top-level views share one consistent header. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -31,41 +31,63 @@
|
||||
</div>
|
||||
|
||||
{% if ansible_available %}
|
||||
{% set scope_select %}
|
||||
<label>Target</label>
|
||||
<select name="inventory_scope" required>
|
||||
{% for g in deploy_groups %}<option value="steward:group:{{ g.id }}">Group: {{ g.name }}</option>{% endfor %}
|
||||
{% for t in deploy_targets %}<option value="steward:target:{{ t.id }}">Target: {{ t.name }}</option>{% endfor %}
|
||||
</select>
|
||||
{% endset %}
|
||||
|
||||
<div class="card">
|
||||
<h3 style="margin-bottom:0.4rem;">Provision a fresh host</h3>
|
||||
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
|
||||
First contact for a host Steward can't yet reach by key. Creates a
|
||||
<code>steward</code> login account with passwordless sudo, installs the managed
|
||||
key, then installs the agent — over a one-time bootstrap password (used for this
|
||||
run only, never stored). After this, use <strong>Deploy</strong> below for updates.
|
||||
<h3 style="margin-bottom:0.4rem;">Agent lifecycle via Ansible</h3>
|
||||
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.6rem;">
|
||||
These actions run bundled <strong>Ansible playbooks</strong> to deploy and maintain the
|
||||
Steward monitoring agent on your <a href="/ansible/inventory/targets">inventory hosts</a>.
|
||||
Steward generates each host's API token automatically and connects over SSH as the managed
|
||||
<code>steward</code> account — you'll be dropped into the live Ansible run to watch it.
|
||||
</p>
|
||||
|
||||
{% if not managed_key_set %}
|
||||
<p style="font-size:0.85rem;color:var(--text-dim);">
|
||||
No managed key yet. Generate one under <a href="/settings/ansible/">Settings → Ansible</a> first.
|
||||
</p>
|
||||
<div style="background:color-mix(in srgb,var(--yellow) 12%,var(--bg-elevated));
|
||||
border:1px solid color-mix(in srgb,var(--yellow) 35%,var(--border));
|
||||
border-radius:6px;padding:0.7rem 0.9rem;display:flex;align-items:center;
|
||||
gap:0.8rem;flex-wrap:wrap;">
|
||||
<span style="color:var(--yellow);">⚠</span>
|
||||
<span style="font-size:0.84rem;flex:1;min-width:14rem;">
|
||||
No managed SSH key yet — Steward needs one to log into hosts as <code>steward</code>.
|
||||
</span>
|
||||
<form method="post" action="/settings/ansible/generate-key" style="margin:0;">
|
||||
<input type="hidden" name="next" value="/plugins/host_agent/settings/">
|
||||
<button type="submit" class="btn btn-sm">Generate managed key</button>
|
||||
</form>
|
||||
</div>
|
||||
{% elif not (deploy_targets or deploy_groups) %}
|
||||
<p style="font-size:0.85rem;color:var(--text-dim);">
|
||||
<p style="font-size:0.85rem;color:var(--text-dim);margin:0;">
|
||||
No Ansible inventory targets yet. Add some under <a href="/ansible/inventory/targets">Ansible → Inventory</a>.
|
||||
</p>
|
||||
{% else %}
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
{% if managed_key_set and (deploy_targets or deploy_groups) %}
|
||||
<div class="card">
|
||||
<h3 style="margin-bottom:0.4rem;">1 · Provision a fresh host</h3>
|
||||
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
|
||||
First contact for a brand-new host. Connects with a one-time <strong>bootstrap</strong>
|
||||
user + password (used for this run only, never stored), creates the <code>steward</code>
|
||||
login account with passwordless sudo, installs the managed SSH key, then installs the
|
||||
agent. Run this once per host.
|
||||
</p>
|
||||
<form method="post" action="/plugins/host_agent/provision"
|
||||
style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
|
||||
<div class="form-group" style="margin-bottom:0;">
|
||||
<label>Target</label>
|
||||
<select name="inventory_scope" required>
|
||||
{% for g in deploy_groups %}<option value="steward:group:{{ g.id }}">Group: {{ g.name }}</option>{% endfor %}
|
||||
{% for t in deploy_targets %}<option value="steward:target:{{ t.id }}">Target: {{ t.name }}</option>{% endfor %}
|
||||
</select>
|
||||
</div>
|
||||
<div class="form-group" style="margin-bottom:0;">{{ scope_select }}</div>
|
||||
<div class="form-group" style="margin-bottom:0;">
|
||||
<label>Bootstrap user</label>
|
||||
<input type="text" name="bootstrap_user" required placeholder="root" style="width:9rem;"
|
||||
autocomplete="off">
|
||||
<input type="text" name="bootstrap_user" required placeholder="root" style="width:9rem;" autocomplete="off">
|
||||
</div>
|
||||
<div class="form-group" style="margin-bottom:0;">
|
||||
<label>Bootstrap password</label>
|
||||
<input type="password" name="bootstrap_password" required style="width:11rem;"
|
||||
autocomplete="new-password">
|
||||
<input type="password" name="bootstrap_password" required style="width:11rem;" autocomplete="new-password">
|
||||
</div>
|
||||
<div class="form-group" style="margin-bottom:0;">
|
||||
<label>Report interval (s)</label>
|
||||
@@ -73,37 +95,40 @@
|
||||
</div>
|
||||
<button type="submit" class="btn">Provision</button>
|
||||
</form>
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h3 style="margin-bottom:0.4rem;">Deploy via Ansible</h3>
|
||||
<h3 style="margin-bottom:0.4rem;">2 · Install / enroll agent</h3>
|
||||
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
|
||||
Install (or update) the agent on Ansible inventory hosts in one run — no per-host <code>curl | sh</code>.
|
||||
A fresh token is minted per host and injected into the run; existing agents are rotated to the new token.
|
||||
For a host that's already provisioned (has the <code>steward</code> account) but has no
|
||||
agent yet — or to re-enroll one. Connects as <code>steward</code> with the managed key,
|
||||
mints a fresh token, and installs the agent. No <code>curl | sh</code> needed.
|
||||
</p>
|
||||
{% if not (deploy_targets or deploy_groups) %}
|
||||
<p style="font-size:0.85rem;color:var(--text-dim);">
|
||||
No Ansible inventory targets yet. Add some under <a href="/ansible/browse">Ansible → Browse</a>.
|
||||
</p>
|
||||
{% else %}
|
||||
<form method="post" action="/plugins/host_agent/deploy"
|
||||
style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
|
||||
<div class="form-group" style="margin-bottom:0;">
|
||||
<label>Target</label>
|
||||
<select name="inventory_scope" required>
|
||||
{% for g in deploy_groups %}<option value="steward:group:{{ g.id }}">Group: {{ g.name }}</option>{% endfor %}
|
||||
{% for t in deploy_targets %}<option value="steward:target:{{ t.id }}">Target: {{ t.name }}</option>{% endfor %}
|
||||
</select>
|
||||
</div>
|
||||
<div class="form-group" style="margin-bottom:0;">{{ scope_select }}</div>
|
||||
<div class="form-group" style="margin-bottom:0;">
|
||||
<label>Report interval (s)</label>
|
||||
<input type="number" name="agent_interval" value="30" min="5" style="width:7rem;">
|
||||
</div>
|
||||
<button type="submit" class="btn">Deploy</button>
|
||||
<button type="submit" class="btn">Install</button>
|
||||
</form>
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h3 style="margin-bottom:0.4rem;">3 · Update agents</h3>
|
||||
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
|
||||
Refresh the agent binary on hosts already running it. Connects as <code>steward</code>
|
||||
with the managed key and restarts the service — the token and config are left untouched,
|
||||
so identity is preserved.
|
||||
</p>
|
||||
<form method="post" action="/plugins/host_agent/update"
|
||||
style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
|
||||
<div class="form-group" style="margin-bottom:0;">{{ scope_select }}</div>
|
||||
<button type="submit" class="btn">Update</button>
|
||||
</form>
|
||||
</div>
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
|
||||
<div class="card-flush">
|
||||
|
||||
Reference in New Issue
Block a user