fix(ansible): replace steward key on reprovision + distinct agent update path
CI / lint (push) Successful in 2s
CI / unit (push) Successful in 7s
CI / integration (push) Successful in 2m19s
CI / publish (push) Successful in 54s

Provisioning review corrections + the matching frontend, plus breadcrumb
header integration.

- provision.yml: authorize the managed pubkey with a regexp match on the
  ' steward-managed' comment so rotating the key REPLACES the host's steward
  key in place instead of stacking a second authorized entry. Hand-added keys
  (other comments) are untouched.
- update.yml (new): refresh agent.py + restart only. Does NOT rotate the token
  or rewrite /etc/steward-agent.conf — the host keeps its identity. Asserts the
  agent is already installed and fails clearly otherwise.
- host_agent /update route: runs update.yml as the managed steward user (no
  token minting). Token rotation stays a deliberate action.
- settings/ansible/generate-key honors a safe relative `next` redirect, so an
  inline trigger elsewhere returns to its page.
- Host Agents settings: reworked into a clear lifecycle — an intro card that
  explains it runs Ansible to deploy the agent (+ inline "generate managed key"
  warning/trigger when none exists), then three labelled cards: 1 Provision,
  2 Install/enroll, 3 Update. Each explains what it does.
- base.html: breadcrumb now renders as a kicker line directly above the page
  title (moved below alerts, tightened margin) so nested and top-level views
  share one consistent header.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-06-16 19:22:12 -04:00
parent a996cc6908
commit 6a8146b544
6 changed files with 161 additions and 43 deletions
+65 -40
View File
@@ -31,41 +31,63 @@
</div>
{% if ansible_available %}
{% set scope_select %}
<label>Target</label>
<select name="inventory_scope" required>
{% for g in deploy_groups %}<option value="steward:group:{{ g.id }}">Group: {{ g.name }}</option>{% endfor %}
{% for t in deploy_targets %}<option value="steward:target:{{ t.id }}">Target: {{ t.name }}</option>{% endfor %}
</select>
{% endset %}
<div class="card">
<h3 style="margin-bottom:0.4rem;">Provision a fresh host</h3>
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
First contact for a host Steward can't yet reach by key. Creates a
<code>steward</code> login account with passwordless sudo, installs the managed
key, then installs the agent — over a one-time bootstrap password (used for this
run only, never stored). After this, use <strong>Deploy</strong> below for updates.
<h3 style="margin-bottom:0.4rem;">Agent lifecycle via Ansible</h3>
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.6rem;">
These actions run bundled <strong>Ansible playbooks</strong> to deploy and maintain the
Steward monitoring agent on your <a href="/ansible/inventory/targets">inventory hosts</a>.
Steward generates each host's API token automatically and connects over SSH as the managed
<code>steward</code> account — you'll be dropped into the live Ansible run to watch it.
</p>
{% if not managed_key_set %}
<p style="font-size:0.85rem;color:var(--text-dim);">
No managed key yet. Generate one under <a href="/settings/ansible/">Settings → Ansible</a> first.
</p>
<div style="background:color-mix(in srgb,var(--yellow) 12%,var(--bg-elevated));
border:1px solid color-mix(in srgb,var(--yellow) 35%,var(--border));
border-radius:6px;padding:0.7rem 0.9rem;display:flex;align-items:center;
gap:0.8rem;flex-wrap:wrap;">
<span style="color:var(--yellow);"></span>
<span style="font-size:0.84rem;flex:1;min-width:14rem;">
No managed SSH key yet — Steward needs one to log into hosts as <code>steward</code>.
</span>
<form method="post" action="/settings/ansible/generate-key" style="margin:0;">
<input type="hidden" name="next" value="/plugins/host_agent/settings/">
<button type="submit" class="btn btn-sm">Generate managed key</button>
</form>
</div>
{% elif not (deploy_targets or deploy_groups) %}
<p style="font-size:0.85rem;color:var(--text-dim);">
<p style="font-size:0.85rem;color:var(--text-dim);margin:0;">
No Ansible inventory targets yet. Add some under <a href="/ansible/inventory/targets">Ansible → Inventory</a>.
</p>
{% else %}
{% endif %}
</div>
{% if managed_key_set and (deploy_targets or deploy_groups) %}
<div class="card">
<h3 style="margin-bottom:0.4rem;">1 · Provision a fresh host</h3>
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
First contact for a brand-new host. Connects with a one-time <strong>bootstrap</strong>
user + password (used for this run only, never stored), creates the <code>steward</code>
login account with passwordless sudo, installs the managed SSH key, then installs the
agent. Run this once per host.
</p>
<form method="post" action="/plugins/host_agent/provision"
style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
<div class="form-group" style="margin-bottom:0;">
<label>Target</label>
<select name="inventory_scope" required>
{% for g in deploy_groups %}<option value="steward:group:{{ g.id }}">Group: {{ g.name }}</option>{% endfor %}
{% for t in deploy_targets %}<option value="steward:target:{{ t.id }}">Target: {{ t.name }}</option>{% endfor %}
</select>
</div>
<div class="form-group" style="margin-bottom:0;">{{ scope_select }}</div>
<div class="form-group" style="margin-bottom:0;">
<label>Bootstrap user</label>
<input type="text" name="bootstrap_user" required placeholder="root" style="width:9rem;"
autocomplete="off">
<input type="text" name="bootstrap_user" required placeholder="root" style="width:9rem;" autocomplete="off">
</div>
<div class="form-group" style="margin-bottom:0;">
<label>Bootstrap password</label>
<input type="password" name="bootstrap_password" required style="width:11rem;"
autocomplete="new-password">
<input type="password" name="bootstrap_password" required style="width:11rem;" autocomplete="new-password">
</div>
<div class="form-group" style="margin-bottom:0;">
<label>Report interval (s)</label>
@@ -73,37 +95,40 @@
</div>
<button type="submit" class="btn">Provision</button>
</form>
{% endif %}
</div>
<div class="card">
<h3 style="margin-bottom:0.4rem;">Deploy via Ansible</h3>
<h3 style="margin-bottom:0.4rem;">2 · Install / enroll agent</h3>
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
Install (or update) the agent on Ansible inventory hosts in one run — no per-host <code>curl | sh</code>.
A fresh token is minted per host and injected into the run; existing agents are rotated to the new token.
For a host that's already provisioned (has the <code>steward</code> account) but has no
agent yet — or to re-enroll one. Connects as <code>steward</code> with the managed key,
mints a fresh token, and installs the agent. No <code>curl | sh</code> needed.
</p>
{% if not (deploy_targets or deploy_groups) %}
<p style="font-size:0.85rem;color:var(--text-dim);">
No Ansible inventory targets yet. Add some under <a href="/ansible/browse">Ansible → Browse</a>.
</p>
{% else %}
<form method="post" action="/plugins/host_agent/deploy"
style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
<div class="form-group" style="margin-bottom:0;">
<label>Target</label>
<select name="inventory_scope" required>
{% for g in deploy_groups %}<option value="steward:group:{{ g.id }}">Group: {{ g.name }}</option>{% endfor %}
{% for t in deploy_targets %}<option value="steward:target:{{ t.id }}">Target: {{ t.name }}</option>{% endfor %}
</select>
</div>
<div class="form-group" style="margin-bottom:0;">{{ scope_select }}</div>
<div class="form-group" style="margin-bottom:0;">
<label>Report interval (s)</label>
<input type="number" name="agent_interval" value="30" min="5" style="width:7rem;">
</div>
<button type="submit" class="btn">Deploy</button>
<button type="submit" class="btn">Install</button>
</form>
{% endif %}
</div>
<div class="card">
<h3 style="margin-bottom:0.4rem;">3 · Update agents</h3>
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
Refresh the agent binary on hosts already running it. Connects as <code>steward</code>
with the managed key and restarts the service — the token and config are left untouched,
so identity is preserved.
</p>
<form method="post" action="/plugins/host_agent/update"
style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
<div class="form-group" style="margin-bottom:0;">{{ scope_select }}</div>
<button type="submit" class="btn">Update</button>
</form>
</div>
{% endif %}
{% endif %}
<div class="card-flush">