bvandeusen
fb579bcf97
Foundation for the Ansible automation milestone (#37) — makes the existing manual playbook runner actually executable and the schema automation-ready. - pyproject: [ansible] extra (full ansible package, batteries-included, pinned) - Dockerfile: pip install .[ansible]; add openssh-client for remote runs - models/ansible.py + migration 0012: AnsibleRun.triggered_by now nullable so automated (alert/schedule) runs need no human actor - ansible/routes.py + run_detail.html: show 'Triggered by' (username or 'system') - CI: integration lane installs .[dev,ansible]; new tests/integration/ test_ansible_foundation.py runs a real connection:local playbook end-to-end, asserts success+output, and round-trips a NULL-triggered run No extra-vars/limit/credentials/scheduling here — those are their own #37 tasks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
41 lines
1.3 KiB
Docker
41 lines
1.3 KiB
Docker
FROM python:3.13-slim
|
|
|
|
RUN DEBIAN_FRONTEND=noninteractive apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
iputils-ping \
|
|
# gosu — minimal privilege-drop tool used by entrypoint.sh
|
|
gosu \
|
|
# openssh-client — ansible-playbook reaches remote hosts over ssh
|
|
openssh-client \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Upgrade pip to suppress the version notice
|
|
RUN pip install --upgrade pip
|
|
|
|
WORKDIR /app
|
|
|
|
COPY pyproject.toml .
|
|
COPY steward/ steward/
|
|
# .[ansible] pulls the full Ansible package so the playbook runner works in-image.
|
|
RUN pip install --no-cache-dir '.[ansible]'
|
|
|
|
COPY alembic.ini .
|
|
# First-party plugins ship inside the image (bundled root at /app/plugins).
|
|
# Third-party plugins are mounted at runtime into the external root
|
|
# (STEWARD_PLUGIN_DIR, default /data/plugins).
|
|
COPY plugins/ plugins/
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
# Runtime directories — owned by app user. The container starts as root
|
|
# so the entrypoint can fix up /data permissions if needed, then drops to
|
|
# 'app' (uid 1000) via gosu before launching steward.
|
|
RUN useradd -m -u 1000 app \
|
|
&& mkdir -p /data/playbook_cache /data/plugins \
|
|
&& chown -R app:app /data /app
|
|
|
|
EXPOSE 5000
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|
|
CMD ["steward", "--host", "0.0.0.0", "--port", "5000"]
|