bvandeusen
42f7840c26
Extend the playbook metadata convention with a namespaced `# steward:<key>:` comment block: - steward:category — free-text grouping label, shown as a badge in the browse list and on the run form. - steward:confirm — true/yes/1/on marks a playbook destructive; the run form then requires a confirmation tick (required checkbox in the shared vars fragment) before it can launch. sources.discover_playbook_meta() parses description + category + confirm (first match per key; `# description:` still primary, `# steward:description:` alias). discover_playbook_description() now delegates to it. The browse list reads per-playbook meta to show category badges + descriptions; the run-form and playbook-vars fragments render the badge + confirm gate. Bundled playbooks tagged: docker_prune → category maintenance + confirm true; provision/install/update → category host-agent. Docs: docs/reference/playbook-authoring.md updated (keys now implemented) and a quick reference added next to the code at steward/ansible/PLAYBOOK_CONVENTIONS.md. Tests added for category/confirm/alias parsing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
97 lines
3.0 KiB
YAML
97 lines
3.0 KiB
YAML
---
|
|
# description: Install or re-enroll the Steward host agent on an already-provisioned host.
|
|
# steward:category: host-agent
|
|
# Install (or update) the Steward host agent on a target. Mirrors the
|
|
# curl-based install.sh. Pass the per-host registration token as extra-vars:
|
|
# steward_url=https://steward.example steward_token=<token from Host Agents>
|
|
# Re-running updates agent.py in place and restarts the service.
|
|
- name: Install Steward host agent
|
|
hosts: all
|
|
become: true
|
|
gather_facts: false
|
|
# steward_token is a per-host inventory var — not declared here, or a play var
|
|
# would outrank and shadow it. steward_url arrives as an extra-var.
|
|
vars:
|
|
steward_url: ""
|
|
agent_interval: 30
|
|
tasks:
|
|
- name: Require steward_url and steward_token
|
|
ansible.builtin.assert:
|
|
that:
|
|
- steward_url | default('') | length > 0
|
|
- steward_token | default('') | length > 0
|
|
fail_msg: "Pass steward_url and steward_token (Steward injects these)."
|
|
|
|
- name: Create steward-agent system user
|
|
ansible.builtin.user:
|
|
name: steward-agent
|
|
system: true
|
|
shell: /usr/sbin/nologin
|
|
create_home: false
|
|
|
|
- name: Create agent directory
|
|
ansible.builtin.file:
|
|
path: /usr/local/lib/steward-agent
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Download agent.py
|
|
ansible.builtin.get_url:
|
|
url: "{{ steward_url }}/plugins/host_agent/agent.py"
|
|
dest: /usr/local/lib/steward-agent/agent.py
|
|
mode: "0755"
|
|
force: true
|
|
notify: restart steward-agent
|
|
|
|
- name: Write agent config
|
|
ansible.builtin.copy:
|
|
dest: /etc/steward-agent.conf
|
|
owner: root
|
|
group: steward-agent
|
|
mode: "0640"
|
|
content: |
|
|
url = {{ steward_url }}
|
|
token = {{ steward_token }}
|
|
interval_seconds = {{ agent_interval }}
|
|
notify: restart steward-agent
|
|
|
|
- name: Install systemd unit
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/steward-agent.service
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=Steward host agent
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=steward-agent
|
|
Environment=STEWARD_AGENT_CONFIG=/etc/steward-agent.conf
|
|
ExecStart=/usr/bin/env python3 /usr/local/lib/steward-agent/agent.py
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
NoNewPrivileges=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
notify: restart steward-agent
|
|
|
|
- name: Enable and start the agent
|
|
ansible.builtin.systemd:
|
|
name: steward-agent
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
handlers:
|
|
- name: restart steward-agent
|
|
ansible.builtin.systemd:
|
|
name: steward-agent
|
|
state: restarted
|
|
daemon_reload: true
|