0318f6423f
Turn the agent-install playbook into a full provisioning + maintenance path. Solves the bootstrap chicken-and-egg: first contact uses an operator-supplied password (one run, never stored), which creates a dedicated `steward` login account with NOPASSWD sudo + Steward's managed public key. Every run thereafter connects as `steward` with the managed key — fully unattended (scheduled prune, agent updates). - core/crypto: generate_ssh_keypair() — ed25519, OpenSSH formats. - settings: ansible.ssh_public_key (non-secret, displayed) + ansible.ssh_user (default steward); to_ansible_cfg extended. - settings UI + route: "Generate managed key" (private encrypted, public shown to copy) + SSH-user field. - executor: build_bootstrap() writes a 0600 vars file (-e @file) for the per-run user/password — never argv, never DB, never logged; drops the managed key when a bootstrap password is given; --user floor from the global ssh_user when no override. - runner.trigger_run: pass-through `connection` kwarg, deliberately NOT persisted on AnsibleRun.params (password stays out of the DB). - bundled/host_agent/provision.yml: create steward user + authorized_keys + /etc/sudoers.d/steward (visudo-validated) + agent install. - host_agent: /provision route + "Provision a fresh host" card (bootstrap user/password; injects pubkey + user + token as space-safe JSON hostvars). - Dockerfile: add sshpass (Ansible shells out to it for password SSH). - tests: keypair generation + build_bootstrap (secret stays off argv). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
145 lines
6.4 KiB
HTML
145 lines
6.4 KiB
HTML
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% block title %}Host Agent — Steward{% endblock %}
|
|
{% block breadcrumb %}{{ crumbs([("Host Agents", "/plugins/host_agent/"), ("Settings", "")]) }}{% endblock %}
|
|
{% block content %}
|
|
<h1 class="page-title">Host Agent — Registered Hosts</h1>
|
|
|
|
{% if new_token %}
|
|
<div class="card" style="background:var(--accent-bg);">
|
|
<h3>New token — copy this install command now</h3>
|
|
<p style="font-size:0.82rem;color:var(--text-muted);">
|
|
This is the only time the raw token is shown. Rotate if you lose it.
|
|
</p>
|
|
<pre style="user-select:all;word-break:break-all;">curl -sSL '{{ install_url }}' | sudo sh</pre>
|
|
</div>
|
|
{% endif %}
|
|
|
|
<div class="card">
|
|
<form method="post" action="/plugins/host_agent/settings/add-host"
|
|
style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
|
|
<div class="form-group" style="margin-bottom:0;">
|
|
<label>Host name</label>
|
|
<input type="text" name="name" required>
|
|
</div>
|
|
<div class="form-group" style="margin-bottom:0;">
|
|
<label>Address (optional)</label>
|
|
<input type="text" name="address">
|
|
</div>
|
|
<button type="submit" class="btn">Add host</button>
|
|
</form>
|
|
</div>
|
|
|
|
{% if ansible_available %}
|
|
<div class="card">
|
|
<h3 style="margin-bottom:0.4rem;">Provision a fresh host</h3>
|
|
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
|
|
First contact for a host Steward can't yet reach by key. Creates a
|
|
<code>steward</code> login account with passwordless sudo, installs the managed
|
|
key, then installs the agent — over a one-time bootstrap password (used for this
|
|
run only, never stored). After this, use <strong>Deploy</strong> below for updates.
|
|
</p>
|
|
{% if not managed_key_set %}
|
|
<p style="font-size:0.85rem;color:var(--text-dim);">
|
|
No managed key yet. Generate one under <a href="/settings/ansible/">Settings → Ansible</a> first.
|
|
</p>
|
|
{% elif not (deploy_targets or deploy_groups) %}
|
|
<p style="font-size:0.85rem;color:var(--text-dim);">
|
|
No Ansible inventory targets yet. Add some under <a href="/ansible/inventory/targets">Ansible → Inventory</a>.
|
|
</p>
|
|
{% else %}
|
|
<form method="post" action="/plugins/host_agent/provision"
|
|
style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
|
|
<div class="form-group" style="margin-bottom:0;">
|
|
<label>Target</label>
|
|
<select name="inventory_scope" required>
|
|
{% for g in deploy_groups %}<option value="steward:group:{{ g.id }}">Group: {{ g.name }}</option>{% endfor %}
|
|
{% for t in deploy_targets %}<option value="steward:target:{{ t.id }}">Target: {{ t.name }}</option>{% endfor %}
|
|
</select>
|
|
</div>
|
|
<div class="form-group" style="margin-bottom:0;">
|
|
<label>Bootstrap user</label>
|
|
<input type="text" name="bootstrap_user" required placeholder="root" style="width:9rem;"
|
|
autocomplete="off">
|
|
</div>
|
|
<div class="form-group" style="margin-bottom:0;">
|
|
<label>Bootstrap password</label>
|
|
<input type="password" name="bootstrap_password" required style="width:11rem;"
|
|
autocomplete="new-password">
|
|
</div>
|
|
<div class="form-group" style="margin-bottom:0;">
|
|
<label>Report interval (s)</label>
|
|
<input type="number" name="agent_interval" value="30" min="5" style="width:7rem;">
|
|
</div>
|
|
<button type="submit" class="btn">Provision</button>
|
|
</form>
|
|
{% endif %}
|
|
</div>
|
|
|
|
<div class="card">
|
|
<h3 style="margin-bottom:0.4rem;">Deploy via Ansible</h3>
|
|
<p style="font-size:0.82rem;color:var(--text-muted);margin-bottom:0.75rem;">
|
|
Install (or update) the agent on Ansible inventory hosts in one run — no per-host <code>curl | sh</code>.
|
|
A fresh token is minted per host and injected into the run; existing agents are rotated to the new token.
|
|
</p>
|
|
{% if not (deploy_targets or deploy_groups) %}
|
|
<p style="font-size:0.85rem;color:var(--text-dim);">
|
|
No Ansible inventory targets yet. Add some under <a href="/ansible/browse">Ansible → Browse</a>.
|
|
</p>
|
|
{% else %}
|
|
<form method="post" action="/plugins/host_agent/deploy"
|
|
style="display:flex;gap:0.75rem;align-items:flex-end;flex-wrap:wrap;">
|
|
<div class="form-group" style="margin-bottom:0;">
|
|
<label>Target</label>
|
|
<select name="inventory_scope" required>
|
|
{% for g in deploy_groups %}<option value="steward:group:{{ g.id }}">Group: {{ g.name }}</option>{% endfor %}
|
|
{% for t in deploy_targets %}<option value="steward:target:{{ t.id }}">Target: {{ t.name }}</option>{% endfor %}
|
|
</select>
|
|
</div>
|
|
<div class="form-group" style="margin-bottom:0;">
|
|
<label>Report interval (s)</label>
|
|
<input type="number" name="agent_interval" value="30" min="5" style="width:7rem;">
|
|
</div>
|
|
<button type="submit" class="btn">Deploy</button>
|
|
</form>
|
|
{% endif %}
|
|
</div>
|
|
{% endif %}
|
|
|
|
<div class="card-flush">
|
|
<table class="table">
|
|
<thead>
|
|
<tr>
|
|
<th>Host</th><th>Reported IP</th><th>Agent version</th><th>Distro</th>
|
|
<th>Last seen</th><th class="td-actions">Actions</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for item in registrations %}
|
|
<tr>
|
|
<td>{{ item.host.name if item.host else item.reg.host_id }}</td>
|
|
<td>{{ item.reg.host_ip or "—" }}</td>
|
|
<td>{{ item.reg.agent_version or "—" }}</td>
|
|
<td>{{ item.reg.distro or "—" }}</td>
|
|
<td>{{ item.reg.last_seen_at.strftime("%Y-%m-%d %H:%M:%S") if item.reg.last_seen_at else "never" }}</td>
|
|
<td class="td-actions">
|
|
<form method="post" action="/plugins/host_agent/settings/{{ item.reg.host_id }}/rotate-token"
|
|
style="display:inline;"
|
|
onsubmit="return confirm('Rotate the token for this host? The existing agent will stop working until reinstalled with the new token.');">
|
|
<button type="submit" class="btn btn-ghost btn-sm">Rotate token</button>
|
|
</form>
|
|
<form method="post" action="/plugins/host_agent/settings/{{ item.reg.host_id }}/delete"
|
|
style="display:inline;"
|
|
onsubmit="return confirm('Delete this host registration? The agent will be unable to report metrics until re-registered.');">
|
|
<button type="submit" class="btn btn-danger btn-sm">Delete</button>
|
|
</form>
|
|
</td>
|
|
</tr>
|
|
{% else %}
|
|
<tr><td colspan="6" class="empty">No hosts registered. Add one above.</td></tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
{% endblock %}
|