bvandeusen
0bf007173b
Global Ansible credentials, applied to every run (manual + alert-triggered): - core/settings.py: ansible.ssh_private_key / become_password / vault_password (plaintext at rest, masked in UI — encryption tracked in #580) + host_key_checking (default off); surfaced via to_ansible_cfg into app.config[ANSIBLE] - executor.py: pure build_credentials() materializes creds into a 0600 temp dir (--private-key, --vault-password-file, become via -e @vars-file so the password never hits argv) cleaned up in finally; pure ansible_env() sets ANSIBLE_HOST_KEY_CHECKING. build_ansible_command stays param-only - settings/routes.py + ansible.html: admin-only Credentials section, masked-update (blank keeps current, explicit Clear checkbox), reload app config on save - tests: unit (build_credentials per cred + none; ansible_env toggle); integration vault round-trip (ansible-vault encrypt a vars file, run via executor with the vault password, assert it decrypted) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
68 lines
3.7 KiB
HTML
68 lines
3.7 KiB
HTML
{# steward/templates/settings/ansible.html #}
|
|
{% extends "base.html" %}
|
|
{% block title %}Settings — Ansible — Steward{% endblock %}
|
|
{% block content %}
|
|
{% set active_tab = "ansible" %}
|
|
{% include "settings/_tabs.html" %}
|
|
|
|
<div style="max-width:720px;">
|
|
<div style="display:flex;align-items:baseline;justify-content:space-between;margin-bottom:0.75rem;">
|
|
<div class="section-title">Ansible Sources</div>
|
|
<a href="/ansible/" class="btn btn-ghost btn-sm" style="font-size:0.78rem;">Run History →</a>
|
|
</div>
|
|
<p style="color:var(--text-muted);font-size:0.84rem;margin-bottom:1rem;">
|
|
Sources are directories of playbooks — either a local path or a git repository
|
|
cloned automatically. Add as many as you need; each can be browsed and run independently.
|
|
</p>
|
|
{% include "settings/_ansible_sources.html" %}
|
|
|
|
{# ── Credentials ──────────────────────────────────────────────────────────── #}
|
|
{% set cfg_badge = '<span style="color:var(--green);font-size:0.72rem;">(configured)</span>' %}
|
|
{% set not_set_badge = '<span style="color:var(--text-muted);font-size:0.72rem;">(not set)</span>' %}
|
|
<div style="margin-top:2.25rem;">
|
|
<div class="section-title" style="margin-bottom:0.75rem;">Credentials</div>
|
|
<p style="color:var(--text-muted);font-size:0.84rem;margin-bottom:1rem;">
|
|
Used by every playbook run (manual and alert-triggered). Stored on the server and
|
|
never shown again after saving — leave a field blank to keep the current value.
|
|
</p>
|
|
<form method="post" action="/settings/ansible/credentials">
|
|
<div class="form-group">
|
|
<label>SSH private key {{ (cfg_badge if ssh_key_set else not_set_badge) | safe }}</label>
|
|
<textarea name="ssh_private_key" rows="4"
|
|
placeholder="-----BEGIN OPENSSH PRIVATE KEY----- … (blank = keep current)"
|
|
style="width:100%;font-family:ui-monospace,monospace;font-size:0.8rem;"></textarea>
|
|
{% if ssh_key_set %}
|
|
<label style="font-weight:normal;font-size:0.8rem;color:var(--text-muted);">
|
|
<input type="checkbox" name="clear_ssh_private_key"> Clear stored key</label>
|
|
{% endif %}
|
|
</div>
|
|
<div class="form-group">
|
|
<label>Become / sudo password {{ (cfg_badge if become_set else not_set_badge) | safe }}</label>
|
|
<input type="password" name="become_password" autocomplete="new-password"
|
|
placeholder="blank = keep current">
|
|
{% if become_set %}
|
|
<label style="font-weight:normal;font-size:0.8rem;color:var(--text-muted);">
|
|
<input type="checkbox" name="clear_become_password"> Clear</label>
|
|
{% endif %}
|
|
</div>
|
|
<div class="form-group">
|
|
<label>Vault password {{ (cfg_badge if vault_set else not_set_badge) | safe }}</label>
|
|
<input type="password" name="vault_password" autocomplete="new-password"
|
|
placeholder="blank = keep current">
|
|
{% if vault_set %}
|
|
<label style="font-weight:normal;font-size:0.8rem;color:var(--text-muted);">
|
|
<input type="checkbox" name="clear_vault_password"> Clear</label>
|
|
{% endif %}
|
|
</div>
|
|
<div class="form-group">
|
|
<label style="display:flex;align-items:center;gap:0.5rem;font-weight:normal;">
|
|
<input type="checkbox" name="host_key_checking" {% if host_key_checking %}checked{% endif %}>
|
|
Enforce SSH host-key checking <span style="color:var(--text-muted);font-size:0.78rem;">(off by default for homelab convenience)</span>
|
|
</label>
|
|
</div>
|
|
<button type="submit" class="btn">Save credentials</button>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
{% endblock %}
|