From cd1ee3631dca028891b64d829e453e908f51f428 Mon Sep 17 00:00:00 2001 From: dotdavid Date: Tue, 7 Jul 2026 06:32:37 +0100 Subject: [PATCH] Fix become-precedence bug, dead Tailscale install path, and make meshcore config self-sufficient MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - ansible_become: true as a group_vars connection variable silently took precedence over every task-level `become: false` in this repo, so every "unprivileged" task (pipx installs, user script deploys, legacy .env.local writes) was actually running as root the whole time. Move become to a play-level keyword in site.yml instead, which correctly loses to a task's own become: false. Also stop relying on ansible_env.HOME (which reflected root's home once facts were gathered under the old broken setup) and use /home/{{ remote_user }} directly, with explicit owner/group so ownership self-heals. - meshcore_capture: 99-user.toml.j2 now defines every broker (including letsmesh-us/eu) fully rather than assuming config.d/10-letsmesh.toml was auto-installed — that preset only gets created on some install paths (fresh install) and not others (migrate), so the old partial-override form silently dropped brokers on migrated nodes. - base: install libffi-dev/pkg-config on armv6 (Pi Zero W) — cffi has no prebuilt wheel for that architecture and fails to compile without the headers. - dm-ashwell: migrated off the legacy layout to the current installer's system-service layout; drop its layout override now that it matches the group default. - meshcore-capture-update.sh: fix a YAML folded scalar (>-) collapsing the shebang and command onto one line, corrupting the script. Co-Authored-By: Claude Sonnet 5 --- ansible/group_vars/all/vars.yml | 6 +++- ansible/host_vars/dm-ashwell/vars.yml | 3 -- ansible/roles/base/tasks/main.yml | 9 +++++ ansible/roles/meshcore_capture/tasks/main.yml | 15 +++++--- .../templates/99-user.toml.j2 | 35 +++++++++++++++++-- ansible/roles/meshcore_cli/tasks/main.yml | 2 +- ansible/roles/scripts/tasks/main.yml | 8 +++-- ansible/site.yml | 1 + 8 files changed, 64 insertions(+), 15 deletions(-) diff --git a/ansible/group_vars/all/vars.yml b/ansible/group_vars/all/vars.yml index 204fb8c..6da6b0d 100644 --- a/ansible/group_vars/all/vars.yml +++ b/ansible/group_vars/all/vars.yml @@ -1,6 +1,10 @@ remote_user: david ansible_user: "{{ remote_user }}" -ansible_become: true +# become is set at the play level in site.yml, NOT here — ansible_become as a +# connection variable takes precedence over a task's own `become: false` +# keyword, which silently broke every become:false task in this repo (they +# all ran as root regardless). Play-level `become:` correctly loses to a +# task-level override. meshcore_description: "meshcore management" diff --git a/ansible/host_vars/dm-ashwell/vars.yml b/ansible/host_vars/dm-ashwell/vars.yml index abcde90..45bac93 100644 --- a/ansible/host_vars/dm-ashwell/vars.yml +++ b/ansible/host_vars/dm-ashwell/vars.yml @@ -3,6 +3,3 @@ serial_port: /dev/serial/by-id/usb-Espressif_USB_JTAG_serial_debug_unit_1C:DB:D4 # Deployed-location wifi wifi_ssid_location: "awesome" wifi_password_location: "{{ vault_wifi_location }}" - -# Predates the current upstream installer's system-service layout -meshcore_capture_layout: "legacy" diff --git a/ansible/roles/base/tasks/main.yml b/ansible/roles/base/tasks/main.yml index e229ed5..e9733cc 100644 --- a/ansible/roles/base/tasks/main.yml +++ b/ansible/roles/base/tasks/main.yml @@ -17,6 +17,15 @@ state: present become: true +- name: Install libffi headers (armv6 has no prebuilt cffi wheel, needs to compile it) + apt: + name: + - libffi-dev + - pkg-config + state: present + become: true + when: ansible_architecture == "armv6l" + - name: Set MOTD template: src: motd.j2 diff --git a/ansible/roles/meshcore_capture/tasks/main.yml b/ansible/roles/meshcore_capture/tasks/main.yml index 8379a86..b628c90 100644 --- a/ansible/roles/meshcore_capture/tasks/main.yml +++ b/ansible/roles/meshcore_capture/tasks/main.yml @@ -29,7 +29,9 @@ - name: Write .env.local config (legacy layout) template: src: env.local.j2 - dest: "{{ ansible_env.HOME }}/.meshcore-packet-capture/.env.local" + dest: "/home/{{ remote_user }}/.meshcore-packet-capture/.env.local" + owner: "{{ remote_user }}" + group: "{{ remote_user }}" mode: "0640" become: false when: meshcore_capture_layout == 'legacy' @@ -56,11 +58,12 @@ - name: Deploy meshcore-capture-update script copy: - content: >- + content: | #!/usr/bin/env bash - bash <(curl -fsSL https://raw.githubusercontent.com/agessaman/meshcore-packet-capture/main/install.sh){{ ' --update' if meshcore_capture_layout != 'legacy' else '' }} - dest: "{{ ansible_env.HOME }}/meshcore-capture-update.sh" + dest: "/home/{{ remote_user }}/meshcore-capture-update.sh" + owner: "{{ remote_user }}" + group: "{{ remote_user }}" mode: "0755" become: false @@ -69,6 +72,8 @@ content: | #!/usr/bin/env bash sudo journalctl -u {{ 'meshcore-capture' if meshcore_capture_layout == 'legacy' else 'meshcore-packet-capture' }} -f - dest: "{{ ansible_env.HOME }}/meshcore-capture-logs.sh" + dest: "/home/{{ remote_user }}/meshcore-capture-logs.sh" + owner: "{{ remote_user }}" + group: "{{ remote_user }}" mode: "0755" become: false diff --git a/ansible/roles/meshcore_capture/templates/99-user.toml.j2 b/ansible/roles/meshcore_capture/templates/99-user.toml.j2 index 6afa11d..4cfdcfd 100644 --- a/ansible/roles/meshcore_capture/templates/99-user.toml.j2 +++ b/ansible/roles/meshcore_capture/templates/99-user.toml.j2 @@ -1,9 +1,10 @@ # MeshCore Packet Capture - user overrides # Managed by Ansible - local changes will be overwritten on next playbook run # -# [[broker]] tables merge by name across config.d/*.toml, so the letsmesh-us -# and letsmesh-eu entries below only add owner identity to the connection -# details already installed as config.d/10-letsmesh.toml. +# Defines every broker fully (not relying on config.d/10-letsmesh.toml being +# auto-installed) — whether that preset exists depends on which path the +# installer took (fresh install vs migrate), so a partial override here would +# silently no-op on nodes where it wasn't created. [general] iata = "{{ packetcapture_iata }}" @@ -22,17 +23,45 @@ advert_interval_hours = {{ packetcapture_advert_interval_hours }} owner_public_key = "{{ packetcapture_owner_public_key }}" owner_email = "{{ packetcapture_owner_email }}" +# LetsMesh.net Packet Analyzer (US) [[broker]] name = "letsmesh-us" +enabled = true +server = "mqtt-us-v1.letsmesh.net" +port = 443 +transport = "websockets" +keepalive = 120 +qos = 0 +retain = true + +[broker.tls] +enabled = true +verify = true [broker.auth] +method = "token" +audience = "mqtt-us-v1.letsmesh.net" owner = "{{ packetcapture_owner_public_key }}" email = "{{ packetcapture_owner_email }}" +# LetsMesh.net Packet Analyzer (EU) [[broker]] name = "letsmesh-eu" +enabled = true +server = "mqtt-eu-v1.letsmesh.net" +port = 443 +transport = "websockets" +keepalive = 120 +qos = 0 +retain = true + +[broker.tls] +enabled = true +verify = true [broker.auth] +method = "token" +audience = "mqtt-eu-v1.letsmesh.net" owner = "{{ packetcapture_owner_public_key }}" email = "{{ packetcapture_owner_email }}" diff --git a/ansible/roles/meshcore_cli/tasks/main.yml b/ansible/roles/meshcore_cli/tasks/main.yml index 3e42cfe..baf26ee 100644 --- a/ansible/roles/meshcore_cli/tasks/main.yml +++ b/ansible/roles/meshcore_cli/tasks/main.yml @@ -11,5 +11,5 @@ shell: pipx install meshcore-cli args: executable: /bin/bash - creates: "{{ ansible_env.HOME }}/.local/bin/meshcore-cli" + creates: "/home/{{ remote_user }}/.local/bin/meshcore-cli" become: false diff --git a/ansible/roles/scripts/tasks/main.yml b/ansible/roles/scripts/tasks/main.yml index ae6b639..3fa8611 100644 --- a/ansible/roles/scripts/tasks/main.yml +++ b/ansible/roles/scripts/tasks/main.yml @@ -2,13 +2,17 @@ - name: Deploy voltage.sh copy: src: voltage.sh - dest: "{{ ansible_env.HOME }}/voltage.sh" + dest: "/home/{{ remote_user }}/voltage.sh" + owner: "{{ remote_user }}" + group: "{{ remote_user }}" mode: "0755" become: false - name: Deploy bandwidth.sh copy: src: bandwidth.sh - dest: "{{ ansible_env.HOME }}/bandwidth.sh" + dest: "/home/{{ remote_user }}/bandwidth.sh" + owner: "{{ remote_user }}" + group: "{{ remote_user }}" mode: "0755" become: false diff --git a/ansible/site.yml b/ansible/site.yml index 9221ab2..e0b4289 100644 --- a/ansible/site.yml +++ b/ansible/site.yml @@ -1,6 +1,7 @@ --- - name: Deploy MeshCore monitoring nodes hosts: meshcore + become: true vars_prompt: - name: tailscale_auth_key prompt: "Tailscale auth key (leave blank to skip)"