Fix become-precedence bug, dead Tailscale install path, and make meshcore config self-sufficient

- ansible_become: true as a group_vars connection variable silently took
  precedence over every task-level `become: false` in this repo, so
  every "unprivileged" task (pipx installs, user script deploys,
  legacy .env.local writes) was actually running as root the whole
  time. Move become to a play-level keyword in site.yml instead, which
  correctly loses to a task's own become: false. Also stop relying on
  ansible_env.HOME (which reflected root's home once facts were
  gathered under the old broken setup) and use /home/{{ remote_user }}
  directly, with explicit owner/group so ownership self-heals.
- meshcore_capture: 99-user.toml.j2 now defines every broker
  (including letsmesh-us/eu) fully rather than assuming
  config.d/10-letsmesh.toml was auto-installed — that preset only gets
  created on some install paths (fresh install) and not others
  (migrate), so the old partial-override form silently dropped
  brokers on migrated nodes.
- base: install libffi-dev/pkg-config on armv6 (Pi Zero W) — cffi has
  no prebuilt wheel for that architecture and fails to compile
  without the headers.
- dm-ashwell: migrated off the legacy layout to the current
  installer's system-service layout; drop its layout override now
  that it matches the group default.
- meshcore-capture-update.sh: fix a YAML folded scalar (>-) collapsing
  the shebang and command onto one line, corrupting the script.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

ansible/roles/base/tasks/main.yml

@@ -17,6 +17,15 @@
     state: present
   become: true
 
+- name: Install libffi headers (armv6 has no prebuilt cffi wheel, needs to compile it)
+  apt:
+    name:
+      - libffi-dev
+      - pkg-config
+    state: present
+  become: true
+  when: ansible_architecture == "armv6l"
+
 - name: Set MOTD
   template:
     src: motd.j2

ansible/roles/meshcore_capture/tasks/main.yml

@@ -29,7 +29,9 @@
 - name: Write .env.local config (legacy layout)
   template:
     src: env.local.j2
-    dest: "{{ ansible_env.HOME }}/.meshcore-packet-capture/.env.local"
+    dest: "/home/{{ remote_user }}/.meshcore-packet-capture/.env.local"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0640"
   become: false
   when: meshcore_capture_layout == 'legacy'
@@ -56,11 +58,12 @@
 
 - name: Deploy meshcore-capture-update script
   copy:
-    content: >-
+    content: |
       #!/usr/bin/env bash
-
       bash <(curl -fsSL https://raw.githubusercontent.com/agessaman/meshcore-packet-capture/main/install.sh){{ ' --update' if meshcore_capture_layout != 'legacy' else '' }}
-    dest: "{{ ansible_env.HOME }}/meshcore-capture-update.sh"
+    dest: "/home/{{ remote_user }}/meshcore-capture-update.sh"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0755"
   become: false
 
@@ -69,6 +72,8 @@
     content: |
       #!/usr/bin/env bash
       sudo journalctl -u {{ 'meshcore-capture' if meshcore_capture_layout == 'legacy' else 'meshcore-packet-capture' }} -f
-    dest: "{{ ansible_env.HOME }}/meshcore-capture-logs.sh"
+    dest: "/home/{{ remote_user }}/meshcore-capture-logs.sh"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0755"
   become: false

ansible/roles/meshcore_capture/templates/99-user.toml.j2

@@ -1,9 +1,10 @@
 # MeshCore Packet Capture - user overrides
 # Managed by Ansible - local changes will be overwritten on next playbook run
 #
-# [[broker]] tables merge by name across config.d/*.toml, so the letsmesh-us
-# and letsmesh-eu entries below only add owner identity to the connection
-# details already installed as config.d/10-letsmesh.toml.
+# Defines every broker fully (not relying on config.d/10-letsmesh.toml being
+# auto-installed) — whether that preset exists depends on which path the
+# installer took (fresh install vs migrate), so a partial override here would
+# silently no-op on nodes where it wasn't created.
 
 [general]
 iata = "{{ packetcapture_iata }}"
@@ -22,17 +23,45 @@ advert_interval_hours = {{ packetcapture_advert_interval_hours }}
 owner_public_key = "{{ packetcapture_owner_public_key }}"
 owner_email = "{{ packetcapture_owner_email }}"
 
+# LetsMesh.net Packet Analyzer (US)
 [[broker]]
 name = "letsmesh-us"
+enabled = true
+server = "mqtt-us-v1.letsmesh.net"
+port = 443
+transport = "websockets"
+keepalive = 120
+qos = 0
+retain = true
+
+[broker.tls]
+enabled = true
+verify = true
 
 [broker.auth]
+method = "token"
+audience = "mqtt-us-v1.letsmesh.net"
 owner = "{{ packetcapture_owner_public_key }}"
 email = "{{ packetcapture_owner_email }}"
 
+# LetsMesh.net Packet Analyzer (EU)
 [[broker]]
 name = "letsmesh-eu"
+enabled = true
+server = "mqtt-eu-v1.letsmesh.net"
+port = 443
+transport = "websockets"
+keepalive = 120
+qos = 0
+retain = true
+
+[broker.tls]
+enabled = true
+verify = true
 
 [broker.auth]
+method = "token"
+audience = "mqtt-eu-v1.letsmesh.net"
 owner = "{{ packetcapture_owner_public_key }}"
 email = "{{ packetcapture_owner_email }}"
 

ansible/roles/meshcore_cli/tasks/main.yml

@@ -11,5 +11,5 @@
   shell: pipx install meshcore-cli
   args:
     executable: /bin/bash
-    creates: "{{ ansible_env.HOME }}/.local/bin/meshcore-cli"
+    creates: "/home/{{ remote_user }}/.local/bin/meshcore-cli"
   become: false

ansible/roles/scripts/tasks/main.yml

@@ -2,13 +2,17 @@
 - name: Deploy voltage.sh
   copy:
     src: voltage.sh
-    dest: "{{ ansible_env.HOME }}/voltage.sh"
+    dest: "/home/{{ remote_user }}/voltage.sh"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0755"
   become: false
 
 - name: Deploy bandwidth.sh
   copy:
     src: bandwidth.sh
-    dest: "{{ ansible_env.HOME }}/bandwidth.sh"
+    dest: "/home/{{ remote_user }}/bandwidth.sh"
+    owner: "{{ remote_user }}"
+    group: "{{ remote_user }}"
     mode: "0755"
   become: false