davidandClaude Sonnet 5
cd1ee3631d
- ansible_become: true as a group_vars connection variable silently took
precedence over every task-level `become: false` in this repo, so
every "unprivileged" task (pipx installs, user script deploys,
legacy .env.local writes) was actually running as root the whole
time. Move become to a play-level keyword in site.yml instead, which
correctly loses to a task's own become: false. Also stop relying on
ansible_env.HOME (which reflected root's home once facts were
gathered under the old broken setup) and use /home/{{ remote_user }}
directly, with explicit owner/group so ownership self-heals.
- meshcore_capture: 99-user.toml.j2 now defines every broker
(including letsmesh-us/eu) fully rather than assuming
config.d/10-letsmesh.toml was auto-installed — that preset only gets
created on some install paths (fresh install) and not others
(migrate), so the old partial-override form silently dropped
brokers on migrated nodes.
- base: install libffi-dev/pkg-config on armv6 (Pi Zero W) — cffi has
no prebuilt wheel for that architecture and fails to compile
without the headers.
- dm-ashwell: migrated off the legacy layout to the current
installer's system-service layout; drop its layout override now
that it matches the group default.
- meshcore-capture-update.sh: fix a YAML folded scalar (>-) collapsing
the shebang and command onto one line, corrupting the script.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
62 lines
1.2 KiB
YAML
62 lines
1.2 KiB
YAML
---
|
|
- name: SSH — ensure current keys are authorized
|
|
ansible.posix.authorized_key:
|
|
user: "{{ remote_user }}"
|
|
key: |
|
|
{{ ssh_pubkey_dotlaptop_lin }}
|
|
{{ ssh_pubkey_dotlaptop_win }}
|
|
tags: [ssh]
|
|
|
|
- name: Install base packages
|
|
apt:
|
|
name:
|
|
- screen
|
|
- pipx
|
|
- vnstat
|
|
- git
|
|
state: present
|
|
become: true
|
|
|
|
- name: Install libffi headers (armv6 has no prebuilt cffi wheel, needs to compile it)
|
|
apt:
|
|
name:
|
|
- libffi-dev
|
|
- pkg-config
|
|
state: present
|
|
become: true
|
|
when: ansible_architecture == "armv6l"
|
|
|
|
- name: Set MOTD
|
|
template:
|
|
src: motd.j2
|
|
dest: /etc/motd
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
become: true
|
|
|
|
- name: Download Tailscale install script
|
|
get_url:
|
|
url: https://tailscale.com/install.sh
|
|
dest: /tmp/tailscale-install.sh
|
|
mode: "0755"
|
|
|
|
- name: Run Tailscale install script
|
|
shell: sh /tmp/tailscale-install.sh
|
|
args:
|
|
creates: /usr/bin/tailscale
|
|
become: true
|
|
|
|
- name: Enable and start tailscaled
|
|
systemd:
|
|
name: tailscaled
|
|
enabled: true
|
|
state: started
|
|
become: true
|
|
|
|
- name: Authenticate Tailscale
|
|
shell: tailscale up --authkey {{ tailscale_auth_key }}
|
|
become: true
|
|
when: tailscale_auth_key != ""
|
|
no_log: true
|