0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

History

kevinveenbirkenbachandClaude Opus 5 3b2761c15f perf(deploy): run the per-host setup once per host, not once per application

Two probes that describe a host were re-running per application. Measured in CI
run wp-swarm-tor2: 42 invocations of the pip probe and 44 of the NFS assert.

sys-pip-install guarded only its dependency include. Everything expensive sat
below that guard in main.yml, unguarded: resolving the interpreter, probing pip
for --break-system-packages, checking for `packaging` and bootstrapping it. All
four ran on every one of the 21 include sites. They move into 00_core.yml, where
the existing `when: run_once_sys_pip_install is not defined` covers them, and
main.yml keeps the guarded include and the pip task itself. The role recap reads
sys-pip-install ---- 87.35s.

The two facts this freezes per host are run constants: ansible_python_interpreter
is pinned once in group_vars/all/00_general.yml and no call site overrides it,
and all 21 sites pass global_install: true. main.yml now defends the probe fact
with `| default(false)` the way 00_core.yml already did, because the probe sits
behind `when: global_install | bool` and a first invocation with false would
otherwise leave it undefined for every later one.

The NFS assert emulated a per-host check with run_once plus delegate_to over
groups['svc-swarm-node'], and the include it lives in happens per application.
It becomes a plain per-host task in sys-svc-compose/00_core.yml, which main.yml
already gates once per host per play: 44 instances and 132 remote commands
become 4 and 4. Dropping run_once also removes a real fragility — at log line
35355 only wrk-01 and wrk-02 reach the include because mgr-01's flag is already
set, so run_once there designates a host that skipped.

It reaches the same hosts as the loop it replaces, measured rather than assumed:
sys-svc-compose/00_core fires only on mgr-01, wrk-01 and wrk-02, the backup play
never runs it, and nfs-server and bkp-01 never execute it. The two conditions
that do not travel are a per-application volume count, meaningless for a
per-host check, and an exemption for manager-placed roles — mgr-01 answered the
assert ok 14 times out of 14, so the exemption was hiding nothing.

The assert is appended to 00_core.yml rather than prepended: utils/once/flag.yml
must stay that file's first task for test_service_core_first_task_run_once.

Worth 128.6s: 84.6s from the pip probe and 44.0s from the assert.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-14 20:13:57 +02:00

defaults

…

README.md

sys-pip-install

Description

This role installs or upgrades a Python package system-wide using the system pip (python3 -m pip). It is intended for CLI tools that should be available globally (e.g., maintenance utilities).

This role depends on sys-pip, which ensures that pip is installed on the target system.

Overview

Ensures the system pip is available (via sys-pip).
Installs or upgrades a package specified by package_name.
Designed for non-interactive automation (CI/maintenance hosts).

Cosmos

The diagram places sys-pip-install in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-pip-install 💻]
        svc_pip_install["pip-install"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features

Automated provisioning: Configured by Ansible without manual steps.

Variables

Required

package_name (string)
Name of the Python package to install (e.g., dockreap, backup-docker-to-local).

Notes / Caveats

The role checks whether pip from ansible_python_interpreter supports --break-system-packages and only uses it (plus PIP_BREAK_SYSTEM_PACKAGES=1) when available. This keeps the role compatible with older pip versions (e.g., some CentOS/RHEL systems).
Use with care: installing Python packages system-wide can conflict with OS package management. For isolated installs of CLI tools, consider pipx instead.

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).