mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Fable 5
e2f8d4c304
Two wrapper behaviours move onto single sources of truth: Exec timeout: SYS_TIMEOUT_CONTAINER_EXEC (07_schedule.yml, default 7d so a hard kill never beats a production migration; the dev/CI inventory tightens it to 60min) reaches every task host via the play environment as CONTAINER_EXEC_TIMEOUT. The wrapper prefixes only the exec subcommand with coreutils timeout --kill-after=15. Ansible task timeouts are SIGALRM-based and slept through the last wedged docker socket for 4.5 hours; the OS level kill still fires there and returns 124, which until/failed_when and the rescue diagnostics react to. Unset or 0 keeps todays behaviour. CA container paths: the bind-mount targets for the injected root CA and wrapper script lived as string literals in container.py, compose_ca.py and the filter plugin. They now live once in the CA_TRUST group_vars SPOT (inject_cert_container, inject_wrapper_container) and reach container.py as env vars (play environment plus CA_TRUST_SYSTEMD_ENV) and compose_ca.py as CLI arguments built by the compose_ca_inject_cmd lookup. A caller that provides the host CA env but not the container paths is half-migrated and fails loudly instead of silently dropping CA injection; a host without any CA env keeps the soft fallback. All tests read the paths from the SPOT, and a regression test asserts the runtime scripts carry no literal copy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
---
|
|
- name: "Execute Infinito.Nexus Play"
|
|
hosts: all
|
|
any_errors_fatal: true
|
|
environment:
|
|
CA_TRUST_CERT_HOST: "{{ CA_TRUST.cert_host }}"
|
|
CA_TRUST_WRAPPER_HOST: "{{ CA_TRUST.wrapper_host }}"
|
|
CA_TRUST_NAME: "{{ CA_TRUST.trust_name }}"
|
|
CA_TRUST_CERT_CONTAINER: "{{ CA_TRUST.inject_cert_container }}"
|
|
CA_TRUST_WRAPPER_CONTAINER: "{{ CA_TRUST.inject_wrapper_container }}"
|
|
CA_CONTAINER_ENABLED: "{{ CA_CONTAINER_ENABLED | int }}"
|
|
COMPOSE_HTTP_TIMEOUT: "600"
|
|
DOCKER_CLIENT_TIMEOUT: "600"
|
|
DOCKER_BUILDKIT: "{{ BUILDKIT_ENABLED | int }}"
|
|
COMPOSE_DOCKER_CLI_BUILD: "{{ BUILDKIT_ENABLED | int }}"
|
|
INFINITO_RESCUE_DIAGNOSTICS_DIR: "{{ DIR_RESCUE_DIAGNOSTICS }}"
|
|
CONTAINER_EXEC_TIMEOUT: "{{ SYS_TIMEOUT_CONTAINER_EXEC }}"
|
|
tasks:
|
|
- name: "Load 'constructor' tasks"
|
|
include_tasks: "tasks/stages/01_constructor.yml"
|
|
|
|
- name: Load host-type stages
|
|
ansible.builtin.include_tasks: "tasks/stages/02_{{ item }}.yml"
|
|
loop: "{{ group_names | get_deployment_types_from_groups }}"
|
|
|
|
- name: "Load 'destructor' tasks"
|
|
include_tasks: "tasks/stages/03_destructor.yml"
|
|
become: true
|