mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-08-26 21:45:20 +02:00
Kevin Veen-Birkenbach
79e702a3ab
- sys-service:
- Set explicit ownership and permissions for generated unit files:
owner=root, group=root, mode=0644. Prevents drift and makes idempotence
predictable when handlers reload/refresh systemd.
- web-svc-collabora:
- Move cmp-docker-proxy include into tasks/01_core.yml and run it
before Nginx config generation. Use public: true only to initialize the
proxy/compose context and docker_compose_flush_handlers: true to ensure
timely handler execution.
- Define role-local variables domain and http_port in vars/main.yml
and use {{ domain }} for the Nginx server file path. These values MUST
be defined locally because they cannot be reliably imported via
public: true — other roles may override them later in the play, leading
to leakage and nondeterministic behavior. Localizing avoids precedence
conflicts without resorting to host-wide set_fact.
- CSP adjusted: add server.security.flags.style-src.unsafe-inline: true
to accommodate Collabora’s inline styles (requested as “csr” in notes).
- Minor variable alignment/cleanup and TODO note for future refactor.
- Housekeeping:
- Rename task title to reflect {{ domain }} usage.
Refs:
- Discussion and rationale in this chat https://chatgpt.com/share/68a731aa-d394-800f-9eb4-2499f45ed54b (2025-08-21, Europe/Berlin).
49 lines
1.5 KiB
YAML
49 lines
1.5 KiB
YAML
- name: Resolve systemctl template source
|
|
set_fact:
|
|
system_service_template_src: >-
|
|
{{ lookup(
|
|
'first_found',
|
|
{
|
|
'files': [
|
|
'templates/systemctl@.service.j2',
|
|
'templates/systemctl.service.j2'
|
|
],
|
|
'paths': [
|
|
system_service_role_dir,
|
|
role_path
|
|
]
|
|
},
|
|
errors='strict'
|
|
) }}
|
|
|
|
- name: Ensure a systemctl template was found
|
|
assert:
|
|
that: system_service_template_src | length > 0
|
|
fail_msg: >-
|
|
Could not resolve any systemctl template. Looked in:
|
|
{{ system_service_role_dir }}/templates/ and {{ role_path }}/templates/.
|
|
when: MODE_ASSERT | bool
|
|
|
|
- name: Flag whether @-template is used
|
|
set_fact:
|
|
system_service_uses_at: "{{ system_service_id.endswith('@') }}"
|
|
|
|
- name: "setup systemctl '{{ system_service_id }}'"
|
|
template:
|
|
src: "{{ system_service_template_src }}"
|
|
dest: "{{ [ PATH_SYSTEM_SERVICE_DIR, system_service_id | get_service_name(SOFTWARE_NAME) ] | path_join }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
notify: "{{ 'reload system daemon' if system_service_uses_at else 'refresh systemctl service' }}"
|
|
|
|
- name: refresh systemctl service when SYS_SERVICE_ALL_ENABLE
|
|
block:
|
|
- command: /bin/true
|
|
notify: reload system daemon
|
|
- command: /bin/true
|
|
notify: refresh systemctl service
|
|
when: not system_service_uses_at
|
|
when: SYS_SERVICE_ALL_ENABLED | bool
|
|
|