Clément Désiles
174a96eefc
The archlinux and zfs roles temporarily write `%wheel ALL=(ALL) NOPASSWD: ALL` to /etc/sudoers so makepkg/paru can run unattended, then restore it in a following task. Since the restore was a plain sibling task, any failure in between aborted the play and left the host with passwordless root for the whole wheel group. Move the restore into `always:` so it runs on failure too, and narrow the window in yay.yml to just the makepkg call (dependency install, directory setup and git clone no longer run inside it). This is not hypothetical: a provisioning run of omega failed on paru's git clone and left the sudoers hack in place. The clone failed because the deprecated compile-from-source paru block, which was commented out in tree, had been re-enabled. It fed paru_git_repo into the git module, but that variable now holds a GitHub owner/repo slug for the releases API rather than a clone URL. Remove the block outright, along with the orphaned paru_src_path default; paru is installed from the release binary. Also fix the ansible-lint violations this surfaced so roles/archlinux passes the production profile: explicit `become` next to `become_user`, a pinned branch on the yay clone, and `changed_when` on the command/shell tasks.
95 lines
2.8 KiB
YAML
95 lines
2.8 KiB
YAML
---
|
|
- name: Check if zfs-linux-lts is installed
|
|
ansible.builtin.command: pacman -Qi zfs-dkms
|
|
register: zfs_dkms_installed
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
# The restore lives in `always` so it runs even when paru fails. Otherwise a
|
|
# failed build leaves the host with passwordless root for the whole wheel group.
|
|
- name: Install zfs
|
|
when: zfs_dkms_installed.stderr | length > 0
|
|
block:
|
|
- name: Disable SUDOERS password prompt for makepkg
|
|
no_log: true
|
|
ansible.builtin.lineinfile:
|
|
dest: /etc/sudoers
|
|
state: present
|
|
regexp: "^#?%wheel"
|
|
line: "%wheel ALL=(ALL) NOPASSWD: ALL"
|
|
validate: /usr/sbin/visudo -cf %s
|
|
|
|
# Note: I successfully tried zfs-linux-lts and zfs-linux-lts-headers, but
|
|
# the next kernel upgrade failed: cyclic dependency.
|
|
# Using dkms with the lts linux kernel is a better approach IMO.
|
|
- name: Install zfs
|
|
become: false
|
|
ansible.builtin.command:
|
|
cmd: "paru -S --noconfirm zfs-dkms zfs-utils"
|
|
changed_when: true
|
|
always:
|
|
- name: Restore SUDOERS password prompt after paru
|
|
no_log: true
|
|
ansible.builtin.lineinfile:
|
|
dest: /etc/sudoers
|
|
state: present
|
|
regexp: "^#?%wheel"
|
|
line: "%wheel ALL=(ALL:ALL) ALL"
|
|
validate: /usr/sbin/visudo -cf %s
|
|
|
|
- name: Check if /etc/hostid is present
|
|
ansible.builtin.stat:
|
|
path: /etc/hostid
|
|
register: hostid
|
|
changed_when: false
|
|
|
|
- name: Generate /etc/hostid if not present
|
|
when: not hostid.stat.exists
|
|
ansible.builtin.command: zgenhostid $(hostid)
|
|
- name: Check if zrepl is installed
|
|
ansible.builtin.command: pacman -Qi zrepl
|
|
register: zrepl_installed
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Install zrepl
|
|
when: zrepl_installed.stderr | length > 0
|
|
block:
|
|
- name: Disable SUDOERS password prompt for makepkg
|
|
no_log: true
|
|
ansible.builtin.lineinfile:
|
|
dest: /etc/sudoers
|
|
state: present
|
|
regexp: "^#?%wheel"
|
|
line: "%wheel ALL=(ALL) NOPASSWD: ALL"
|
|
validate: /usr/sbin/visudo -cf %s
|
|
|
|
- name: Install zrepl
|
|
become: false
|
|
ansible.builtin.command:
|
|
cmd: "paru -S --noconfirm zrepl"
|
|
changed_when: true
|
|
always:
|
|
- name: Restore SUDOERS password prompt after paru
|
|
no_log: true
|
|
ansible.builtin.lineinfile:
|
|
dest: /etc/sudoers
|
|
state: present
|
|
regexp: "^#?%wheel"
|
|
line: "%wheel ALL=(ALL:ALL) ALL"
|
|
validate: /usr/sbin/visudo -cf %s
|
|
|
|
- name: Enable zfs services
|
|
ansible.builtin.service:
|
|
name: "{{ item }}"
|
|
enabled: true
|
|
state: started
|
|
loop:
|
|
- zfs.target
|
|
- zfs-import.target
|
|
- zfs-volumes.target
|
|
- zfs-import-scan.service
|
|
- zfs-volume-wait.service
|
|
# Please note /etc/zfs/zpool.cache should not be present, as it is deprecated
|
|
# and we are using zfs-import-scan.service, which rely on blkid.
|