75 lines
2.4 KiB
YAML
75 lines
2.4 KiB
YAML
---
|
||
# 仅在 Terraform 身份配置完成后部署；预检失败不启用定时器。
|
||
- name: 安装独立于人工会话的续签调度
|
||
hosts: etcd-laptop
|
||
become: true
|
||
gather_facts: false
|
||
tasks:
|
||
- name: 创建 root 管理的程序目录
|
||
ansible.builtin.file:
|
||
path: /opt/homelab-etcd-controller
|
||
state: directory
|
||
mode: '0755'
|
||
- name: 安装证书登录与调度程序
|
||
ansible.builtin.copy:
|
||
src: "../controller/{{ item }}"
|
||
dest: "/opt/homelab-etcd-controller/{{ item }}"
|
||
owner: root
|
||
group: root
|
||
mode: '0755'
|
||
loop: [login.py, renew.py]
|
||
- name: 以机器身份预检（不输出 token）
|
||
ansible.builtin.command:
|
||
argv: [/usr/bin/python3, /opt/homelab-etcd-controller/login.py]
|
||
changed_when: false
|
||
no_log: true
|
||
- name: 安装固定的 Ansible 配置副本
|
||
ansible.builtin.copy:
|
||
src: "{{ playbook_dir }}/"
|
||
dest: /opt/homelab-etcd-controller/ansible/
|
||
owner: root
|
||
group: root
|
||
mode: preserve
|
||
- name: 创建调度状态目录
|
||
ansible.builtin.file:
|
||
path: /var/lib/homelab-etcd-controller
|
||
state: directory
|
||
owner: panxiao81
|
||
group: panxiao81
|
||
mode: '0700'
|
||
- name: 安装续签 oneshot unit
|
||
ansible.builtin.copy:
|
||
dest: /etc/systemd/system/homelab-etcd-renew.service
|
||
mode: '0644'
|
||
content: |
|
||
[Unit]
|
||
Description=Renew shared etcd certificates through Bao machine identity
|
||
After=network-online.target
|
||
[Service]
|
||
Type=oneshot
|
||
User=panxiao81
|
||
Environment=HOME=/home/panxiao81
|
||
Environment=PATH=/home/panxiao81/.local/bin:/usr/local/bin:/usr/bin:/bin
|
||
ExecStart=/usr/bin/python3 /opt/homelab-etcd-controller/renew.py
|
||
TimeoutStartSec=30min
|
||
UMask=0077
|
||
- name: 安装每日续签 timer
|
||
ansible.builtin.copy:
|
||
dest: /etc/systemd/system/homelab-etcd-renew.timer
|
||
mode: '0644'
|
||
content: |
|
||
[Unit]
|
||
Description=Daily shared etcd certificate renewal check
|
||
[Timer]
|
||
OnCalendar=*-*-* 04:10:00 UTC
|
||
RandomizedDelaySec=15min
|
||
Persistent=true
|
||
[Install]
|
||
WantedBy=timers.target
|
||
- name: 启用续签调度
|
||
ansible.builtin.systemd_service:
|
||
name: homelab-etcd-renew.timer
|
||
daemon_reload: true
|
||
enabled: true
|
||
state: started
|