feat(ansible): update playbook to install ssh_locker service and create shared socket directory

ansible/playbook_systools.yml

@@ -7,7 +7,8 @@
   tasks:
     - name: Set required facts
       ansible.builtin.set_fact:
-        systools_verion: " {{ systools_version | default('0.0.1') }}"
+        systools_version: "{{ systools_version | default('0.2.0') }}"
+        ssh_locker_timeout: "{{ ssh_locker_timeout | default('5m') }}"
       tags: always
 
     - name: Download systools zip file
@@ -17,6 +18,8 @@
         mode: '0644'
 
     - name: Unpack systools zip file
+      become: true
+      failed_when: false
       ansible.builtin.unarchive:
         src: /tmp/systools-v{{ systools_version }}-linux-amd64.zip
         dest: /usr/local/bin
@@ -31,6 +34,7 @@
         state: absent
 
     - name: Set root-only executable permissions for specific tools
+      become: true
       ansible.builtin.file:
         path: /usr/local/bin/{{ item }}
         mode: '0700'
@@ -38,3 +42,39 @@
         - open_volume
         - read_system_id
         - k8s_encryption_provider
+
+    - name: Create shared socket directory
+      become: true
+      ansible.builtin.file:
+        path: /var/run/ssh_locker
+        state: directory
+        mode: '0777'
+
+    - name: Install ssh_locker service
+      become: true
+      ansible.builtin.template:
+        src: ssh_locker.service.j2
+        dest: /etc/systemd/system/ssh_locker.service
+        mode: '0644'
+      notify:
+        - Reload systemd daemon
+        - Enable ssh_locker service
+        - Start ssh_locker service
+
+  handlers:
+    - name: Reload systemd daemon
+      become: true
+      ansible.builtin.systemd:
+        daemon_reload: true
+
+    - name: Enable ssh_locker service
+      become: true
+      ansible.builtin.systemd:
+        name: ssh_locker
+        enabled: true
+
+    - name: Start ssh_locker service
+      become: true
+      ansible.builtin.systemd:
+        name: ssh_locker
+        state: started

ansible/templates/ssh_locker.service.j2

@@ -0,0 +1,13 @@
+[Unit]
+Description=AWS Encryption Provider
+After=network.target
+
+[Service]
+Type=simple
+User={{ ansible_user }}
+Environment="HOME=/home/{{ ansible_user }}"
+ExecStart=/usr/local/bin/ssh_locker -s /var/run/ssh_locker/provision.sock -t {{ ssh_locker_timeout }}
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target