alexandre.pires
040f7a382f
- Created a new Ansible playbook for configuring macOS development stations. - Added role `macos_dev_station` with default variables, handlers, and tasks. - Implemented tasks for installing Homebrew packages, managing user configurations, and setting up launch agents for code-server and opencode. - Included templates for launchd plist files and startup scripts for code-server and opencode. - Added validation for required environment variables and configurations. - Updated inventory to include macOS hosts and added a setup script for initial prerequisites. - Modified Terraform configuration to include DNS records for new services.
153 lines
4.6 KiB
Markdown
153 lines
4.6 KiB
Markdown
# Legal Notice
|
|
|
|
This is part of A13Labs project, any unauthorized copy is no allowed. If you got access to this
|
|
code DELETE immediately. We have been warned.
|
|
|
|
# Updating Nextcloud
|
|
|
|
```
|
|
# Enable maintenance
|
|
/bin/occ maintenance:mode --on
|
|
# Update config.tf
|
|
# Apply
|
|
# Run maintenance operations
|
|
./bin/occ upgrade
|
|
./bin/occ db:add-missing-columns
|
|
./bin/occ db:add-missing-indices
|
|
./bin/occ db:add-missing-primary-keys
|
|
# Disable maintenance
|
|
./bin/occ maintenance:mode --off
|
|
```
|
|
|
|
# Contabo CLI
|
|
|
|
Download latest version from [here](https://github.com/contabo/cntb/releases).
|
|
|
|
Setup:
|
|
```
|
|
sectool exec cntb get instances --oauth2-clientid="$CONTABO_CLIENT_ID" --oauth2-client-secret="$CONTABO_CLIENT_SECRET" --oauth2-user="$CONTABO_API_USER" --oauth2-password="$CONTABO_API_PASSWORD"
|
|
```
|
|
|
|
# Windows
|
|
|
|
## Create a Dedicated “Ansible” User (One-Time Setup) — Linux
|
|
|
|
```
|
|
# Create the provision user (Debian/Ubuntu)
|
|
sudo useradd -m -s /bin/bash -G sudo provision
|
|
sudo passwd provision
|
|
|
|
# OR (RHEL/CentOS/Fedora)
|
|
sudo useradd -m -s /bin/bash -G wheel provision
|
|
sudo passwd provision
|
|
```
|
|
|
|
```
|
|
# Allow passwordless sudo for the provision user (recommended for Ansible)
|
|
echo 'provision ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/provision
|
|
sudo chmod 440 /etc/sudoers.d/provision
|
|
|
|
# Or edit safely:
|
|
sudo visudo -f /etc/sudoers.d/provision
|
|
# and add:
|
|
# provision ALL=(ALL) NOPASSWD:ALL
|
|
```
|
|
|
|
```
|
|
# Install SSH authorized key for the provision user (recommended over passwords)
|
|
sudo -u provision mkdir -p /home/provision/.ssh
|
|
sudo -u provision chmod 700 /home/provision/.ssh
|
|
echo "<your_public_key_here>" | sudo -u provision tee /home/provision/.ssh/authorized_keys
|
|
sudo -u provision chmod 600 /home/provision/.ssh/authorized_keys
|
|
```
|
|
|
|
Notes:
|
|
- Replace <your_public_key_here> with the actual public key.
|
|
- Use a strong password if you must set one; prefer SSH keys.
|
|
- For tighter security, restrict the sudoers entry to only the commands Ansible requires instead of ALL.
|
|
- Validate sudoers syntax with visudo to avoid lockout.
|
|
|
|
## Configure windows to allow Ansible to connect via WinRM
|
|
|
|
Copy the script located in scripts "ConfigureRemotingForAnsible.ps1" and run it on the target machine.
|
|
|
|
```
|
|
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
|
|
.\ConfigureRemotingForAnsible.ps1
|
|
```
|
|
|
|
# Using MSYS2
|
|
|
|
Upgrade your system:
|
|
|
|
```
|
|
pacman -Syu
|
|
```
|
|
|
|
Install the following packages:
|
|
|
|
```
|
|
mingw-w64-ucrt-x86_64-go
|
|
mingw-w64-ucrt-x86_64-make
|
|
mingw-w64-ucrt-x86_64-python
|
|
ucrt-w64-ucrt-x86_64-gcc
|
|
mingw-w64-ucrt-x86_64-python-cryptography
|
|
mingw-w64-ucrt-x86_64-python-paramiko
|
|
mingw-w64-ucrt-x86_64-python-rpds-py
|
|
python-lxml
|
|
mingw-w64-ucrt-x86_64-python-ruamel-yaml
|
|
mingw-w64-ucrt-x86_64-python-sspilib
|
|
unzip
|
|
```
|
|
|
|
Create a python environment use:
|
|
|
|
```
|
|
python -m venv .venv --system-site-packages
|
|
```
|
|
|
|
# macOS Dev Station
|
|
|
|
Use the repository hybrid flow: bootstrap once with shell script, then manage day-2 changes with Ansible.
|
|
|
|
## 1) Bootstrap prerequisites on the Mac
|
|
|
|
```
|
|
./scripts/setup-dev-station.sh
|
|
```
|
|
|
|
This installs only prerequisites (Homebrew, base tools, Ansible) and avoids persistent shell side effects.
|
|
|
|
## 2) Configure the Mac with Ansible
|
|
|
|
1. Add or adjust the host in `inventory/hosts` under `[darwin_dev]`.
|
|
2. Configure host vars in `ansible/host_vars/mac-01.lab.alexpires.me.yml`.
|
|
3. Run:
|
|
|
|
```
|
|
cd ansible
|
|
sectool exec ansible-playbook playbook_macos_dev_station.yml --limit darwin_dev
|
|
```
|
|
|
|
The macOS role configures tools, tmux, code-server and opencode as system launchd daemons running under a dedicated service user. This allows services to start at boot without requiring an interactive login.
|
|
|
|
OpenCode server auth is injected from environment variables. Ensure `OPENCODE_SERVER_USERNAME` and `OPENCODE_SERVER_PASSWORD` are available through `ansible/sectool.env` values before running the playbook.
|
|
code-server password auth is also env-backed. Ensure `CODE_SERVER_PASSWORD` is available through `ansible/sectool.env` values before running the playbook.
|
|
Hard mode (system daemons + dedicated service user) also requires sudo rights. Use passwordless sudo for your ansible user or set `ANSIBLE_BECOME_PASSWORD` through `ansible/sectool.env` values before running the playbook.
|
|
|
|
## 3) Optional DNS entry in dev-01 CoreDNS
|
|
|
|
From `terraform/apps/dev-01`, you can inject an optional DNS record for the Mac dev station:
|
|
|
|
```
|
|
export TF_VAR_mac_dev_station_dns_name="mac-mini"
|
|
export TF_VAR_mac_dev_station_dns_type="A"
|
|
export TF_VAR_mac_dev_station_dns_target="10.19.4.250"
|
|
|
|
sectool -f ../../../sectool.json exec tofu validate
|
|
sectool -f ../../../sectool.json exec tofu plan
|
|
sectool -f ../../../sectool.json exec tofu apply -auto-approve
|
|
```
|
|
|
|
Use `CNAME` + hostname target instead of `A` when you want an alias.
|