alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
Files
8724360fb249f683b4e46e7980355589e578a388
a13labs.infra/ansible/roles/macos_dev_station/tasks/main.yml
T
alexandre.pires 5818b05d96 Enhance Linux and macOS development station configurations: 
- Add user management and Oh My Zsh settings
- Update service scripts to use Zsh
- Include new packages and environment variables
- Modify Terraform configuration for upstream services
2026-07-10 17:15:24 -04:00

618 lines
22 KiB
YAML
Raw Blame History

---
- name: Ensure host is macOS
ansible.builtin.assert:
that:
- ansible_system == "Darwin"
fail_msg: "Role macos_dev_station supports macOS hosts only"
- name: Ensure launchd mode is valid
ansible.builtin.assert:
that:
- macos_dev_station_launchd_mode == "daemon"
fail_msg: "macos_dev_station currently supports daemon mode only. Set macos_dev_station_launchd_mode to 'daemon'."
- name: Check passwordless sudo availability for daemon mode
ansible.builtin.command: sudo -n true
register: __macos_dev_station_sudo_check
changed_when: false
failed_when: false
- name: Ensure sudo access is available for daemon mode
ansible.builtin.assert:
that:
- __macos_dev_station_sudo_check.rc == 0 or (ansible_become_password | default('') | length > 0)
fail_msg: "Daemon mode needs sudo. Configure passwordless sudo for ansible user or set ANSIBLE_BECOME_PASSWORD via sectool."
- name: Ensure OpenCode server credentials are provided
ansible.builtin.assert:
that:
- macos_dev_station_opencode_server_username | length > 0
- macos_dev_station_opencode_server_password | length > 0
fail_msg: "Set OPENCODE_SERVER_USERNAME and OPENCODE_SERVER_PASSWORD in environment (recommended via sectool) before running the playbook."
when: macos_dev_station_opencode_launchd_enabled | bool
- name: Ensure code-server password is provided
ansible.builtin.assert:
that:
- macos_dev_station_code_server_password | length > 0
fail_msg: "Set CODE_SERVER_PASSWORD in environment (recommended via sectool) before running the playbook."
when:
- macos_dev_station_code_server_launchd_enabled | bool
- macos_dev_station_code_server_auth == "password"
- name: Install Homebrew packages
become: false
community.general.homebrew:
name: "{{ macos_dev_station_brew_packages }}"
state: present
- name: Ensure dedicated service user exists
become: true
ansible.builtin.user:
name: "{{ macos_dev_station_service_user }}"
shell: "{{ (macos_dev_station_service_user_ssh_enabled | bool) | ternary(macos_dev_station_service_user_ssh_shell, macos_dev_station_service_shell) }}"
home: "{{ macos_dev_station_service_home }}"
create_home: true
state: present
when: macos_dev_station_service_user_enabled | bool
- name: Discover npm executable path
ansible.builtin.command: /bin/sh -lc "command -v npm"
register: __macos_npm_path
changed_when: false
failed_when: __macos_npm_path.rc != 0
environment:
PATH: "{{ macos_dev_station_path }}"
when: macos_dev_station_npm_packages | length > 0
- name: Install global npm packages
community.general.npm:
name: "{{ item.name }}"
version: "{{ item.version }}"
executable: "{{ __macos_npm_path.stdout | trim }}"
global: true
environment:
PATH: "{{ macos_dev_station_path }}"
loop: "{{ macos_dev_station_npm_packages }}"
when: macos_dev_station_npm_packages | length > 0
- name: Ensure required user directories exist
become: true
ansible.builtin.file:
path: "{{ item }}"
state: directory
mode: "0750"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
loop:
- "{{ macos_dev_station_service_home }}"
- "{{ macos_dev_station_workspace_dir }}"
- "{{ macos_dev_station_scripts_dir }}"
- "{{ macos_dev_station_logs_dir }}"
- name: Ensure service home permissions are restrictive
become: true
ansible.builtin.file:
path: "{{ macos_dev_station_service_home }}"
state: directory
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
mode: "0700"
- name: Ensure service user config directories exist
become: true
ansible.builtin.file:
path: "{{ item }}"
state: directory
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
mode: "0750"
loop:
- "{{ macos_dev_station_service_home }}/.cache"
- "{{ macos_dev_station_service_home }}/.local"
- "{{ macos_dev_station_service_home }}/.local/bin"
- "{{ macos_dev_station_service_home }}/.local/lib"
- "{{ macos_dev_station_service_home }}/.local/lib/node_modules"
- "{{ macos_dev_station_service_home }}/.config"
- "{{ macos_dev_station_service_home }}/.config/opencode"
when: macos_dev_station_service_user_enabled | bool
- name: Ensure OpenCode config object is valid when provided
ansible.builtin.assert:
that:
- macos_dev_station_opencode_config is mapping
fail_msg: "macos_dev_station_opencode_config must be a mapping (dictionary)."
- name: Render OpenCode config from host vars
become: true
ansible.builtin.template:
src: opencode.json.j2
dest: "{{ macos_dev_station_opencode_config_path }}"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
mode: "0600"
notify: Restart opencode launch agent
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_opencode_config | length > 0
- name: Download Oh My Zsh installer
become: true
ansible.builtin.get_url:
url: "{{ macos_dev_station_oh_my_zsh_install_url }}"
dest: "{{ macos_dev_station_service_home }}/.cache/ohmyzsh-install.sh"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
mode: "0755"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_oh_my_zsh_enabled | bool
- name: Install Oh My Zsh for service user
become: true
become_user: "{{ macos_dev_station_service_user }}"
ansible.builtin.command: >-
/bin/sh {{ macos_dev_station_service_home }}/.cache/ohmyzsh-install.sh --unattended
args:
creates: "{{ macos_dev_station_service_home }}/.oh-my-zsh"
environment:
HOME: "{{ macos_dev_station_service_home }}"
USER: "{{ macos_dev_station_service_user }}"
RUNZSH: "no"
CHSH: "no"
KEEP_ZSHRC: "yes"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_oh_my_zsh_enabled | bool
- name: Ensure .zshrc sources Oh My Zsh
become: true
ansible.builtin.blockinfile:
path: "{{ macos_dev_station_service_home }}/.zshrc"
block: |
# ansible: macos_dev_station oh-my-zsh
export ZSH="$HOME/.oh-my-zsh"
ZSH_THEME="{{ macos_dev_station_oh_my_zsh_theme }}"
plugins=({{ macos_dev_station_oh_my_zsh_plugins | join(' ') }})
source "$ZSH/oh-my-zsh.sh"
marker: "# {mark} ansible: macos_dev_station oh-my-zsh"
create: true
mode: "0644"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_oh_my_zsh_enabled | bool
- name: Ensure .zshrc has extra environment variables
become: true
ansible.builtin.blockinfile:
path: "{{ macos_dev_station_service_home }}/.zshrc"
block: |
# ansible: macos_dev_station extra env vars
{% for env_key, env_value in macos_dev_station_zshrc_extra_env.items() %}
export {{ env_key }}="{{ env_value }}"
{% endfor %}
marker: "# {mark} ansible: macos_dev_station extra env vars"
create: true
mode: "0644"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_zshrc_extra_env | length > 0
- name: Ensure .zshrc has ssh-agent startup for devstation
become: true
ansible.builtin.blockinfile:
path: "{{ macos_dev_station_service_home }}/.zshrc"
block: |
# ansible: macos_dev_station ssh-agent
export SSH_AUTH_SOCK="{{ macos_dev_station_ssh_agent_socket }}"
if [ -S "$SSH_AUTH_SOCK" ] && ssh-add -l &>/dev/null; then
# Agent socket exists and has keys — nothing to do
true
else
if [ -S "$SSH_AUTH_SOCK" ]; then
# Socket exists but agent is dead or has no keys — restart
rm -f "$SSH_AUTH_SOCK"
eval "$(ssh-agent -a "$SSH_AUTH_SOCK" 2>/dev/null)" || true
else
# No socket — start fresh agent
eval "$(ssh-agent -a "$SSH_AUTH_SOCK" 2>/dev/null)" || true
fi
if [ -f "{{ macos_dev_station_scripts_dir }}/ssh-agent-start.sh" ]; then
source "{{ macos_dev_station_scripts_dir }}/ssh-agent-start.sh"
fi
fi
marker: "# {mark} ansible: macos_dev_station ssh-agent"
create: true
mode: "0644"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_ssh_agent_enabled | bool
- name: Install managed MCP server runtimes
ansible.builtin.include_tasks: mcp_installers.yml
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_mcp_installers_enabled | bool
- macos_dev_station_mcp_installers | length > 0
- name: Run MCP bootstrap commands
become: true
become_user: "{{ macos_dev_station_service_user }}"
ansible.builtin.shell: "{{ item }}"
register: __mcp_bootstrap_result
changed_when: __mcp_bootstrap_result.rc == 0
args:
executable: /bin/sh
environment:
HOME: "{{ macos_dev_station_service_home }}"
USER: "{{ macos_dev_station_service_user }}"
PATH: "{{ macos_dev_station_path }}"
loop: "{{ macos_dev_station_mcp_bootstrap_commands }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_mcp_bootstrap_commands | length > 0
- name: List installed code-server extensions for service user
become: true
become_user: "{{ macos_dev_station_service_user }}"
ansible.builtin.command: code-server --list-extensions
register: __code_server_extensions_installed
changed_when: false
environment:
HOME: "{{ macos_dev_station_service_home }}"
USER: "{{ macos_dev_station_service_user }}"
PATH: "{{ macos_dev_station_path }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_code_server_extensions_enabled | bool
- macos_dev_station_code_server_extensions | length > 0
- name: Install base code-server extensions for service user
become: true
become_user: "{{ macos_dev_station_service_user }}"
ansible.builtin.command: >-
code-server --install-extension {{ item }}
register: __code_server_extension_install
changed_when: __code_server_extension_install.rc == 0
failed_when: >-
(macos_dev_station_code_server_extensions_fail_on_error | bool)
and (__code_server_extension_install.rc != 0)
environment:
HOME: "{{ macos_dev_station_service_home }}"
USER: "{{ macos_dev_station_service_user }}"
PATH: "{{ macos_dev_station_path }}"
notify: Restart code-server launch agent
loop: "{{ macos_dev_station_code_server_extensions }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_code_server_extensions_enabled | bool
- item not in (__code_server_extensions_installed.stdout_lines | default([]))
- name: Report skipped code-server extensions that are unavailable
ansible.builtin.debug:
msg: >-
Skipping unavailable code-server extension '{{ item.item }}':
{{ (item.stderr_lines | default([])) | join(' ') }}
loop: "{{ __code_server_extension_install.results | default([]) }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_code_server_extensions_enabled | bool
- not (macos_dev_station_code_server_extensions_fail_on_error | bool)
- item.rc is defined
- item.rc != 0
- name: Copy Copilot installer script
become: true
ansible.builtin.copy:
src: install-copilot.sh
dest: "{{ macos_dev_station_service_home }}/.cache/install-copilot.sh"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
mode: "0755"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_copilot_enabled | bool
- name: Install GitHub Copilot extensions via compatible VSIX
become: true
become_user: "{{ macos_dev_station_service_user }}"
ansible.builtin.command: "{{ macos_dev_station_service_home }}/.cache/install-copilot.sh"
register: __copilot_install_result
changed_when: __copilot_install_result.rc == 0
failed_when: >-
(macos_dev_station_copilot_fail_on_error | bool)
and (__copilot_install_result.rc != 0)
environment:
HOME: "{{ macos_dev_station_service_home }}"
USER: "{{ macos_dev_station_service_user }}"
PATH: "{{ macos_dev_station_path }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_copilot_enabled | bool
- name: Ensure devstation SSH directory exists when SSH access is enabled
become: true
ansible.builtin.file:
path: "{{ macos_dev_station_service_home }}/.ssh"
state: directory
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
mode: "0700"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_service_user_ssh_enabled | bool
- name: Ensure devstation authorized keys are present when SSH access is enabled
become: true
ansible.posix.authorized_key:
user: "{{ macos_dev_station_service_user }}"
key: "{{ item }}"
state: present
loop: "{{ macos_dev_station_service_user_ssh_authorized_keys }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_service_user_ssh_enabled | bool
- name: Check whether macOS Remote Login allowlist group exists
become: true
ansible.builtin.command: dscl . -read /Groups/com.apple.access_ssh
register: __macos_access_ssh_group
changed_when: false
failed_when: false
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_service_user_ssh_enabled | bool
- name: Check whether service user is in macOS Remote Login allowlist
become: true
ansible.builtin.command: >-
dseditgroup -o checkmember -m {{ macos_dev_station_service_user }} com.apple.access_ssh
register: __macos_access_ssh_member
changed_when: false
failed_when: false
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_service_user_ssh_enabled | bool
- __macos_access_ssh_group.rc == 0
- name: Ensure service user is allowed by macOS Remote Login allowlist
become: true
ansible.builtin.command: >-
dseditgroup -o edit -a {{ macos_dev_station_service_user }} -t user com.apple.access_ssh
changed_when: true
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_service_user_ssh_enabled | bool
- __macos_access_ssh_group.rc == 0
- __macos_access_ssh_member.rc != 0
- name: Render ssh-agent launch daemon
become: true
ansible.builtin.template:
src: ssh-agent.plist.j2
dest: "{{ macos_dev_station_launchd_plist_dir }}/com.a13labs.ssh-agent.plist"
mode: "0644"
owner: root
group: wheel
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_ssh_agent_enabled | bool
notify: Restart ssh-agent launch daemon
- name: Render ssh-agent starter script
become: true
ansible.builtin.template:
src: ssh-agent-start.sh.j2
dest: "{{ macos_dev_station_scripts_dir }}/ssh-agent-start.sh"
mode: "0755"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_ssh_agent_enabled | bool
notify: Restart ssh-agent launch daemon
- name: Ensure ssh_config has ssh-agent settings for devstation
become: true
ansible.builtin.blockinfile:
path: "{{ macos_dev_station_service_home }}/.ssh/config"
block: |
Host *
AddKeysToAgent yes
ServerAliveInterval 60
ServerAliveCountMax 3
marker: "# {mark} ansible: macos_dev_station ssh-agent"
create: true
mode: "0600"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
when:
- macos_dev_station_service_user_enabled | bool
- macos_dev_station_ssh_agent_enabled | bool
- name: Check ssh-agent launch daemon status
become: true
ansible.builtin.command: launchctl print system/com.a13labs.ssh-agent
register: __ssh_agent_status
failed_when: false
changed_when: false
when:
- macos_dev_station_manage_launchd | bool
- macos_dev_station_ssh_agent_enabled | bool
- macos_dev_station_service_user_enabled | bool
- name: Bootstrap ssh-agent launch daemon if missing
become: true
ansible.builtin.command: >-
launchctl bootstrap system {{ macos_dev_station_launchd_plist_dir }}/com.a13labs.ssh-agent.plist
changed_when: true
when:
- macos_dev_station_manage_launchd | bool
- macos_dev_station_ssh_agent_enabled | bool
- macos_dev_station_service_user_enabled | bool
- __ssh_agent_status.rc != 0
- name: Ensure ssh-agent launch daemon is enabled
become: true
ansible.builtin.command: launchctl enable system/com.a13labs.ssh-agent
changed_when: false
when:
- macos_dev_station_manage_launchd | bool
- macos_dev_station_ssh_agent_enabled | bool
- name: Remove legacy user launch agent plists for hard mode
ansible.builtin.file:
path: "{{ ansible_facts['env']['HOME'] }}/Library/LaunchAgents/{{ item }}"
state: absent
loop:
- com.a13labs.code-server.plist
- com.a13labs.opencode.plist
- name: Ensure SSH directory exists
ansible.builtin.file:
path: "{{ ansible_facts['env']['HOME'] }}/.ssh"
state: directory
mode: "0700"
- name: Generate SSH key if missing
ansible.builtin.command: >-
ssh-keygen -t ed25519 -C {{ macos_dev_station_ssh_key_comment }}
-f {{ macos_dev_station_ssh_key_path }} -N ''
args:
creates: "{{ macos_dev_station_ssh_key_path }}"
- name: Configure Git init default branch
community.general.git_config:
name: init.defaultBranch
scope: global
value: "{{ macos_dev_station_git_init_default_branch }}"
- name: Configure Git pull.rebase
community.general.git_config:
name: pull.rebase
scope: global
value: "{{ macos_dev_station_git_pull_rebase | ternary('true', 'false') }}"
- name: Render code-server launcher script
become: true
ansible.builtin.template:
src: start-ide.sh.j2
dest: "{{ macos_dev_station_scripts_dir }}/start-ide.sh"
mode: "0755"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
- name: Render opencode launcher script
become: true
ansible.builtin.template:
src: start-opencode.sh.j2
dest: "{{ macos_dev_station_scripts_dir }}/start-opencode.sh"
mode: "0755"
owner: "{{ macos_dev_station_service_user }}"
group: "{{ macos_dev_station_service_group }}"
- name: Render tmux configuration
ansible.builtin.copy:
dest: "{{ ansible_facts['env']['HOME'] }}/.tmux.conf"
mode: "0644"
content: |
set -g mouse on
set -g history-limit 100000
- name: Ensure Colima runtime is started
ansible.builtin.command: >-
colima start --cpu {{ macos_dev_station_colima_cpu }} --memory {{ macos_dev_station_colima_memory }}
register: __colima_start
changed_when: "'already running' not in ((__colima_start.stdout | default('')) + (__colima_start.stderr | default('')))"
when: macos_dev_station_colima_enabled | bool
environment:
PATH: "{{ macos_dev_station_path }}"
- name: Render code-server launchd unit
become: true
ansible.builtin.template:
src: code-server.plist.j2
dest: "{{ macos_dev_station_launchd_plist_dir }}/com.a13labs.code-server.plist"
mode: "0644"
owner: root
group: wheel
when: macos_dev_station_code_server_launchd_enabled | bool
notify: Restart code-server launch agent
- name: Render opencode launchd unit
become: true
ansible.builtin.template:
src: opencode.plist.j2
dest: "{{ macos_dev_station_launchd_plist_dir }}/com.a13labs.opencode.plist"
mode: "0644"
owner: root
group: wheel
when: macos_dev_station_opencode_launchd_enabled | bool
notify: Restart opencode launch agent
- name: Check code-server daemon status
become: true
ansible.builtin.command: launchctl print system/com.a13labs.code-server
register: __code_server_daemon_status
failed_when: false
changed_when: false
when:
- macos_dev_station_manage_launchd | bool
- macos_dev_station_code_server_launchd_enabled | bool
- name: Bootstrap code-server daemon if missing
become: true
ansible.builtin.command: >-
launchctl bootstrap system {{ macos_dev_station_launchd_plist_dir }}/com.a13labs.code-server.plist
changed_when: true
when:
- macos_dev_station_manage_launchd | bool
- macos_dev_station_code_server_launchd_enabled | bool
- __code_server_daemon_status.rc != 0
- name: Ensure code-server daemon is enabled
become: true
ansible.builtin.command: launchctl enable system/com.a13labs.code-server
changed_when: false
when:
- macos_dev_station_manage_launchd | bool
- macos_dev_station_code_server_launchd_enabled | bool
- name: Check opencode daemon status
become: true
ansible.builtin.command: launchctl print system/com.a13labs.opencode
register: __opencode_daemon_status
failed_when: false
changed_when: false
when:
- macos_dev_station_manage_launchd | bool
- macos_dev_station_opencode_launchd_enabled | bool
- name: Bootstrap opencode daemon if missing
become: true
ansible.builtin.command: >-
launchctl bootstrap system {{ macos_dev_station_launchd_plist_dir }}/com.a13labs.opencode.plist
changed_when: true
when:
- macos_dev_station_manage_launchd | bool
- macos_dev_station_opencode_launchd_enabled | bool
- __opencode_daemon_status.rc != 0
- name: Ensure opencode daemon is enabled
become: true
ansible.builtin.command: launchctl enable system/com.a13labs.opencode
changed_when: false
when:
- macos_dev_station_manage_launchd | bool
- macos_dev_station_opencode_launchd_enabled | bool
- name: Ensure launch agents are loaded now
ansible.builtin.meta: flush_handlers
when: macos_dev_station_manage_launchd | bool
Reference in New Issue View Git Blame Copy Permalink