mdella
c966450d8e
Inside the estate gitea.cbs.tikali.net resolves to jump1's RED EIP (10.10.0.175), which has no HTTP ingress, so backend boxes could not download the install artefacts from the Gitea mirror (cbs/iac#102). scm.tikali.ai is reachable from those boxes and the project is now public, so the GitLab generic package registry becomes the PRIMARY source: - packaging/install.sh: default source = scm.tikali.ai generic package registry (projects/69/packages/generic/monky-deployd/<ver>/...); `--source gitea` / MONKY_DEPLOYD_SOURCE=gitea keeps the Gitea release as the off-estate alternative; --base-url / MONKY_DEPLOYD_BASE_URL still override the base. - ansible role defaults: monky_deployd_base_url/_deb_url point at the registry, Gitea layout kept as a commented alternative. - README / docs/OPERATIONS.md / CLAUDE.md / CI comments + release description: both locations keep being published (release + release:gitea). - Version 0.1.1 (the tag gate refuses v* tags whose version != __version__); tests compare against __version__ instead of a literal. No agent change. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
1.9 KiB
role monky_deployd
Installs and configures monky-deployd
(the Monky backend pull agent, MONKY-ADR-0028) on a docker host that already carries an enrolled
host identity (roles/ziti_tunneler, run-host mode). Skeleton for osg1-07; copy it there.
What it does: pin + download the .deb from the scm.tikali.ai package registry (sha256 verified; monky_deployd_base_url/_deb_url switch to the Gitea release off-estate) → ACL
u:monky-deployd:r on the identity (rx on the dir) → /etc/monky-deployd/config.yaml from the
template → optional openbao-ca PEM → optional monky-deployd-proxy.service (transport: proxy)
→ the one-time bootstrap deploy grant from a vault var (0600, no_log) → monky-deployd.timer
→ first tick via handler (inside the grant's hour) → monky-deployd status.
Variables (see defaults/main.yml)
| var | note |
|---|---|
monky_deployd_version |
pinned release, e.g. 0.1.1 |
monky_deployd_env_id / _site / _transport |
per host (env-dev-06, cbs, sdk) |
monky_deployd_bootstrap_grant |
tenancy-minted deploy grant (1 h) — ansible-vault or a lookup at play time; empty keeps the existing token |
monky_deployd_bao_ca_pem |
the openbao-ca certificate (PEM) |
monky_deployd_volumes_on_absent |
keep (default) or purge (never applied on prod by the agent) |
Example play
- hosts: env-dev-06:env-dev-07:env-dev-08:env-dev-09
become: true
roles:
- role: ziti_tunneler # enrol/verify monky-host.<env>; gains the ACL var + name assertion
- role: monky_deployd
vars:
monky_deployd_bootstrap_grant: "{{ lookup('pipe', 'tenancy-mint-grant ' ~ inventory_hostname) }}"
Rollout order (plan §E): pilot env-qa-02 → env-dev-06..09 → env-dev-01 last (after its live key moves into Bao). Verified on Ubuntu 26.04.