ansible-pull(role): make successful run timestamp exporter work

The successful run timestamp exporter didn't work, because the
ansible-pull user wouldn't necessarily have the necessary permissions
and because the command wouldn't properly work.
Move the timestamp export as well as the reboot to separate services,
which always run as root, to ensure these operations work and to have a
clean setup using systemd services.
Also move the successful run timestamp exporter to a custom script to
have it work properly.

roles/ansible_pull/files/ansible-pull-reboot.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=ansible-pull reboot, if required
+After=ansible-pull.service
+
+[Service]
+Type=oneshot
+# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
+ExecStart=/usr/bin/bash -c 'if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then systemctl reboot; fi'

roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=ansible-pull successful run timestamp exporter
+After=ansible-pull.service
+Before=ansible-pull-reboot.service
+
+[Service]
+Type=oneshot
+ExecStart=ansible-pull-successful-run-timestamp-exporter

roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+
+echo "ansible_pull_last_successful_run_timestamp_seconds $(date +%s)" > /var/lib/node_exporter_textfile/ansible_pull.prom.$$
+mv /var/lib/node_exporter_textfile/ansible_pull.prom.$$ /var/lib/node_exporter_textfile/ansible_pull.prom

roles/ansible_pull/tasks/main.yaml

@@ -24,6 +24,17 @@
     virtualenv: /usr/local/lib/ansible_pull_venv
   become: true
 
+- name: ensure helper script installations exist
+  ansible.builtin.copy:
+    src: "{{ item }}.sh"
+    dest: "/usr/local/sbin/{{ item }}"
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+  loop:
+    - ansible-pull-successful-run-timestamp-exporter
+
 - name: ensure ansible-pull-failure-notify script installation exists
   ansible.builtin.template:
     src: ansible-pull-failure-notify.sh.j2
@@ -51,7 +62,7 @@
     group: "{{ ansible_pull__user }}"
   become: true
 
-- name: ensure systemd services exists
+- name: ensure templated systemd services exists
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
@@ -65,6 +76,20 @@
   notify:
     - systemd daemon reload
 
+- name: ensure systemd services exists
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  loop:
+    - ansible-pull-reboot.service
+    - ansible-pull-successful-run-timestamp-exporter.service
+  notify:
+    - systemd daemon reload
+
 - name: ensure systemd timer exists
   ansible.builtin.template:
     src: ansible-pull.timer.j2

roles/ansible_pull/templates/ansible-pull.service.j2

@@ -3,6 +3,7 @@ Description=ansible-pull for configuration and maintenance
 After=network-online.target
 Wants=network-online.target
 OnFailure=ansible-pull-failure-notify.service
+OnSuccess=ansible-pull-successful-run-timestamp-exporter.service ansible-pull-reboot.service
 
 [Service]
 Type=oneshot
@@ -19,6 +20,3 @@ ExecStart=/usr/local/lib/ansible_pull_venv/bin/ansible-pull \
           --inventory "{{ ansible_pull__inventory }}" \
           "{{ ansible_pull__playbook }}"
 User={{ ansible_pull__user }}
-ExecStartPost=/usr/bin/bash -c 'echo "ansible_pull_last_successful_run_timestamp_seconds $(date +%s)" > /var/lib/node_exporter_textfile/ansible_pull.prom.$$; mv /var/lib/node_exporter_textfile/ansible_pull.prom.$$ /var/lib/node_exporter_textfile/ansible_pull.prom'
-# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
-ExecStartPost=/usr/bin/bash -c 'if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then sudo systemctl reboot; fi'