From 1157c98ff5274d70f76604f8fad3f2763208e64c Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 4 Nov 2026 17:28:03 +0100
Subject: [PATCH] ansible-pull(role): make successful run timestamp exporter
 work

The successful run timestamp exporter didn't work, because the
ansible-pull user wouldn't necessarily have the necessary permissions
and because the command wouldn't properly work.
Move the timestamp export as well as the reboot to separate services,
which always run as root, to ensure these operations work and to have a
clean setup using systemd services.
Also move the successful run timestamp exporter to a custom script to
have it work properly.
---
 .../files/ansible-pull-reboot.service         |  8 ++++++
 ...-successful-run-timestamp-exporter.service |  8 ++++++
 ...-pull-successful-run-timestamp-exporter.sh |  6 +++++
 roles/ansible_pull/tasks/main.yaml            | 27 ++++++++++++++++++-
 .../templates/ansible-pull.service.j2         |  4 +--
 5 files changed, 49 insertions(+), 4 deletions(-)
 create mode 100644 roles/ansible_pull/files/ansible-pull-reboot.service
 create mode 100644 roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service
 create mode 100644 roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh

diff --git a/roles/ansible_pull/files/ansible-pull-reboot.service b/roles/ansible_pull/files/ansible-pull-reboot.service
new file mode 100644
index 00000000..e70c082e
--- /dev/null
+++ b/roles/ansible_pull/files/ansible-pull-reboot.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=ansible-pull reboot, if required
+After=ansible-pull.service
+
+[Service]
+Type=oneshot
+# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
+ExecStart=/usr/bin/bash -c 'if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then systemctl reboot; fi'
diff --git a/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service b/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service
new file mode 100644
index 00000000..ebed50ce
--- /dev/null
+++ b/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=ansible-pull successful run timestamp exporter
+After=ansible-pull.service
+Before=ansible-pull-reboot.service
+
+[Service]
+Type=oneshot
+ExecStart=ansible-pull-successful-run-timestamp-exporter
diff --git a/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh b/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh
new file mode 100644
index 00000000..90969675
--- /dev/null
+++ b/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+
+echo "ansible_pull_last_successful_run_timestamp_seconds $(date +%s)" > /var/lib/node_exporter_textfile/ansible_pull.prom.$$
+mv /var/lib/node_exporter_textfile/ansible_pull.prom.$$ /var/lib/node_exporter_textfile/ansible_pull.prom
diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index 61a2635f..49e96f2b 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -24,6 +24,17 @@
     virtualenv: /usr/local/lib/ansible_pull_venv
   become: true
 
+- name: ensure helper script installations exist
+  ansible.builtin.copy:
+    src: "{{ item }}.sh"
+    dest: "/usr/local/sbin/{{ item }}"
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+  loop:
+    - ansible-pull-successful-run-timestamp-exporter
+
 - name: ensure ansible-pull-failure-notify script installation exists
   ansible.builtin.template:
     src: ansible-pull-failure-notify.sh.j2
@@ -51,7 +62,7 @@
     group: "{{ ansible_pull__user }}"
   become: true
 
-- name: ensure systemd services exists
+- name: ensure templated systemd services exists
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
@@ -65,6 +76,20 @@
   notify:
     - systemd daemon reload
 
+- name: ensure systemd services exists
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  loop:
+    - ansible-pull-reboot.service
+    - ansible-pull-successful-run-timestamp-exporter.service
+  notify:
+    - systemd daemon reload
+
 - name: ensure systemd timer exists
   ansible.builtin.template:
     src: ansible-pull.timer.j2
diff --git a/roles/ansible_pull/templates/ansible-pull.service.j2 b/roles/ansible_pull/templates/ansible-pull.service.j2
index 8b5c9e86..7f12bc4e 100644
--- a/roles/ansible_pull/templates/ansible-pull.service.j2
+++ b/roles/ansible_pull/templates/ansible-pull.service.j2
@@ -3,6 +3,7 @@ Description=ansible-pull for configuration and maintenance
 After=network-online.target
 Wants=network-online.target
 OnFailure=ansible-pull-failure-notify.service
+OnSuccess=ansible-pull-successful-run-timestamp-exporter.service ansible-pull-reboot.service
 
 [Service]
 Type=oneshot
@@ -19,6 +20,3 @@ ExecStart=/usr/local/lib/ansible_pull_venv/bin/ansible-pull \
           --inventory "{{ ansible_pull__inventory }}" \
           "{{ ansible_pull__playbook }}"
 User={{ ansible_pull__user }}
-ExecStartPost=/usr/bin/bash -c 'echo "ansible_pull_last_successful_run_timestamp_seconds $(date +%s)" > /var/lib/node_exporter_textfile/ansible_pull.prom.$$; mv /var/lib/node_exporter_textfile/ansible_pull.prom.$$ /var/lib/node_exporter_textfile/ansible_pull.prom'
-# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
-ExecStartPost=/usr/bin/bash -c 'if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then sudo systemctl reboot; fi'