From 1157c98ff5274d70f76604f8fad3f2763208e64c Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 4 Nov 2026 17:28:03 +0100
Subject: [PATCH 1/4] ansible-pull(role): make successful run timestamp
 exporter work

The successful run timestamp exporter didn't work, because the
ansible-pull user wouldn't necessarily have the necessary permissions
and because the command wouldn't properly work.
Move the timestamp export as well as the reboot to separate services,
which always run as root, to ensure these operations work and to have a
clean setup using systemd services.
Also move the successful run timestamp exporter to a custom script to
have it work properly.
---
 .../files/ansible-pull-reboot.service         |  8 ++++++
 ...-successful-run-timestamp-exporter.service |  8 ++++++
 ...-pull-successful-run-timestamp-exporter.sh |  6 +++++
 roles/ansible_pull/tasks/main.yaml            | 27 ++++++++++++++++++-
 .../templates/ansible-pull.service.j2         |  4 +--
 5 files changed, 49 insertions(+), 4 deletions(-)
 create mode 100644 roles/ansible_pull/files/ansible-pull-reboot.service
 create mode 100644 roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service
 create mode 100644 roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh

diff --git a/roles/ansible_pull/files/ansible-pull-reboot.service b/roles/ansible_pull/files/ansible-pull-reboot.service
new file mode 100644
index 00000000..e70c082e
--- /dev/null
+++ b/roles/ansible_pull/files/ansible-pull-reboot.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=ansible-pull reboot, if required
+After=ansible-pull.service
+
+[Service]
+Type=oneshot
+# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
+ExecStart=/usr/bin/bash -c 'if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then systemctl reboot; fi'
diff --git a/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service b/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service
new file mode 100644
index 00000000..ebed50ce
--- /dev/null
+++ b/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=ansible-pull successful run timestamp exporter
+After=ansible-pull.service
+Before=ansible-pull-reboot.service
+
+[Service]
+Type=oneshot
+ExecStart=ansible-pull-successful-run-timestamp-exporter
diff --git a/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh b/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh
new file mode 100644
index 00000000..90969675
--- /dev/null
+++ b/roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+
+echo "ansible_pull_last_successful_run_timestamp_seconds $(date +%s)" > /var/lib/node_exporter_textfile/ansible_pull.prom.$$
+mv /var/lib/node_exporter_textfile/ansible_pull.prom.$$ /var/lib/node_exporter_textfile/ansible_pull.prom
diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index 61a2635f..49e96f2b 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -24,6 +24,17 @@
     virtualenv: /usr/local/lib/ansible_pull_venv
   become: true
 
+- name: ensure helper script installations exist
+  ansible.builtin.copy:
+    src: "{{ item }}.sh"
+    dest: "/usr/local/sbin/{{ item }}"
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+  loop:
+    - ansible-pull-successful-run-timestamp-exporter
+
 - name: ensure ansible-pull-failure-notify script installation exists
   ansible.builtin.template:
     src: ansible-pull-failure-notify.sh.j2
@@ -51,7 +62,7 @@
     group: "{{ ansible_pull__user }}"
   become: true
 
-- name: ensure systemd services exists
+- name: ensure templated systemd services exists
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
@@ -65,6 +76,20 @@
   notify:
     - systemd daemon reload
 
+- name: ensure systemd services exists
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  loop:
+    - ansible-pull-reboot.service
+    - ansible-pull-successful-run-timestamp-exporter.service
+  notify:
+    - systemd daemon reload
+
 - name: ensure systemd timer exists
   ansible.builtin.template:
     src: ansible-pull.timer.j2
diff --git a/roles/ansible_pull/templates/ansible-pull.service.j2 b/roles/ansible_pull/templates/ansible-pull.service.j2
index 8b5c9e86..7f12bc4e 100644
--- a/roles/ansible_pull/templates/ansible-pull.service.j2
+++ b/roles/ansible_pull/templates/ansible-pull.service.j2
@@ -3,6 +3,7 @@ Description=ansible-pull for configuration and maintenance
 After=network-online.target
 Wants=network-online.target
 OnFailure=ansible-pull-failure-notify.service
+OnSuccess=ansible-pull-successful-run-timestamp-exporter.service ansible-pull-reboot.service
 
 [Service]
 Type=oneshot
@@ -19,6 +20,3 @@ ExecStart=/usr/local/lib/ansible_pull_venv/bin/ansible-pull \
           --inventory "{{ ansible_pull__inventory }}" \
           "{{ ansible_pull__playbook }}"
 User={{ ansible_pull__user }}
-ExecStartPost=/usr/bin/bash -c 'echo "ansible_pull_last_successful_run_timestamp_seconds $(date +%s)" > /var/lib/node_exporter_textfile/ansible_pull.prom.$$; mv /var/lib/node_exporter_textfile/ansible_pull.prom.$$ /var/lib/node_exporter_textfile/ansible_pull.prom'
-# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
-ExecStartPost=/usr/bin/bash -c 'if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then sudo systemctl reboot; fi'
-- 
2.54.0


From 96a7eabbaca5a4ffd3b6fe9e6a1bf3cc754a36c5 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 4 Nov 2026 17:15:48 +0100
Subject: [PATCH 2/4] ansible-pull(role): move ansible-pull reboot logic to
 script as well

Do this to unify the way these helper scripts get deployed.
---
 roles/ansible_pull/files/ansible-pull-reboot.service | 3 +--
 roles/ansible_pull/files/ansible-pull-reboot.sh      | 6 ++++++
 roles/ansible_pull/tasks/main.yaml                   | 1 +
 3 files changed, 8 insertions(+), 2 deletions(-)
 create mode 100644 roles/ansible_pull/files/ansible-pull-reboot.sh

diff --git a/roles/ansible_pull/files/ansible-pull-reboot.service b/roles/ansible_pull/files/ansible-pull-reboot.service
index e70c082e..d6e5bc8d 100644
--- a/roles/ansible_pull/files/ansible-pull-reboot.service
+++ b/roles/ansible_pull/files/ansible-pull-reboot.service
@@ -4,5 +4,4 @@ After=ansible-pull.service
 
 [Service]
 Type=oneshot
-# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
-ExecStart=/usr/bin/bash -c 'if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then systemctl reboot; fi'
+ExecStart=ansible-pull-reboot
diff --git a/roles/ansible_pull/files/ansible-pull-reboot.sh b/roles/ansible_pull/files/ansible-pull-reboot.sh
new file mode 100644
index 00000000..940334a5
--- /dev/null
+++ b/roles/ansible_pull/files/ansible-pull-reboot.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
+if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then
+    systemctl reboot
+fi
diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index 49e96f2b..0d2b1d3b 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -34,6 +34,7 @@
   become: true
   loop:
     - ansible-pull-successful-run-timestamp-exporter
+    - ansible-pull-reboot
 
 - name: ensure ansible-pull-failure-notify script installation exists
   ansible.builtin.template:
-- 
2.54.0


From a4a92448dc2fdca70b612bcfcdb5abfb99c3cfa1 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 4 Nov 2026 17:17:55 +0100
Subject: [PATCH 3/4] ansible-pull(role): have failure notify deploy match
 other script deploy

Have the deployment of the ansible-pull-failure-notify script match the
deployment of the other helper scripts.
---
 roles/ansible_pull/tasks/main.yaml                        | 8 +++++---
 .../templates/ansible-pull-failure-notify.service.j2      | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index 0d2b1d3b..cc754ca5 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -36,14 +36,16 @@
     - ansible-pull-successful-run-timestamp-exporter
     - ansible-pull-reboot
 
-- name: ensure ansible-pull-failure-notify script installation exists
+- name: ensure templated helper script installations exists
   ansible.builtin.template:
-    src: ansible-pull-failure-notify.sh.j2
-    dest: /usr/local/sbin/ansible-pull-failure-notify.sh
+    src: "{{ item }}.sh.j2"
+    dest: "/usr/local/sbin/{{ item }}"
     owner: root
     group: root
     mode: "0755"
   become: true
+  loop:
+    - ansible-pull-failure-notify
 
 - name: ensure secrets directory exists
   ansible.builtin.file:
diff --git a/roles/ansible_pull/templates/ansible-pull-failure-notify.service.j2 b/roles/ansible_pull/templates/ansible-pull-failure-notify.service.j2
index fa5d471d..30d90091 100644
--- a/roles/ansible_pull/templates/ansible-pull-failure-notify.service.j2
+++ b/roles/ansible_pull/templates/ansible-pull-failure-notify.service.j2
@@ -3,5 +3,5 @@ Description=ansible-pull failure notifier
 
 [Service]
 Type=oneshot
-ExecStart=/usr/local/sbin/ansible-pull-failure-notify.sh
+ExecStart=ansible-pull-failure-notify
 User=root
-- 
2.54.0


From 947d8fd0a0449037be95840aa6423ad5cbbc1276 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 4 Nov 2026 17:20:15 +0100
Subject: [PATCH 4/4] ansible-pull(role): deploy failure notify service using
 the copy loop

Deploy the ansible-pull-failure-notify.service using the loop using
ansible.builtin.copy as it doesn't have any template logic.
---
 .../ansible-pull-failure-notify.service}                        | 0
 roles/ansible_pull/tasks/main.yaml                              | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename roles/ansible_pull/{templates/ansible-pull-failure-notify.service.j2 => files/ansible-pull-failure-notify.service} (100%)

diff --git a/roles/ansible_pull/templates/ansible-pull-failure-notify.service.j2 b/roles/ansible_pull/files/ansible-pull-failure-notify.service
similarity index 100%
rename from roles/ansible_pull/templates/ansible-pull-failure-notify.service.j2
rename to roles/ansible_pull/files/ansible-pull-failure-notify.service
diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index cc754ca5..d8915be7 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -75,7 +75,6 @@
   become: true
   loop:
     - ansible-pull.service
-    - ansible-pull-failure-notify.service
   notify:
     - systemd daemon reload
 
@@ -88,6 +87,7 @@
     mode: "0644"
   become: true
   loop:
+    - ansible-pull-failure-notify.service
     - ansible-pull-reboot.service
     - ansible-pull-successful-run-timestamp-exporter.service
   notify:
-- 
2.54.0