roles/ansible_pull/files/ansible-pull-failure-notify.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=ansible-pull failure notifier
+
+[Service]
+Type=oneshot
+ExecStart=ansible-pull-failure-notify
+User=root

roles/ansible_pull/files/ansible-pull-reboot.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=ansible-pull reboot, if required
+After=ansible-pull.service
+
+[Service]
+Type=oneshot
+ExecStart=ansible-pull-reboot

roles/ansible_pull/files/ansible-pull-reboot.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
+if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then
+    systemctl reboot
+fi

roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=ansible-pull successful run timestamp exporter
+After=ansible-pull.service
+Before=ansible-pull-reboot.service
+
+[Service]
+Type=oneshot
+ExecStart=ansible-pull-successful-run-timestamp-exporter

roles/ansible_pull/files/ansible-pull-successful-run-timestamp-exporter.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+
+echo "ansible_pull_last_successful_run_timestamp_seconds $(date +%s)" > /var/lib/node_exporter_textfile/ansible_pull.prom.$$
+mv /var/lib/node_exporter_textfile/ansible_pull.prom.$$ /var/lib/node_exporter_textfile/ansible_pull.prom

roles/ansible_pull/tasks/main.yaml

@@ -24,14 +24,28 @@
     virtualenv: /usr/local/lib/ansible_pull_venv
   become: true
 
-- name: ensure ansible-pull-failure-notify script installation exists
-  ansible.builtin.template:
-    src: ansible-pull-failure-notify.sh.j2
-    dest: /usr/local/sbin/ansible-pull-failure-notify.sh
+- name: ensure helper script installations exist
+  ansible.builtin.copy:
+    src: "{{ item }}.sh"
+    dest: "/usr/local/sbin/{{ item }}"
     owner: root
     group: root
     mode: "0755"
   become: true
+  loop:
+    - ansible-pull-successful-run-timestamp-exporter
+    - ansible-pull-reboot
+
+- name: ensure templated helper script installations exists
+  ansible.builtin.template:
+    src: "{{ item }}.sh.j2"
+    dest: "/usr/local/sbin/{{ item }}"
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+  loop:
+    - ansible-pull-failure-notify
 
 - name: ensure secrets directory exists
   ansible.builtin.file:
@@ -51,7 +65,7 @@
     group: "{{ ansible_pull__user }}"
   become: true
 
-- name: ensure systemd services exists
+- name: ensure templated systemd services exists
   ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "/etc/systemd/system/{{ item }}"
@@ -61,7 +75,21 @@
   become: true
   loop:
     - ansible-pull.service
+  notify:
+    - systemd daemon reload
+
+- name: ensure systemd services exists
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  loop:
     - ansible-pull-failure-notify.service
+    - ansible-pull-reboot.service
+    - ansible-pull-successful-run-timestamp-exporter.service
   notify:
     - systemd daemon reload
 

roles/ansible_pull/templates/ansible-pull.service.j2

@@ -3,6 +3,7 @@ Description=ansible-pull for configuration and maintenance
 After=network-online.target
 Wants=network-online.target
 OnFailure=ansible-pull-failure-notify.service
+OnSuccess=ansible-pull-successful-run-timestamp-exporter.service ansible-pull-reboot.service
 
 [Service]
 Type=oneshot
@@ -19,6 +20,3 @@ ExecStart=/usr/local/lib/ansible_pull_venv/bin/ansible-pull \
           --inventory "{{ ansible_pull__inventory }}" \
           "{{ ansible_pull__playbook }}"
 User={{ ansible_pull__user }}
-ExecStartPost=/usr/bin/bash -c 'echo "ansible_pull_last_successful_run_timestamp_seconds $(date +%s)" > /var/lib/node_exporter_textfile/ansible_pull.prom.$$; mv /var/lib/node_exporter_textfile/ansible_pull.prom.$$ /var/lib/node_exporter_textfile/ansible_pull.prom'
-# Reboot, if /var/run/reboot-required or /var/run/ansible-reboot-required exist.
-ExecStartPost=/usr/bin/bash -c 'if [ -e /var/run/reboot-required ] || [ -e /var/run/ansible-reboot-required ]; then sudo systemctl reboot; fi'