June
1157c98ff5
The successful run timestamp exporter didn't work, because the ansible-pull user wouldn't necessarily have the necessary permissions and because the command wouldn't properly work. Move the timestamp export as well as the reboot to separate services, which always run as root, to ensure these operations work and to have a clean setup using systemd services. Also move the successful run timestamp exporter to a custom script to have it work properly.
22 lines
1.2 KiB
Django/Jinja
22 lines
1.2 KiB
Django/Jinja
[Unit]
|
|
Description=ansible-pull for configuration and maintenance
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
OnFailure=ansible-pull-failure-notify.service
|
|
OnSuccess=ansible-pull-successful-run-timestamp-exporter.service ansible-pull-reboot.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
TimeoutStartSec=30min
|
|
Environment="SOPS_AGE_KEY_FILE=/etc/ansible_pull_secrets/age_private_key"
|
|
ExecStartPre=/usr/bin/bash -c 'if [ ! -e /home/chaos/ansible_pull_checkout ]; then git clone --depth 1 "{{ ansible_pull__repo_url }}" /home/chaos/ansible_pull_checkout ; fi'
|
|
ExecStartPre=/usr/local/lib/ansible_pull_venv/bin/ansible-galaxy role install -r /home/chaos/ansible_pull_checkout/requirements.yml
|
|
ExecStartPre=/usr/local/lib/ansible_pull_venv/bin/ansible-galaxy collection install -r /home/chaos/ansible_pull_checkout/requirements.yml
|
|
ExecStart=/usr/local/lib/ansible_pull_venv/bin/ansible-pull \
|
|
--directory /home/chaos/ansible_pull_checkout \
|
|
--clean \
|
|
--url "{{ ansible_pull__repo_url }}" \
|
|
--checkout "{{ ansible_pull__checkout }}" \
|
|
--inventory "{{ ansible_pull__inventory }}" \
|
|
"{{ ansible_pull__playbook }}"
|
|
User={{ ansible_pull__user }}
|