fix(ansible): align ensemble rollout with current windows deploy

2026-04-26 09:13:41 +03:00
parent 7ef8166504
commit 97fe09a150
6 changed files with 51 additions and 12 deletions
@@ -73,10 +73,16 @@ ansible-playbook -i inventory.ini deploy_aw_windows_phase2.yml
 Playbook:

 - выгружает `windows/*` toolkit на целевой хост в `C:\Deploy\AWatch-rus\windows`;
- выполняет `deploy-domain-users.ps1` с phase-2 policy/rules;
+- выполняет `deploy-ensemble.ps1` (deploy + hardening/recovery) с phase-2 policy/rules;
 - запускает `validate-deployment.ps1`;
 - забирает JSON-отчёт в локальную директорию (`/tmp/aw-rus-validation` по умолчанию).

+Дополнительные флаги:
+
+- `aw_windows_afk_enabled: false` — не запускать `aw-watcher-afk`;
+- `aw_windows_window_enabled: false` — не запускать `aw-watcher-window`;
+- `aw_windows_skip_hardening: true` — пропустить `hardening-recovery.ps1` внутри ensemble-скрипта.
+
 ## Результат

 - Установлен ActivityWatch Server.
@@ -17,6 +17,9 @@
      - user5
    aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
    aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+    aw_windows_afk_enabled: true
+    aw_windows_window_enabled: true
+    aw_windows_skip_hardening: false
    aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
    aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
    aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
@@ -52,6 +55,7 @@
        - browser-domains-native-collector.ps1
        - dlp-endpoint-signals-collector.ps1
        - deploy-domain-users.ps1
+        - deploy-ensemble.ps1
        - hardening-recovery.ps1
        - validate-deployment.ps1
        - web-category-rules.example.json
@@ -65,19 +69,26 @@
          {{ user }}
          {% endfor -%}

-    - name: Run phase2 domain deployment
+    - name: Run phase2 ensemble deployment
      ansible.windows.win_powershell:
        script: |
          $ErrorActionPreference = 'Stop'
-          & "{{ aw_windows_deploy_root }}\windows\deploy-domain-users.ps1" `
-            -ServerHost "{{ aw_windows_server_host }}" `
-            -ServerPort {{ aw_windows_server_port }} `
-            -Domain "{{ aw_windows_domain }}" `
-            -UserListPath "{{ aw_windows_deploy_root }}\windows\users.txt" `
-            -InstallRoot "{{ aw_windows_install_root }}" `
-            -StateRoot "{{ aw_windows_state_root }}" `
-            -CustomRulesPath "{{ aw_windows_rules_path }}" `
-            -CustomPolicyPath "{{ aw_windows_policy_path }}"
+          $params = @{
+            ServerHost = "{{ aw_windows_server_host }}"
+            ServerPort = {{ aw_windows_server_port }}
+            Domain = "{{ aw_windows_domain }}"
+            UserListPath = "{{ aw_windows_deploy_root }}\windows\users.txt"
+            InstallRoot = "{{ aw_windows_install_root }}"
+            StateRoot = "{{ aw_windows_state_root }}"
+            AfkEnabled = {{ '$true' if (aw_windows_afk_enabled | bool) else '$false' }}
+            WindowEnabled = {{ '$true' if (aw_windows_window_enabled | bool) else '$false' }}
+            CustomRulesPath = "{{ aw_windows_rules_path }}"
+            CustomPolicyPath = "{{ aw_windows_policy_path }}"
+          }
+          {% if aw_windows_skip_hardening | bool %}
+          $params.SkipHardening = $true
+          {% endif %}
+          & "{{ aw_windows_deploy_root }}\windows\deploy-ensemble.ps1" @params

    - name: Run validation and store report on target
      ansible.windows.win_powershell:
@@ -13,6 +13,9 @@ aw_windows_users:
 # Рекомендуемый изолированный профиль для фазового раската.
 aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
 aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
+aw_windows_afk_enabled: true
+aw_windows_window_enabled: true
+aw_windows_skip_hardening: false

 aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
 aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
@@ -24,6 +24,7 @@ C:\Deploy\AWatch-rus\windows\deploy-ensemble.ps1 `
  -Users user1,user2,user3,user4,user5 `
  -InstallRoot 'C:\Program Files\ActivityWatch-Phase2' `
  -StateRoot 'C:\ProgramData\ActivityWatch-Phase2' `
+  -AfkEnabled:$false `
  -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json `
  -ValidateAfterDeploy
 ```
@@ -16,6 +16,8 @@ param(
    [int]$PollSeconds = 5,
    [int]$PulseSeconds = 30,
    [int]$RecoveryIntervalSeconds = 180,
+    [bool]$AfkEnabled = $true,
+    [bool]$WindowEnabled = $true,
    [string]$CustomRulesPath,
    [string]$CustomPolicyPath,
    [string]$ReportPath,
@@ -55,6 +57,8 @@ if (-not (Test-Path -LiteralPath $deployScript)) {
    -PollSeconds $PollSeconds `
    -PulseSeconds $PulseSeconds `
    -RecoveryIntervalSeconds $RecoveryIntervalSeconds `
+    -AfkEnabled $AfkEnabled `
+    -WindowEnabled $WindowEnabled `
    -CustomRulesPath $CustomRulesPath `
    -CustomPolicyPath $CustomPolicyPath

@@ -70,6 +74,8 @@ if (-not $SkipHardening) {
        -PollSeconds $PollSeconds `
        -PulseSeconds $PulseSeconds `
        -RecoveryIntervalSeconds $RecoveryIntervalSeconds `
+        -AfkEnabled $AfkEnabled `
+        -WindowEnabled $WindowEnabled `
        -CustomRulesPath $CustomRulesPath `
        -CustomPolicyPath $CustomPolicyPath
 }
@@ -88,6 +94,10 @@ $report = [ordered]@{
        stateRoot = $StateRoot
        configPath = Join-Path $StateRoot 'deployment-config.json'
    }
+    collectors = [ordered]@{
+        afkEnabled = $AfkEnabled
+        windowEnabled = $WindowEnabled
+    }
    hardeningApplied = (-not $SkipHardening)
 }

@@ -16,6 +16,7 @@ param(
    [bool]$AfkEnabled,
    [bool]$WindowEnabled,
    [string]$CustomRulesPath,
+    [string]$CustomPolicyPath,
    [switch]$RepairPackage,
    [string]$Version,
    [string]$PackageUrl,
@@ -46,7 +47,9 @@ $effectiveConfigPath = if ($ConfigPath) { $ConfigPath } else { Join-Path $effect
 $effectiveLaunchScript = Join-Path $effectiveStateRoot 'launch-watchers.ps1'
 $effectiveRecoveryScript = Join-Path $effectiveStateRoot 'recovery-loop.ps1'
 $effectiveCollector = Join-Path $effectiveStateRoot 'browser-domains-native-collector.ps1'
+$effectiveEndpointCollector = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'endpointCollectorScript') { [string]$existingConfig.paths.endpointCollectorScript } else { Join-Path $effectiveStateRoot 'dlp-endpoint-signals-collector.ps1' }
 $effectiveRules = Join-Path $effectiveStateRoot 'web-category-rules.json'
+$effectivePolicy = if ($existingConfig -and $existingConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$existingConfig.paths.policyPath } else { Join-Path $effectiveStateRoot 'dlp-policy.json' }

 $effectiveServerHost = if ($ServerHost) { $ServerHost } elseif ($existingConfig) { [string]$existingConfig.server.host } else { $null }
 $effectiveServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($existingConfig) { [int]$existingConfig.server.port } else { 5600 }
@@ -82,9 +85,12 @@ Get-ActivityWatchExecutableMap -InstallRoot $effectiveInstallRoot | Out-Null

 $assetResult = Copy-ActivityWatchCollectorAssets `
    -CollectorScriptSource (Join-Path $PSScriptRoot 'browser-domains-native-collector.ps1') `
+    -EndpointCollectorScriptSource (Join-Path $PSScriptRoot 'dlp-endpoint-signals-collector.ps1') `
    -ExampleRulesSource (Join-Path $PSScriptRoot 'web-category-rules.example.json') `
+    -ExamplePolicySource (Join-Path $PSScriptRoot 'dlp-policy.example.json') `
    -StateRoot $effectiveStateRoot `
-    -CustomRulesSource $CustomRulesPath
+    -CustomRulesSource $CustomRulesPath `
+    -CustomPolicySource $CustomPolicyPath

 $taskDefinitions = New-ActivityWatchUserTaskDefinitions -Users $effectiveUsers
 Write-ActivityWatchLaunchScript -Path $effectiveLaunchScript -ConfigPath $effectiveConfigPath
@@ -98,7 +104,9 @@ $config = New-ActivityWatchDeploymentConfig `
    -StateRoot $effectiveStateRoot `
    -LogsRoot $effectiveLogsRoot `
    -CollectorScript $effectiveCollector `
+    -EndpointCollectorScript $effectiveEndpointCollector `
    -RulesPath $effectiveRules `
+    -PolicyPath $effectivePolicy `
    -PollSeconds $effectivePollSeconds `
    -PulseSeconds $effectivePulseSeconds `
    -RecoveryIntervalSeconds $effectiveRecoveryInterval `