refactor(detmir): retire python runtime paths
This commit is contained in:
igor04091968
+263
-623
File diff suppressed because it is too large
Load Diff
@@ -258,7 +258,7 @@
|
||||
AW_RUS_WORKTIME_BASE={{ tsj_bot_aw_rus_worktime_base | default('http://10.10.10.13:5610') }}
|
||||
AW_DLP_POLICY_API_BASE={{ tsj_bot_aw_dlp_policy_api_base | default('http://10.10.10.13:5601/api/0') }}
|
||||
AW_DLP_POLICY_ACTOR={{ tsj_bot_aw_dlp_policy_actor | default('tsj-guardian-bot') }}
|
||||
AW_RUS_WORKTIME_HEAL_CMD={{ tsj_bot_aw_rus_worktime_heal_cmd | default("ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new igor@10.10.10.13 'sudo -n /usr/local/bin/aw-worktime-autoheal.sh && sudo -n systemctl reset-failed aw-worktime-ui-bridge.service && sudo -n systemctl start aw-worktime-ui-bridge.service'") }}
|
||||
AW_RUS_WORKTIME_HEAL_CMD={{ tsj_bot_aw_rus_worktime_heal_cmd | default("ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new igor@10.10.10.13 'sudo -n /usr/local/bin/aw-worktime-autoheal-rust && sudo -n systemctl reset-failed aw-worktime-ui-bridge.service && sudo -n systemctl start aw-worktime-ui-bridge.service'") }}
|
||||
AW_RUS_DLP_HEAL_CMD={{ tsj_bot_aw_rus_dlp_heal_cmd | default("ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new igor@10.10.10.13 'sudo -n systemctl restart activitywatch-server.service && (sudo -n systemctl start activitywatch-dlp-aggregator.service || true) && sudo -n /usr/local/bin/aw-health-check && sudo -n /usr/local/bin/dlp-health-check'") }}
|
||||
AW_RUS_CASE_API_BASE={{ tsj_bot_aw_rus_case_api_base | default('http://10.10.10.13:5602') }}
|
||||
AW_RUS_HAYABUSA_ENABLED={{ tsj_bot_aw_rus_hayabusa_enabled | default('true') }}
|
||||
@@ -305,7 +305,7 @@
|
||||
- { key: "AW_RUS_WORKTIME_BASE", value: "{{ tsj_bot_aw_rus_worktime_base | default('http://10.10.10.13:5610') }}" }
|
||||
- { key: "AW_DLP_POLICY_API_BASE", value: "{{ tsj_bot_aw_dlp_policy_api_base | default('http://10.10.10.13:5601/api/0') }}" }
|
||||
- { key: "AW_DLP_POLICY_ACTOR", value: "{{ tsj_bot_aw_dlp_policy_actor | default('tsj-guardian-bot') }}" }
|
||||
- { key: "AW_RUS_WORKTIME_HEAL_CMD", value: "{{ tsj_bot_aw_rus_worktime_heal_cmd | default(\"ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new igor@10.10.10.13 'sudo -n /usr/local/bin/aw-worktime-autoheal.sh && sudo -n systemctl reset-failed aw-worktime-ui-bridge.service && sudo -n systemctl start aw-worktime-ui-bridge.service'\") }}" }
|
||||
- { key: "AW_RUS_WORKTIME_HEAL_CMD", value: "{{ tsj_bot_aw_rus_worktime_heal_cmd | default(\"ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new igor@10.10.10.13 'sudo -n /usr/local/bin/aw-worktime-autoheal-rust && sudo -n systemctl reset-failed aw-worktime-ui-bridge.service && sudo -n systemctl start aw-worktime-ui-bridge.service'\") }}" }
|
||||
- { key: "AW_RUS_DLP_HEAL_CMD", value: "{{ tsj_bot_aw_rus_dlp_heal_cmd | default(\"ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new igor@10.10.10.13 'sudo -n systemctl restart activitywatch-server.service && (sudo -n systemctl start activitywatch-dlp-aggregator.service || true) && sudo -n /usr/local/bin/aw-health-check && sudo -n /usr/local/bin/dlp-health-check'\") }}" }
|
||||
- { key: "AW_RUS_CASE_API_BASE", value: "{{ tsj_bot_aw_rus_case_api_base | default('http://10.10.10.13:5602') }}" }
|
||||
- { key: "AW_RUS_HAYABUSA_ENABLED", value: "{{ tsj_bot_aw_rus_hayabusa_enabled | default('true') }}" }
|
||||
|
||||
@@ -49,7 +49,7 @@ tsj_bot_aw_rus_api_base: "http://10.10.10.13:5600/api/0"
|
||||
tsj_bot_aw_rus_worktime_base: "http://10.10.10.13:5610"
|
||||
tsj_bot_aw_dlp_policy_api_base: "http://10.10.10.13:5601/api/0"
|
||||
tsj_bot_aw_dlp_policy_actor: "tsj-guardian-bot"
|
||||
tsj_bot_aw_rus_worktime_heal_cmd: "sshpass -p 'CHANGE_ME' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S /usr/local/bin/aw-worktime-autoheal.sh && sudo -S systemctl reset-failed aw-worktime-ui-bridge.service && sudo -S systemctl start aw-worktime-ui-bridge.service'"
|
||||
tsj_bot_aw_rus_worktime_heal_cmd: "sshpass -p 'CHANGE_ME' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S /usr/local/bin/aw-worktime-autoheal-rust && sudo -S systemctl reset-failed aw-worktime-ui-bridge.service && sudo -S systemctl start aw-worktime-ui-bridge.service'"
|
||||
tsj_bot_aw_rus_dlp_heal_cmd: "sshpass -p 'CHANGE_ME' ssh -o PubkeyAuthentication=no -o StrictHostKeyChecking=no igor@10.10.10.13 'sudo -S systemctl restart activitywatch-server.service && sudo -S systemctl start activitywatch-dlp-aggregator.service || true && sudo -S /usr/local/bin/aw-health-check && sudo -S /usr/local/bin/dlp-health-check'"
|
||||
tsj_bot_aw_rus_case_api_base: "http://10.10.10.13:5602"
|
||||
tsj_bot_aw_rus_hayabusa_enabled: "true"
|
||||
|
||||
@@ -1,46 +1,14 @@
|
||||
---
|
||||
- name: Создать один Proxmox CT и развернуть AWatch-rus
|
||||
- name: Deprecated Proxmox CT bootstrap path
|
||||
hosts: proxmox
|
||||
gather_facts: false
|
||||
|
||||
vars:
|
||||
proxmox_bootstrap_dir: "/tmp/aw-rus-bootstrap"
|
||||
aw_bootstrap_files:
|
||||
- install_aw_server.sh
|
||||
- apply_webui_ru_patch.sh
|
||||
- activitywatch-server.service
|
||||
- aw-worktime-api.py
|
||||
- aw-worktime-api.service
|
||||
- aw-worktime-ui-bridge.py
|
||||
- aw-worktime-ui-bridge.service
|
||||
- aw-worktime-ui-bridge.timer
|
||||
- aw-worktime-panel.js
|
||||
- aw-server.env.example
|
||||
- aw-ru-patch.js
|
||||
- aw-sw-cleanup.js
|
||||
- aw-host-groups.json
|
||||
- settings/classes-worktime.json
|
||||
- settings/views-default.json
|
||||
|
||||
tasks:
|
||||
- name: Выполнить workflow создания одного CT
|
||||
ansible.builtin.include_tasks: tasks/provision_ct_and_deploy_aw.yml
|
||||
vars:
|
||||
ct_id: "{{ proxmox_ct_id }}"
|
||||
ct_hostname: "{{ proxmox_ct_hostname }}"
|
||||
ct_storage: "{{ proxmox_ct_storage }}"
|
||||
ct_template: "{{ proxmox_ct_template }}"
|
||||
ct_rootfs_size: "{{ proxmox_ct_rootfs_size }}"
|
||||
ct_cores: "{{ proxmox_ct_cores }}"
|
||||
ct_memory: "{{ proxmox_ct_memory }}"
|
||||
ct_swap: "{{ proxmox_ct_swap }}"
|
||||
ct_bridge: "{{ proxmox_ct_bridge }}"
|
||||
ct_ip: "{{ proxmox_ct_ip }}"
|
||||
ct_gw: "{{ proxmox_ct_gw }}"
|
||||
ct_vlan: "{{ proxmox_ct_vlan | default('') }}"
|
||||
ct_nameserver: "{{ proxmox_ct_nameserver | default('') }}"
|
||||
ct_searchdomain: "{{ proxmox_ct_searchdomain | default('') }}"
|
||||
ct_password: "{{ proxmox_ct_password }}"
|
||||
ct_unprivileged: "{{ proxmox_ct_unprivileged }}"
|
||||
ct_onboot: "{{ proxmox_ct_onboot }}"
|
||||
ct_features: "{{ proxmox_ct_features }}"
|
||||
- name: Stop deprecated Python-era CT bootstrap
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/provision_proxmox_ct_and_deploy_aw.yml is deprecated because
|
||||
its bootstrap path copied removed Python service entrypoints. Use the
|
||||
existing DetMir AW server and ansible/deploy_aw_server.yml for the
|
||||
Rust application deploy. Rebuild this CT bootstrap path separately
|
||||
before using it for new infrastructure.
|
||||
|
||||
@@ -1,56 +1,14 @@
|
||||
---
|
||||
- name: Создать матрицу Proxmox CT и развернуть AWatch-rus с RU patch
|
||||
- name: Deprecated Proxmox CT matrix bootstrap path
|
||||
hosts: proxmox
|
||||
gather_facts: false
|
||||
|
||||
vars:
|
||||
proxmox_bootstrap_dir: "/tmp/aw-rus-bootstrap"
|
||||
aw_bootstrap_files:
|
||||
- install_aw_server.sh
|
||||
- apply_webui_ru_patch.sh
|
||||
- activitywatch-server.service
|
||||
- aw-worktime-api.py
|
||||
- aw-worktime-api.service
|
||||
- aw-worktime-ui-bridge.py
|
||||
- aw-worktime-ui-bridge.service
|
||||
- aw-worktime-ui-bridge.timer
|
||||
- aw-worktime-panel.js
|
||||
- aw-server.env.example
|
||||
- aw-ru-patch.js
|
||||
- aw-sw-cleanup.js
|
||||
- aw-host-groups.json
|
||||
- settings/classes-worktime.json
|
||||
- settings/views-default.json
|
||||
|
||||
tasks:
|
||||
- name: Проверить, что матрица CT задана
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- proxmox_ct_matrix is defined
|
||||
- proxmox_ct_matrix | length > 0
|
||||
fail_msg: "Задайте proxmox_ct_matrix в group_vars/proxmox-matrix.yml"
|
||||
|
||||
- name: Выполнить workflow создания для каждого CT
|
||||
ansible.builtin.include_tasks: tasks/provision_ct_and_deploy_aw.yml
|
||||
vars:
|
||||
ct_id: "{{ item.id }}"
|
||||
ct_hostname: "{{ item.hostname }}"
|
||||
ct_storage: "{{ item.storage }}"
|
||||
ct_template: "{{ item.template }}"
|
||||
ct_rootfs_size: "{{ item.rootfs_size }}"
|
||||
ct_cores: "{{ item.cores }}"
|
||||
ct_memory: "{{ item.memory }}"
|
||||
ct_swap: "{{ item.swap }}"
|
||||
ct_bridge: "{{ item.bridge }}"
|
||||
ct_ip: "{{ item.ip }}"
|
||||
ct_gw: "{{ item.gw }}"
|
||||
ct_vlan: "{{ item.vlan | default('') }}"
|
||||
ct_nameserver: "{{ item.nameserver | default('') }}"
|
||||
ct_searchdomain: "{{ item.searchdomain | default('') }}"
|
||||
ct_password: "{{ item.password }}"
|
||||
ct_unprivileged: "{{ item.unprivileged }}"
|
||||
ct_onboot: "{{ item.onboot }}"
|
||||
ct_features: "{{ item.features }}"
|
||||
loop: "{{ proxmox_ct_matrix }}"
|
||||
loop_control:
|
||||
label: "ct={{ item.id }} host={{ item.hostname }} ip={{ item.ip }}"
|
||||
- name: Stop deprecated Python-era CT matrix bootstrap
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/provision_proxmox_ct_matrix_and_deploy_aw.yml is deprecated
|
||||
because its bootstrap path copied removed Python service entrypoints.
|
||||
Use the existing DetMir AW server and ansible/deploy_aw_server.yml for
|
||||
the Rust application deploy. Rebuild this CT bootstrap path separately
|
||||
before using it for new infrastructure.
|
||||
|
||||
@@ -1,55 +1,7 @@
|
||||
---
|
||||
- name: Ensure DLP case management directory
|
||||
ansible.builtin.file:
|
||||
path: /opt/activitywatch/dlp-case-management
|
||||
state: directory
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Copy DLP case management files
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-case-management/{{ item }}"
|
||||
dest: "/opt/activitywatch/dlp-case-management/{{ item }}"
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0644"
|
||||
loop:
|
||||
- case_service.py
|
||||
- case_schema.py
|
||||
- case_storage.py
|
||||
- evidence_chain.py
|
||||
- requirements.txt
|
||||
|
||||
- name: Make case service executable
|
||||
ansible.builtin.file:
|
||||
path: /opt/activitywatch/dlp-case-management/case_service.py
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Create venv for DLP case management
|
||||
ansible.builtin.command:
|
||||
cmd: python3 -m venv /opt/activitywatch/dlp-case-management/.venv
|
||||
args:
|
||||
creates: /opt/activitywatch/dlp-case-management/.venv/bin/python
|
||||
|
||||
- name: Install Python dependencies for DLP case management
|
||||
ansible.builtin.pip:
|
||||
requirements: /opt/activitywatch/dlp-case-management/requirements.txt
|
||||
virtualenv: /opt/activitywatch/dlp-case-management/.venv
|
||||
|
||||
- name: Install systemd unit DLP case management
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-case-management/case-service.service"
|
||||
dest: /etc/systemd/system/aw-dlp-case-management.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Reload systemd and restart DLP case management
|
||||
ansible.builtin.systemd:
|
||||
name: aw-dlp-case-management.service
|
||||
daemon_reload: true
|
||||
enabled: true
|
||||
state: restarted
|
||||
- name: Deprecated role guard - DLP case management is Rust-only
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/roles/dlp-case-management is deprecated because it deployed the old
|
||||
Python runtime. Use ansible/deploy_aw_server.yml, which installs
|
||||
/usr/local/bin/aw-dlp-case-management-rust from adk-rust.
|
||||
|
||||
@@ -1,54 +1,7 @@
|
||||
---
|
||||
- name: Ensure DLP compliance directory tree
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
loop:
|
||||
- /opt/activitywatch/dlp-compliance
|
||||
- /opt/activitywatch/dlp-compliance/templates
|
||||
- /opt/activitywatch/dlp-compliance/reports
|
||||
|
||||
- name: Copy DLP compliance files
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-compliance/{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- { src: "report_generator.py", dest: "/opt/activitywatch/dlp-compliance/report_generator.py", mode: "0755" }
|
||||
- { src: "compliance_scheduler.py", dest: "/opt/activitywatch/dlp-compliance/compliance_scheduler.py", mode: "0755" }
|
||||
- { src: "requirements.txt", dest: "/opt/activitywatch/dlp-compliance/requirements.txt", mode: "0644" }
|
||||
- { src: "templates/152-fz-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html", mode: "0644" }
|
||||
- { src: "templates/pci-dss-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/pci-dss-report.html", mode: "0644" }
|
||||
- { src: "report-scheduler.service", dest: "/etc/systemd/system/aw-dlp-report-scheduler.service", mode: "0644" }
|
||||
- { src: "report-scheduler.timer", dest: "/etc/systemd/system/aw-dlp-report-scheduler.timer", mode: "0644" }
|
||||
|
||||
- name: Create venv for DLP compliance
|
||||
ansible.builtin.command:
|
||||
cmd: python3 -m venv /opt/activitywatch/dlp-compliance/.venv
|
||||
args:
|
||||
creates: /opt/activitywatch/dlp-compliance/.venv/bin/python
|
||||
|
||||
- name: Install Python dependencies for DLP compliance
|
||||
ansible.builtin.pip:
|
||||
requirements: /opt/activitywatch/dlp-compliance/requirements.txt
|
||||
virtualenv: /opt/activitywatch/dlp-compliance/.venv
|
||||
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Enable and start DLP compliance timer
|
||||
ansible.builtin.systemd:
|
||||
name: aw-dlp-report-scheduler.timer
|
||||
enabled: true
|
||||
state: restarted
|
||||
|
||||
- name: Run DLP compliance report once
|
||||
ansible.builtin.systemd:
|
||||
name: aw-dlp-report-scheduler.service
|
||||
state: started
|
||||
- name: Deprecated role guard - DLP compliance is Rust-only
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/roles/dlp-compliance is deprecated because it deployed the old
|
||||
Python runtime. Use ansible/deploy_aw_server.yml, which installs
|
||||
/usr/local/bin/aw-dlp-compliance-rust from adk-rust.
|
||||
|
||||
@@ -1,194 +1,7 @@
|
||||
---
|
||||
- name: Ensure DLP integrations directory
|
||||
ansible.builtin.file:
|
||||
path: /opt/activitywatch/dlp-integrations
|
||||
state: directory
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Copy DLP integrations files
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-integrations/{{ item }}"
|
||||
dest: "/opt/activitywatch/dlp-integrations/{{ item }}"
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0644"
|
||||
loop:
|
||||
- cef_exporter.py
|
||||
- syslog_forwarder.py
|
||||
- webhook_sender.py
|
||||
- cef-config.yaml
|
||||
- syslog-forwarder-config.yaml
|
||||
- webhook-config.yaml
|
||||
- requirements.txt
|
||||
|
||||
- name: Make DLP integrations scripts executable
|
||||
ansible.builtin.file:
|
||||
path: "/opt/activitywatch/dlp-integrations/{{ item }}"
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
loop:
|
||||
- cef_exporter.py
|
||||
- syslog_forwarder.py
|
||||
- webhook_sender.py
|
||||
|
||||
- name: Create venv for DLP integrations
|
||||
ansible.builtin.command:
|
||||
cmd: python3 -m venv /opt/activitywatch/dlp-integrations/.venv
|
||||
args:
|
||||
creates: /opt/activitywatch/dlp-integrations/.venv/bin/python
|
||||
|
||||
- name: Install Python dependencies for DLP integrations
|
||||
ansible.builtin.pip:
|
||||
requirements: /opt/activitywatch/dlp-integrations/requirements.txt
|
||||
virtualenv: /opt/activitywatch/dlp-integrations/.venv
|
||||
|
||||
- name: Ensure integrations state directory
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/activitywatch/dlp-integrations
|
||||
state: directory
|
||||
owner: "{{ aw_server_user | default('activitywatch') }}"
|
||||
group: "{{ aw_server_group | default('activitywatch') }}"
|
||||
mode: "0755"
|
||||
|
||||
- name: Install systemd units/timers for DLP integrations
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../aw-server/dlp-integrations/{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
loop:
|
||||
- { src: "cef-exporter.service", dest: "/etc/systemd/system/aw-dlp-cef-exporter.service" }
|
||||
- { src: "cef-exporter.timer", dest: "/etc/systemd/system/aw-dlp-cef-exporter.timer" }
|
||||
- { src: "syslog-forwarder.service", dest: "/etc/systemd/system/aw-dlp-syslog-forwarder.service" }
|
||||
- { src: "syslog-forwarder.timer", dest: "/etc/systemd/system/aw-dlp-syslog-forwarder.timer" }
|
||||
- { src: "webhook-sender.service", dest: "/etc/systemd/system/aw-dlp-webhook-sender.service" }
|
||||
- { src: "webhook-sender.timer", dest: "/etc/systemd/system/aw-dlp-webhook-sender.timer" }
|
||||
|
||||
- name: Check local Rust CEF exporter
|
||||
ansible.builtin.stat:
|
||||
path: "{{ playbook_dir }}/../adk-rust/target/release/dlp-cef-exporter"
|
||||
delegate_to: localhost
|
||||
register: dlp_cef_exporter_rust_binary
|
||||
become: false
|
||||
|
||||
- name: Install Rust CEF exporter
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../adk-rust/target/release/dlp-cef-exporter"
|
||||
dest: /usr/local/bin/dlp-cef-exporter-rust
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_cef_exporter_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Ensure CEF exporter drop-in directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/aw-dlp-cef-exporter.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_cef_exporter_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Switch CEF exporter to Rust
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/aw-dlp-cef-exporter.service.d/20-rust-switch.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/local/bin/dlp-cef-exporter-rust
|
||||
when: dlp_cef_exporter_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Check local Rust syslog forwarder
|
||||
ansible.builtin.stat:
|
||||
path: "{{ playbook_dir }}/../adk-rust/target/release/dlp-syslog-forwarder"
|
||||
delegate_to: localhost
|
||||
register: dlp_syslog_forwarder_rust_binary
|
||||
become: false
|
||||
|
||||
- name: Install Rust syslog forwarder
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../adk-rust/target/release/dlp-syslog-forwarder"
|
||||
dest: /usr/local/bin/dlp-syslog-forwarder-rust
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Ensure syslog forwarder drop-in directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/aw-dlp-syslog-forwarder.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Switch syslog forwarder to Rust
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/aw-dlp-syslog-forwarder.service.d/20-rust-switch.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/local/bin/dlp-syslog-forwarder-rust
|
||||
when: dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Check local Rust webhook sender
|
||||
ansible.builtin.stat:
|
||||
path: "{{ playbook_dir }}/../adk-rust/target/release/dlp-webhook-sender"
|
||||
delegate_to: localhost
|
||||
register: dlp_webhook_sender_rust_binary
|
||||
become: false
|
||||
|
||||
- name: Install Rust webhook sender
|
||||
ansible.builtin.copy:
|
||||
src: "{{ playbook_dir }}/../adk-rust/target/release/dlp-webhook-sender"
|
||||
dest: /usr/local/bin/dlp-webhook-sender-rust
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_webhook_sender_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Ensure webhook sender drop-in directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/system/aw-dlp-webhook-sender.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0755"
|
||||
when: dlp_webhook_sender_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Switch webhook sender to Rust
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/aw-dlp-webhook-sender.service.d/20-rust-switch.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
content: |
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/local/bin/dlp-webhook-sender-rust
|
||||
when: dlp_webhook_sender_rust_binary.stat.exists | default(false)
|
||||
|
||||
- name: Reload systemd
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Enable and restart DLP integration timers
|
||||
ansible.builtin.systemd:
|
||||
name: "{{ item }}"
|
||||
enabled: true
|
||||
state: restarted
|
||||
loop:
|
||||
- aw-dlp-cef-exporter.timer
|
||||
- aw-dlp-syslog-forwarder.timer
|
||||
- aw-dlp-webhook-sender.timer
|
||||
- name: Deprecated role guard - DLP integrations are Rust-only
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/roles/dlp-integrations is deprecated because it deployed the old
|
||||
Python runtime. Use ansible/deploy_aw_server.yml, which installs the
|
||||
Rust CEF, syslog, and webhook exporters from adk-rust.
|
||||
|
||||
@@ -1,46 +1,7 @@
|
||||
---
|
||||
- name: Ensure policy engine directory exists
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: /opt/activitywatch/dlp-policy-engine
|
||||
state: directory
|
||||
owner: activitywatch
|
||||
group: activitywatch
|
||||
mode: "0755"
|
||||
|
||||
- name: Deploy policy engine files
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
owner: activitywatch
|
||||
group: activitywatch
|
||||
mode: "{{ item.mode | default('0644') }}"
|
||||
loop:
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_service.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_service.py" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_schema.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_schema.py" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_storage.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_storage.py" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/policy_distributor.py", dest: "/opt/activitywatch/dlp-policy-engine/policy_distributor.py" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/requirements.txt", dest: "/opt/activitywatch/dlp-policy-engine/requirements.txt" }
|
||||
- { src: "{{ playbook_dir }}/../aw-server/dlp-policy-engine/dlp-policy-engine.service", dest: "/etc/systemd/system/aw-dlp-policy-engine.service" }
|
||||
|
||||
- name: Ensure policy engine venv exists
|
||||
become: true
|
||||
ansible.builtin.command:
|
||||
cmd: python3 -m venv /opt/activitywatch/dlp-policy-engine/.venv
|
||||
args:
|
||||
creates: /opt/activitywatch/dlp-policy-engine/.venv/bin/python
|
||||
|
||||
- name: Install python deps for policy engine venv
|
||||
become: true
|
||||
ansible.builtin.pip:
|
||||
requirements: /opt/activitywatch/dlp-policy-engine/requirements.txt
|
||||
virtualenv: /opt/activitywatch/dlp-policy-engine/.venv
|
||||
|
||||
- name: Enable and restart policy engine
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
name: aw-dlp-policy-engine.service
|
||||
enabled: true
|
||||
state: restarted
|
||||
- name: Deprecated role guard - DLP policy engine is Rust-only
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
ansible/roles/dlp-policy-engine is deprecated because it deployed the old
|
||||
Python runtime. Use ansible/deploy_aw_server.yml, which installs
|
||||
/usr/local/bin/aw-dlp-policy-engine-rust from adk-rust.
|
||||
|
||||
Reference in New Issue
Block a user