Add awscli role with configuration on pi for garage backend w/testing

13 files changed, 138 insertions, 0 deletions

diff --git a/configure.yml b/configure.yml
index 9add9d57..647c0204 100644
--- a/configure.yml
+++ b/configure.yml
@@ -99,6 +99,7 @@
     - role: "neomutt"
     - role: "mount"
     - role: "garage"
+    - role: "awscli"
     - role: "wakeonlan"
 
 - name: "Proxmox VE configure"
diff --git a/host_vars/pve.local.yml b/host_vars/pve.local.yml
index 90730264..f8cfcdb6 100644
--- a/host_vars/pve.local.yml
+++ b/host_vars/pve.local.yml
diff --git a/host_vars/rpi5.local.yml b/host_vars/rpi5.local.yml
index 7f68115b..8c97bdef 100644
--- a/host_vars/rpi5.local.yml
+++ b/host_vars/rpi5.local.yml
diff --git a/host_vars/rpi5.local.yml.example b/host_vars/rpi5.local.yml.example
index 6ba629c9..ecc3ca12 100644
--- a/host_vars/rpi5.local.yml.example
+++ b/host_vars/rpi5.local.yml.example
@@ -97,3 +97,9 @@ garage_secret_access_key: "changeme"
 garage_bucket: "restic"
 garage_data_dir: "/backup/garage/data"
 garage_meta_dir: "/backup/garage/meta"
+
+awscli_profile_name: "garage"
+awscli_region: "garage"
+awscli_endpoint_url: "http://127.0.0.1:{{ garage_s3_port }}"
+awscli_access_key_id: "{{ garage_access_key_id }}"
+awscli_secret_access_key: "{{ garage_secret_access_key }}"
diff --git a/molecule/archlinux-gnome/converge.yml b/molecule/archlinux-gnome/converge.yml
index c0e9a348..382cb2fd 100644
--- a/molecule/archlinux-gnome/converge.yml
+++ b/molecule/archlinux-gnome/converge.yml
@@ -51,6 +51,10 @@
     password_store_repo_url: "https://github.com/octocat/Spoon-Knife"
     firefox_install_browserpass: true
     firefox_install_passff: true
+    awscli_profile_name: "example"
+    awscli_region: "eu-central-1"
+    awscli_access_key_id: "CHANGEME"
+    awscli_secret_access_key: "CHANGEME"
   pre_tasks:
     - name: "Override is_chroot fact for container environment"
       ansible.builtin.set_fact:
@@ -100,6 +104,7 @@
     - role: "podman"
     - role: "ansible"
     - role: "claude"
+    - role: "awscli"
     - role: "firefox"
     - role: "chromium"
     - role: "obsidian"
diff --git a/molecule/archlinux/converge.yml b/molecule/archlinux/converge.yml
index 0bc282df..8bfda8f1 100644
--- a/molecule/archlinux/converge.yml
+++ b/molecule/archlinux/converge.yml
@@ -51,6 +51,10 @@
     password_store_repo_url: "https://github.com/octocat/Spoon-Knife"
     firefox_install_browserpass: true
     firefox_install_passff: true
+    awscli_profile_name: "example"
+    awscli_region: "eu-central-1"
+    awscli_access_key_id: "CHANGEME"
+    awscli_secret_access_key: "CHANGEME"
   pre_tasks:
     - name: "Override is_chroot fact for container environment"
       ansible.builtin.set_fact:
@@ -99,6 +103,7 @@
     - role: "podman"
     - role: "ansible"
     - role: "claude"
+    - role: "awscli"
     - role: "firefox"
     - role: "chromium"
     - role: "obsidian"
diff --git a/molecule/debian/converge.yml b/molecule/debian/converge.yml
index 481510ce..2c6d5679 100644
--- a/molecule/debian/converge.yml
+++ b/molecule/debian/converge.yml
@@ -61,6 +61,10 @@
     password_store_repo_url: "https://github.com/octocat/Spoon-Knife"
     firefox_install_browserpass: true
     firefox_install_passff: true
+    awscli_profile_name: "example"
+    awscli_region: "eu-central-1"
+    awscli_access_key_id: "CHANGEME"
+    awscli_secret_access_key: "CHANGEME"
   pre_tasks:
     - name: "Override is_chroot fact for container environment"
       ansible.builtin.set_fact:
@@ -117,6 +121,7 @@
     - role: "btop"
     - role: "pipewire"
     - role: "claude"
+    - role: "awscli"
     - role: "localsend"
     - role: "restic"
     - role: "ethtool"
diff --git a/molecule/raspberrypi/converge.yml b/molecule/raspberrypi/converge.yml
index 499b37cf..880fec34 100644
--- a/molecule/raspberrypi/converge.yml
+++ b/molecule/raspberrypi/converge.yml
@@ -64,6 +64,10 @@
     mount_device: "tmpfs"
     mount_fstype: "tmpfs"
     mount_options: "defaults,mode=0755"
+    awscli_profile_name: "example"
+    awscli_region: "eu-central-1"
+    awscli_access_key_id: "CHANGEME"
+    awscli_secret_access_key: "CHANGEME"
   pre_tasks:
     - name: "Override is_chroot fact for container environment"
       ansible.builtin.set_fact:
@@ -95,6 +99,7 @@
     - role: "grafana"
     - role: "mount"
     - role: "garage"
+    - role: "awscli"
     - role: "gnome"
     - role: "gnome-calendar"
     - role: "gnome-loupe"
diff --git a/molecule/ubuntu/converge.yml b/molecule/ubuntu/converge.yml
index 958c2541..306b1387 100644
--- a/molecule/ubuntu/converge.yml
+++ b/molecule/ubuntu/converge.yml
@@ -51,6 +51,10 @@
     password_store_repo_url: "https://github.com/octocat/Spoon-Knife"
     firefox_install_browserpass: true
     firefox_install_passff: true
+    awscli_profile_name: "example"
+    awscli_region: "eu-central-1"
+    awscli_access_key_id: "CHANGEME"
+    awscli_secret_access_key: "CHANGEME"
   pre_tasks:
     - name: "Override is_chroot fact for container environment"
       ansible.builtin.set_fact:
@@ -107,6 +111,7 @@
     - role: "btop"
     - role: "pipewire"
     - role: "claude"
+    - role: "awscli"
     - role: "steam"
     - role: "localsend"
     - role: "restic"
diff --git a/roles/awscli/defaults/main.yml b/roles/awscli/defaults/main.yml
new file mode 100644
index 00000000..166b6c53
--- /dev/null
+++ b/roles/awscli/defaults/main.yml
@@ -0,0 +1,2 @@
+---
+awscli_version: "latest"
diff --git a/roles/awscli/meta/argument_specs.yml b/roles/awscli/meta/argument_specs.yml
new file mode 100644
index 00000000..3fe2358c
--- /dev/null
+++ b/roles/awscli/meta/argument_specs.yml
@@ -0,0 +1,32 @@
+---
+argument_specs:
+  main:
+    options:
+      awscli_version:
+        type: "str"
+        description: "aws-cli version to install via mise (e.g. 'latest', '2.19.0')"
+        default: "latest"
+      awscli_profile_name:
+        type: "str"
+        description: >-
+          AWS CLI profile name to configure. Use "default" to make it the
+          profile used when --profile is omitted
+        required: true
+      awscli_access_key_id:
+        type: "str"
+        description: "Access key ID for this profile"
+        required: true
+      awscli_secret_access_key:
+        type: "str"
+        description: "Secret access key for this profile"
+        required: true
+      awscli_region:
+        type: "str"
+        description: "Region for this profile (e.g. garage's configured s3_region for a garage profile)"
+        required: true
+      awscli_endpoint_url:
+        type: "str"
+        description: >-
+          Custom S3 endpoint URL for this profile, Omit for real AWS
+          (e.g. http://127.0.0.1:3900 for garage).
+        required: false
diff --git a/roles/awscli/meta/main.yml b/roles/awscli/meta/main.yml
new file mode 100644
index 00000000..7667b31b
--- /dev/null
+++ b/roles/awscli/meta/main.yml
@@ -0,0 +1,18 @@
+---
+dependencies:
+  - role: "mise"
+galaxy_info:
+  author: "a14m"
+  description: "Install and configure aws-cli via mise"
+  license: "MIT"
+  min_ansible_version: "2.18"
+  platforms:
+    - name: "ArchLinux"
+      versions:
+        - "all"
+    - name: "Ubuntu"
+      versions:
+        - "noble"
+    - name: "Debian"
+      versions:
+        - "bookworm"
diff --git a/roles/awscli/tasks/main.yml b/roles/awscli/tasks/main.yml
new file mode 100644
index 00000000..b28747a4
--- /dev/null
+++ b/roles/awscli/tasks/main.yml
@@ -0,0 +1,54 @@
+---
+- name: "Check installed aws-cli versions"
+  ansible.builtin.command:
+    cmd: "mise ls aws-cli"
+  register: awscli_installed_versions
+  changed_when: false
+
+- name: "Install aws-cli"
+  ansible.builtin.command:
+    cmd: "mise use --global aws-cli@{{ awscli_version }}"
+  changed_when: true
+  when: awscli_version not in awscli_installed_versions.stdout
+
+- name: "Ensure .aws directory exists"
+  ansible.builtin.file:
+    path: "{{ ansible_facts['env']['HOME'] }}/.aws"
+    state: "directory"
+    mode: "0700"
+
+# AWS CLI's config file uses "[default]" for the default profile but
+# "[profile <name>]" for every other named profile - credentials file has
+# no such special case, it's always "[<name>]".
+- name: "Determine aws-cli config section name"
+  ansible.builtin.set_fact:
+    awscli_config_section: "{{ 'default' if awscli_profile_name == 'default' else 'profile ' + awscli_profile_name }}"
+
+- name: "Configure aws-cli credentials"
+  community.general.ini_file:
+    path: "{{ ansible_facts['env']['HOME'] }}/.aws/credentials"
+    section: "{{ awscli_profile_name }}"
+    option: "{{ item.key }}"
+    value: "{{ item.value }}"
+    mode: "0600"
+  loop:
+    - { key: "aws_access_key_id", value: "{{ awscli_access_key_id }}" }
+    - { key: "aws_secret_access_key", value: "{{ awscli_secret_access_key }}" }
+  no_log: true
+
+- name: "Configure aws-cli profile region"
+  community.general.ini_file:
+    path: "{{ ansible_facts['env']['HOME'] }}/.aws/config"
+    section: "{{ awscli_config_section }}"
+    option: "region"
+    value: "{{ awscli_region }}"
+    mode: "0600"
+
+- name: "Configure aws-cli profile endpoint URL"
+  community.general.ini_file:
+    path: "{{ ansible_facts['env']['HOME'] }}/.aws/config"
+    section: "{{ awscli_config_section }}"
+    option: "endpoint_url"
+    value: "{{ awscli_endpoint_url }}"
+    mode: "0600"
+  when: awscli_endpoint_url is defined