| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
It was expected to have the package_cache role reused or added as
dependency for other roles, but it turned out it's not used that way,
therefore removing it to a more simpler approach
|
|
Since the configs were mainly to control UI pref (which is not usable
with user.js, as it will always override manual customization)
The rest of the features provided by user.js isn't necessary and are
already covered by policies.
So for now, I'm removing this user.js integration, maybe revisit it
later if it's proven to be useful, ATM, it complicates and brittles the
setup without providing any additional value.
|
|
|
|
And fix the role ideompotent testing
|
|
Update the firefox role dependencies and added notes about using passff
and it's required dependencies
|
|
To avoid potential conflict when a user already have a profile named and
configured for them, it's simpler to use a defined ansible profile that
also indicates that the profile is automated
|
|
The USER env is failing on CI, so reverting back to using ansible_user_id
special variable, the ansible_user also failed as the CI doesn't have
ssh connection (at least not during the tests, and therefore the
ansible_user is undefined)
|
|
|
|
|
|
|
|
The gateway-direct-mode.service was never triggering when WireGuard
interfaces were removed, leaving VPN iptables rules active even when
VPN was disconnected. This caused internet connectivity to fail in
direct mode.
Root cause: SYSTEMD_WANTS in udev rules only works for ACTION=="add"
events. When a device is removed, the device unit is already gone
before systemd can process the SYSTEMD_WANTS dependency, so the
service never starts. This is a documented systemd limitation.
Fix: Replace SYSTEMD_WANTS with RUN+ for the remove action, which
executes systemctl directly during udev event processing without
requiring a device unit to exist.
References:
- https://stackoverflow.com/questions/72208534/why-does-systemd-wants-not-pass-a-parameter-to-a-service-file-from-a-udev-remov
- https://stackoverflow.com/questions/73148448/how-to-start-systemd-user-service-when-device-is-removed-and-stop-it-when-devic
- https://bugzilla.redhat.com/show_bug.cgi?id=871074https://bugzilla.redhat.com/show_bug.cgi?id=871074
- https://unix.stackexchange.com/questions/528803/systemd-doesnt-stop-the-service-when-the-device-is-removed
The VPN mode (ACTION=="add") continues to use SYSTEMD_WANTS as it
works correctly for device addition events.
|
|
The reason the idempotent test fails is the following:
- 1st run: wireguard role deploys all the configured VPN connections
- 1st run: wg_portal updates the file permissions /etc/wireguard (ACLs)
- 2nd run: wireguard sees the file changed, deploys again (idempotent failure)
|
|
|
|
When a wireguard configuration gets removed from the group/host
variables, the role now removes them and make sure only the files found
in the vars are the ones to be configured on the hosts
|
|
|
|
|
|
This allows the creation and persisting of the /run/user/UID/
directories required for gpg smart-card forwarding agent.
|
|
The dotfile/vim/password_store required to run as user with root
permissions, that's why reverting these changes on rpi and resolving to
using a more normal role (in pihole where it was broken)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
This disables install_recommends and revert to using specific gnome
packages that are needed/necessary for functioning
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The roles sometimes fail to install, and on linux it cannot be used with
casks which is defeating the purpose of having it to manage apps and
packages
|
|
Let the linux distros manage the ssl directories and it's permissions
instead of introducing complex logic to match the original created
permissions by the distro install
|
|
|
|
The ansible vars fail on CI because the validate arguments task runs way
before the setting of the variables, which causes the ansible undefined
vars on CI to cause errors.
This is a way better approach of having the static values as defaults
and allowing setting the variables to ansible vars in the host/group vars
|
|
|
|
Gnome installs avahi-daemon, and keeps reinstalling it
Remove the ubuntu specific tasks and install the packages with
recommendations (as we are removing the avahi-daemon afterwords to make
the network manager stable and idempotent)
|
|
|
|
The recommended debian/ubuntu install of gnome pulls avahi-daemon and
that could potentially conflicts with NetworkManager.
Therefore resorting to more restrictive approach for installing gnome
|
|
|
|
|
|
It seems that the gnome packages are complicated and might have postinst
scripts that causes the system state to change/correct...
For this, we just ignore it from the idempotent test
|
