115 lines
4.4 KiB
YAML
115 lines
4.4 KiB
YAML
---
|
|
# ============================================================================
|
|
# life-church/playbooks/thinkcenter-helvum.yml
|
|
# Install Helvum (GTK PipeWire patchbay) on thinkcenter via apt.
|
|
# thinkcenter ONLY. Idempotent. Native package (no flatpak).
|
|
# become password from Infisical /lc-hosts at runtime.
|
|
#
|
|
# Helvum is a lightweight visual patchbay for PipeWire — complements qpwgraph
|
|
# (installed by thinkcenter-audio). Requires a running PipeWire, which the
|
|
# audio playbook provides.
|
|
#
|
|
# UNDO: sudo apt remove --purge helvum
|
|
# ============================================================================
|
|
|
|
# --- Play 1 (localhost): fetch thinkcenter sudo pass from Infisical ----------
|
|
- name: "thinkcenter Helvum — resolve become password from Infisical"
|
|
hosts: localhost
|
|
gather_facts: false
|
|
tasks:
|
|
- name: "[resolve] Infisical creds from env"
|
|
ansible.builtin.set_fact:
|
|
infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
|
|
infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
|
|
infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
|
|
infisical_url: "{{ lookup('env','INFISICAL_API_URL') | default('http://192.168.122.41:8080', true) }}"
|
|
infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('prod', true) }}"
|
|
|
|
- name: "[resolve] Assert Infisical creds present"
|
|
ansible.builtin.assert:
|
|
that:
|
|
- infisical_client_id | length > 0
|
|
- infisical_client_secret | length > 0
|
|
- infisical_project_id | length > 0
|
|
fail_msg: "Infisical creds missing from Semaphore environment 'infisical-dev'."
|
|
|
|
- name: "[infisical] Log in"
|
|
infisical.vault.login:
|
|
url: "{{ infisical_url }}"
|
|
auth_method: universal_auth
|
|
universal_auth_client_id: "{{ infisical_client_id }}"
|
|
universal_auth_client_secret: "{{ infisical_client_secret }}"
|
|
register: infisical_login
|
|
no_log: true
|
|
|
|
- name: "[infisical] Read /lc-hosts"
|
|
infisical.vault.read_secrets:
|
|
login_data: "{{ infisical_login.login_data }}"
|
|
project_id: "{{ infisical_project_id }}"
|
|
env_slug: "{{ infisical_env_slug }}"
|
|
path: "/lc-hosts"
|
|
as_dict: true
|
|
register: lc_secrets
|
|
no_log: true
|
|
|
|
- name: "[set] Stash thinkcenter sudo pass"
|
|
ansible.builtin.set_fact:
|
|
thinkcenter_become_pass: "{{ lc_secrets.secrets['THINKCENTER_SUDO_PASS'] }}"
|
|
no_log: true
|
|
|
|
# --- Play 2: Helvum on thinkcenter ONLY --------------------------------------
|
|
- name: "Install Helvum on thinkcenter"
|
|
hosts: thinkcenter
|
|
gather_facts: true
|
|
become: true
|
|
vars:
|
|
ansible_become_pass: "{{ hostvars['localhost'].thinkcenter_become_pass }}"
|
|
tasks:
|
|
- name: "[safety] Confirm we are on thinkcenter"
|
|
ansible.builtin.assert:
|
|
that: inventory_hostname == 'thinkcenter'
|
|
fail_msg: "Refusing to run — this play is scoped to thinkcenter only."
|
|
|
|
- name: "[safety] Confirm Ubuntu-family host"
|
|
ansible.builtin.assert:
|
|
that: ansible_facts.os_family == 'Debian'
|
|
fail_msg: "This playbook targets Debian/Ubuntu (Mint). Host is {{ ansible_facts.os_family }}."
|
|
|
|
- name: "[apt] Update cache (retry on transient failure)"
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
register: apt_cache
|
|
until: apt_cache is succeeded
|
|
retries: 3
|
|
delay: 15
|
|
|
|
- name: "[apt] Install Helvum (retry on dpkg lock)"
|
|
ansible.builtin.apt:
|
|
name: helvum
|
|
state: present
|
|
register: helvum_install
|
|
until: helvum_install is succeeded
|
|
retries: 3
|
|
delay: 15
|
|
|
|
- name: "[verify] helvum binary present"
|
|
ansible.builtin.command: which helvum
|
|
register: helvum_which
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: "[verify] Assert Helvum installed"
|
|
ansible.builtin.assert:
|
|
that: helvum_which.rc == 0
|
|
fail_msg: "Helvum binary not found after install."
|
|
success_msg: "Helvum installed at {{ helvum_which.stdout | trim }}."
|
|
|
|
- name: "[report] Helvum summary"
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "===== thinkcenter Helvum ====="
|
|
- "packages changed this run : {{ helvum_install.changed }}"
|
|
- "helvum path : {{ helvum_which.stdout | default('n/a') | trim }}"
|
|
- "NOTE: Helvum needs a running PipeWire session (see thinkcenter-audio). Launch from the app menu."
|