Frank refactoring part 1

frank/ansible/bake-pies.yml

@@ -0,0 +1,179 @@
+#################################################
+# DO Community Playbooks: Docker
+#################################################
+---
+- hosts: all
+  become: true
+  vars_files:
+    - vars/pies.yml
+
+  tasks:
+    # - name: Check if LCD Rotated
+    #   shell: grep -c "lcd_rotate=2" /boot/config.txt || true
+    #   register: lcd_rotate_test
+
+    # - name: rotate the lcd
+    #   lineinfile:
+    #     dest: /boot/config.txt
+    #     line: lcd_rotate=2
+    #   when: lcd_rotate_test.stdout == "0"
+
+    - name: Update the hostname file
+      replace:
+        path: /etc/hostname
+        regexp: '(\s*)raspberrypi(\s+.*)?$'
+        replace: "\\1{{ hostname }}\\2"
+        backup: yes
+
+    - name: Update the hosts file
+      replace:
+        path: /etc/hosts
+        regexp: '(\s+)raspberrypi(\s+.*)?$'
+        replace: "\\1{{ hostname }}\\2"
+        backup: yes
+
+    - name: Ensure SSH Directory exists
+      file:
+          path: "/home/{{ user }}/.ssh"
+          state: directory
+          group: "{{ user }}"
+          owner: "{{ user }}"
+          mode: 0700
+
+    - name: Ensure authorized_keys file exists
+      copy:
+        content: ""
+        dest: "/home/{{ user }}/.ssh/authorized_keys"
+        force: no
+        group: "{{ user }}"
+        owner: "{{ user }}"
+        mode: 0644
+
+    - name: Check Terminus public key
+      shell: "grep -c \"{{ terminus_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
+      register: terminuskey_test
+
+    - name: Add Terminus public key
+      lineinfile:
+        dest: "/home/{{ user }}/.ssh/authorized_keys"
+        line: "{{ terminus_key }}"
+      when: terminuskey_test.stdout == "0"
+
+    - name: Check clair public key
+      shell: "grep -c \"{{ clair_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
+      register: clairkey_test
+
+    - name: Add clair public key
+      lineinfile:
+        dest: "/home/{{ user }}/.ssh/authorized_keys"
+        line: "{{ clair_key }}"
+      when: clairkey_test.stdout == "0"
+
+    - name: Check Anjin public key
+      shell: "grep -c \"{{ anjin_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
+      register: anjin_key_test
+
+    - name: Add Anjin public key
+      lineinfile:
+        dest: "/home/{{ user }}/.ssh/authorized_keys"
+        line: "{{ anjin_key }}"
+      when: anjin_key_test.stdout == "0"
+
+    - name: Update the sshd config file to disable password logins
+      replace:
+        path: /etc/ssh/sshd_config
+        regexp: '(\s+)#PasswordAuthentication yes(\s+.*)?$'
+        replace: "\\1PasswordAuthentication no\\2"
+        backup: yes
+
+    - name: Check if .ssh config file exists
+      stat:
+        path: "/home/{{ user }}/.ssh/config"
+      register: config_status
+
+    - name: No need to upload the .ssh config
+      when: config_status.stat.exists == true
+      debug:
+        msg: No need to upload the .ssh config as it already exists.
+
+    - name: Upload the .ssh config file
+      when: config_status.stat.exists == false
+      template:
+        src: "files/config"
+        dest: "/home/{{ user }}/.ssh/config"
+        group: "{{ user }}"
+        owner: "{{ user }}"
+        mode: 0644
+
+    - name: Check if ed25519 key exists
+      stat:
+        path: "/home/{{ user }}/.ssh/id_ed25519"
+      register: key_status
+
+    - name: No need to generate new ed25519 key
+      when: key_status.stat.exists == true
+      debug:
+        msg: No need to generate new ed25519 key as it already exists.
+
+    - name: Generate new id_ed25519 key
+      when: key_status.stat.exists == false
+      become: yes
+      become_user: "{{ user }}"
+      shell: ssh-keygen -t ed25519 -q -f "/home/{{ user }}/.ssh/id_ed25519" -C "{{ user }}@{{ hostname }} $(date '+%Y.%m.%d')" -N ""
+
+    - name: Install Docker
+      shell: curl -sSL https://get.docker.com | sh
+
+    - name: Install matchbox-keyboard
+      package:
+        name: matchbox-keyboard
+        state: latest
+
+    - name: Install python3-docker
+      package:
+        name: python3-docker
+        state: latest
+
+    - name: adding user to group docker
+      user:
+        name: "{{ user }}"
+        groups: docker
+        append: yes
+
+    - name: adding user to group lp (line printers)
+      user:
+        name: "{{ user }}"
+        groups: lp
+        append: yes
+
+    - name: install nats-tunnel systemd unit file
+      template:
+        src: "files/nats-tunnel.service"
+        dest: "/etc/systemd/system/nats-tunnel.service"
+
+    - name: enable service nats-tunnel and ensure it is not masked
+      systemd:
+        name: nats-tunnel
+        enabled: yes
+        masked: no
+
+    - name: Make sure nats-tunnel service is running
+      systemd:
+        state: started
+        name: nats-tunnel
+
+    - name: install leardal systemd unit file
+      template:
+        src: "files/leardal.service"
+        dest: "/etc/systemd/system/leardal.service"
+
+    - name: enable service leardal and ensure it is not masked
+      systemd:
+        name: leardal
+        enabled: yes
+        masked: no
+
+    - name: Make sure leardal service is running
+      systemd:
+        state: started
+        name: leardal

frank/ansible/files/config

@@ -0,0 +1,4 @@
+Host {{ server }} {{ server }}.tanshu.com
+    HostName {{ server }}.tanshu.com
+    IdentityFile ~/.ssh/id_ed25519
+    User tanshu

frank/ansible/files/frank.env

@@ -0,0 +1,5 @@
+NATS_URL=nats://localhost:4222
+DURABLE={{ queue_name }}
+SUBJECT="barker.print"
+STREAM="barker_print_stream"
+ADDRESS={{ printer_port }}

frank/ansible/files/frank.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Frank container service
+After=docker.service {{ server }}-redis-tunnel.service
+Wants=network-online.target docker.socket {{ server }}-redis-tunnel.service
+Requires=docker.socket {{ server }}-redis-tunnel.service
+PartOf={{ server }}-redis-tunnel.service
+
+[Service]
+Restart=always
+RestartSec=3
+ExecStart=/usr/bin/docker start -a frank
+ExecStop=/usr/bin/docker stop -t 10 frank
+
+[Install]
+WantedBy=multi-user.target

frank/ansible/files/leardal.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Reverse SSH connection
+After=network.target
+
+[Service]
+Type=simple
+User={{ user }}
+
+ExecStart=/usr/bin/ssh -NTg -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes -o ServerAliveCountMax=3 -o StrictHostKeyChecking=no -i /home/{{ user }}/.ssh/id_ed25519 -R {{ ssh_port }}:localhost:22 tanshu@{{ server }}.tanshu.com
+
+# Restart every >2 seconds to avoid StartLimitInterval failure
+Restart=always
+RestartSec=5s
+
+[Install]
+WantedBy=default.target

frank/ansible/files/nats-tunnel.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Keep ssh tunnel to specified remote host open
+After=network.target
+
+[Service]
+User={{ user }}
+
+ExecStart=/usr/bin/ssh -NT -o ServerAliveInterval=30 -o ExitOnForwardFailure=yes -o ServerAliveCountMax=2 -o StrictHostKeyChecking=no -i /home/{{ user }}/.ssh/id_ed25519 -L 4222:localhost:4222 tanshu@{{ server }}.tanshu.com
+
+# Restart every >2 seconds to avoid StartLimitInterval failure
+RestartSec=5
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

frank/ansible/hosts

@@ -0,0 +1,17 @@
+[all:vars]
+ansible_python_interpreter=/usr/bin/python3
+
+[frank]
+chd-bar ansible_host=clair var_file=vars/devices/chd-bar.yml
+pkl1 ansible_host=clair var_file=vars/devices/pkl1.yml
+pkl2 ansible_host=clair var_file=vars/devices/pkl2.yml
+pkl3 ansible_host=clair var_file=vars/devices/pkl3.yml
+pkl4 ansible_host=clair var_file=vars/devices/pkl4.yml
+moz1 ansible_host=clair var_file=vars/devices/moz1.yml
+moz2 ansible_host=clair var_file=vars/devices/moz2.yml
+mhl1 ansible_host=clair var_file=vars/devices/mhl1.yml
+mhl2 ansible_host=clair var_file=vars/devices/mhl2.yml
+mhl3 ansible_host=clair var_file=vars/devices/mhl3.yml
+mhl4 ansible_host=clair var_file=vars/devices/mhl4.yml
+chd1 ansible_host=clair var_file=vars/devices/chd1.yml
+chd2 ansible_host=clair var_file=vars/devices/chd2.yml

frank/ansible/playbook.yml

@@ -0,0 +1,19 @@
+#################################################
+# DO Community Playbooks: Docker
+#################################################
+---
+- hosts: frank
+  become: true
+  vars_files:
+    - vars/registry.yml
+    - vars/pies.yml
+
+  pre_tasks:
+    - name: Load per-host vars file from inventory (var_file)
+      ansible.builtin.include_vars:
+        file: "{{ var_file }}"
+      when: var_file is defined
+
+  roles:
+    - tunnels
+    - frank

frank/ansible/roles/frank/tasks/main.yml

@@ -0,0 +1,57 @@
+---
+- name: Check if frank .env file exists
+  stat: path="/home/{{ user }}/frank.env"
+  register: status
+
+- name: No need to upload the frank .env file
+  debug:
+    msg: "No need to upload the frank .env file as it already exists."
+
+- name: Upload the frank .env file
+  when: status.stat.exists == false
+  template:
+    src: files/frank.env
+    dest: "/home/{{ user }}/frank.env"
+    group: "{{ user }}"
+    owner: "{{ user }}"
+    mode: 0644
+
+- name: Log into registry
+  docker_login:
+    registry: "{{ registry }}"
+    username: "{{ username }}"
+    password: "{{ password }}"
+
+- name: Pull frank image
+  docker_image:
+    name: "registry.tanshu.com/frank:{{ frank_version | default('latest') }}"
+    source: pull
+    force_source: yes
+
+- name: Create frank worker container
+  docker_container:
+    name: "frank"
+    image: "registry.tanshu.com/frank:{{ frank_version | default('latest') }}"
+    pull: true
+    state: started
+    restart_policy: "no"
+    env_file: "/home/{{ user }}/frank.env"
+    network_mode: "host"
+    devices:
+      - "{{ printer_port }}:/printer"
+
+- name: install frank systemd unit file
+  template:
+    src: "files/frank.service"
+    dest: "/etc/systemd/system/frank.service"
+
+- name: enable service frank and ensure it is not masked
+  systemd:
+    name: frank
+    enabled: yes
+    masked: no
+
+- name: Make sure frank service is running
+  systemd:
+    state: started
+    name: frank

frank/ansible/roles/tunnels/tasks/main.yml

@@ -0,0 +1,32 @@
+---
+- name: install nats-tunnel systemd unit file
+  template:
+    src: "files/nats-tunnel.service"
+    dest: "/etc/systemd/system/nats-tunnel.service"
+
+- name: enable service nats-tunnel and ensure it is not masked
+  systemd:
+    name: nats-tunnel
+    enabled: yes
+    masked: no
+
+- name: Make sure nats-tunnel service is running
+  systemd:
+    state: started
+    name: nats-tunnel
+
+- name: install leardal systemd unit file
+  template:
+    src: "files/leardal.service"
+    dest: "/etc/systemd/system/leardal.service"
+
+- name: enable service leardal and ensure it is not masked
+  systemd:
+    name: leardal
+    enabled: yes
+    masked: no
+
+- name: Make sure leardal service is running
+  systemd:
+    state: started
+    name: leardal

frank/ansible/vars/devices/chd-bar.yml

@@ -0,0 +1,6 @@
+---
+hostname: chd-bar
+ssh_port: 22242
+user: vari
+queue_name: moz-elante
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/chd1.yml

@@ -0,0 +1,5 @@
+---
+hostname: chd1
+ssh_port: 22341
+user: pi
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/chd2.yml

@@ -0,0 +1,5 @@
+---
+hostname: chd2
+ssh_port: 22342
+user: pi
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/mhl1.yml

@@ -0,0 +1,5 @@
+---
+hostname: mhl1
+ssh_port: 22441
+user: pi
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/mhl2.yml

@@ -0,0 +1,5 @@
+---
+hostname: mhl2
+ssh_port: 22442
+user: pi
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/mhl3.yml

@@ -0,0 +1,5 @@
+---
+hostname: mhl3
+ssh_port: 22443
+user: pi
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/mhl4.yml

@@ -0,0 +1,5 @@
+---
+hostname: mhl4
+ssh_port: 22444
+user: pi
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/moz1.yml

@@ -0,0 +1,5 @@
+---
+hostname: moz1
+ssh_port: 22541
+user: vari
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/moz2.yml

@@ -0,0 +1,5 @@
+---
+hostname: moz2
+ssh_port: 22542
+user: vari
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/pkl1.yml

@@ -0,0 +1,5 @@
+---
+hostname: pkl1
+ssh_port: 22241
+user: pi
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/pkl2.yml

@@ -0,0 +1,5 @@
+---
+hostname: pkl2
+ssh_port: 22242
+user: pi
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/pkl3.yml

@@ -0,0 +1,5 @@
+---
+hostname: pkl3
+ssh_port: 22243
+user: pi
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/devices/pkl4.yml

@@ -0,0 +1,6 @@
+---
+hostname: pkl4
+ssh_port: 22244
+user: pi
+queue_name: moz-elante
+printer_port: "/dev/usb/lp0"

frank/ansible/vars/pies.yml

@@ -0,0 +1,5 @@
+---
+terminus_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK8WQHla0uCcNwmN0DUE49lbjNWa6+7A6OxrX3WEPQH0 tanshu@terminus 2023.01.08"
+clair_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBeTz3weHvjJRTlBg+ovP3KfQNDvyn9mVsekAGwX1HMn tanshu@clair 2025-06-30"
+anjin_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlvalE0JqKyjpEsGTgtf/N1d9QK2MgNFJib+e8O2h9M tanshu@anjin 2024.09.28"
+server: "clair"

frank/ansible/vars/registry.yml

@@ -0,0 +1,4 @@
+---
+registry: registry.tanshu.com
+username: ta-registry
+password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f