@crvouga/dev-fleet 0.0.0-stage → 0.1.0

package/ansible/monitoring/agent-darwin.yml

@@ -0,0 +1,198 @@
+---
+# The manager's own Beszel agent, so the manager is always a monitored system
+# on its own hub. It runs as the signed-in user (no become, like hub-darwin.yml)
+# as an always-on per-user launchd agent: fleet-sync stays unattended and never
+# needs the manager's sudo password. Credentials arrive through private
+# variables, never argv.
+- name: Converge the manager's native Beszel agent as a per-user launchd agent
+  hosts: localhost
+  connection: local
+  become: false
+  gather_facts: true
+  vars_files:
+    - ../macos/policy.json
+  vars:
+    beszel_lock: "{{ lookup('ansible.builtin.file', 'lock.json') | from_json }}"
+    beszel_arch: "{{ {'arm64': 'darwin-arm64', 'x86_64': 'darwin-amd64'}.get(ansible_facts.architecture, 'unsupported') }}"
+    beszel_home: '{{ ansible_facts.env.HOME }}'
+    beszel_base: '{{ beszel_home }}/Library/Application Support/personal-beszel-agent'
+    beszel_root: '{{ beszel_base }}/{{ beszel_lock.version }}'
+    beszel_secrets: '{{ beszel_base }}/credentials'
+    beszel_data: '{{ beszel_base }}/data'
+    beszel_plist: '{{ beszel_home }}/Library/LaunchAgents/{{ beszelDaemon }}.plist'
+    beszel_domain: 'gui/{{ ansible_facts.user_uid }}'
+  tasks:
+    - name: Require supported platform and private hub policy
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.os_family == 'Darwin'
+          - beszel_arch in beszel_lock.agents
+          - beszel_node is match('^[a-z][a-z0-9-]{0,62}$')
+          - beszel_hub_url is match('^https://[a-z0-9.-]+\.ts\.net:8443$')
+    - name: Inspect a legacy system-wide daemon with the same label
+      ansible.builtin.stat:
+        path: '/Library/LaunchDaemons/{{ beszelDaemon }}.plist'
+      register: legacy_daemon
+    - name: Refuse to run two agents for one system
+      ansible.builtin.assert:
+        that: not legacy_daemon.stat.exists
+        fail_msg: BESZEL_LEGACY_DAEMON; remove the root LaunchDaemon once (sudo launchctl bootout system/{{ beszelDaemon }}) before the per-user agent replaces it.
+    - name: Inspect existing agent ownership
+      ansible.builtin.stat:
+        path: '{{ beszel_plist }}'
+      register: existing_plist
+    - name: Read existing agent ownership marker
+      ansible.builtin.slurp:
+        src: '{{ beszel_plist }}'
+      register: existing_agent
+      when: existing_plist.stat.exists
+    # The marker's package path is informational: ownership must survive the
+    # owning directory being moved.
+    - name: Require explicit adoption of any previously unmanaged agent
+      ansible.builtin.assert:
+        that:
+          - "not existing_plist.stat.exists or 'Managed by personal Fleet:' in (existing_agent.content | default('') | b64decode)"
+        fail_msg: Unmanaged Beszel launch agent exists. Review a source-controlled migration before replacing it.
+    - name: Create private configuration, version and state directories
+      ansible.builtin.file:
+        path: '{{ item }}'
+        state: directory
+        mode: '0700'
+      loop:
+        - '{{ beszel_base }}'
+        - '{{ beszel_root }}'
+        - '{{ beszel_secrets }}'
+        - '{{ beszel_data }}'
+        - '{{ beszel_home }}/Library/LaunchAgents'
+    - name: Deliver node-specific credentials through private variables, never command arguments
+      ansible.builtin.copy:
+        dest: '{{ beszel_secrets }}/{{ item.name }}'
+        content: '{{ item.value }}'
+        mode: '0600'
+      loop:
+        - { name: hub-key, value: '{{ beszel_public_key }}' }
+        - { name: agent-token, value: '{{ beszel_agent_token }}' }
+      no_log: true
+      notify: Restart agent
+    - name: Download pinned native artifact with checksum verification
+      ansible.builtin.get_url:
+        url: 'https://github.com/henrygd/beszel/releases/download/v{{ beszel_lock.version }}/beszel-agent_{{ beszel_arch | replace("-", "_") }}.tar.gz'
+        dest: '{{ beszel_root }}/agent.tar.gz'
+        checksum: 'sha256:{{ beszel_lock.agents[beszel_arch] }}'
+        mode: '0644'
+        timeout: 60
+      register: agent_archive
+    - name: Inspect the extracted executable
+      ansible.builtin.stat:
+        path: '{{ beszel_root }}/beszel-agent'
+      register: agent_binary
+    # ansible.builtin.unarchive requires GNU tar; macOS ships BSD tar, which
+    # extracts this checksum-verified archive natively.
+    - name: Extract the pinned executable when new or missing
+      ansible.builtin.command:
+        argv:
+          [
+            /usr/bin/tar,
+            -xzf,
+            '{{ beszel_root }}/agent.tar.gz',
+            -C,
+            '{{ beszel_root }}',
+            beszel-agent,
+          ]
+      when: agent_archive.changed or not agent_binary.stat.exists or not agent_binary.stat.executable
+      changed_when: true
+      notify: Restart agent
+    - name: Install the source-owned always-on launch agent
+      ansible.builtin.copy:
+        dest: '{{ beszel_plist }}'
+        mode: '0644'
+        backup: true
+        content: |
+          <?xml version="1.0" encoding="UTF-8"?>
+          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+          <!-- Managed by personal Fleet: ansible/monitoring -->
+          <plist version="1.0"><dict>
+            <key>Label</key><string>{{ beszelDaemon }}</string>
+            <key>ProgramArguments</key><array>
+              <string>{{ beszel_root }}/beszel-agent</string>
+            </array>
+            <key>EnvironmentVariables</key><dict>
+              <key>HUB_URL</key><string>{{ beszel_hub_url }}</string>
+              <key>SYSTEM_NAME</key><string>{{ beszel_node }}</string>
+              <key>DATA_DIR</key><string>{{ beszel_data }}</string>
+              <key>KEY_FILE</key><string>{{ beszel_secrets }}/hub-key</string>
+              <key>TOKEN_FILE</key><string>{{ beszel_secrets }}/agent-token</string>
+              <key>DISABLE_SSH</key><string>true</string>
+            </dict>
+            <key>RunAtLoad</key><true/>
+            <key>KeepAlive</key><true/>
+            <key>ProcessType</key><string>Background</string>
+            <key>ThrottleInterval</key><integer>20</integer>
+            <key>Umask</key><integer>63</integer>
+            <key>StandardOutPath</key><string>{{ beszel_data }}/agent.log</string>
+            <key>StandardErrorPath</key><string>{{ beszel_data }}/agent.log</string>
+          </dict></plist>
+      notify: Reload agent definition
+    - name: Inspect whether the agent is loaded
+      ansible.builtin.command:
+        argv: [/bin/launchctl, print, '{{ beszel_domain }}/{{ beszelDaemon }}']
+      changed_when: false
+      failed_when: false
+      register: agent_loaded
+    - name: Load the agent at login and now
+      ansible.builtin.command:
+        argv:
+          [
+            /bin/launchctl,
+            bootstrap,
+            '{{ beszel_domain }}',
+            '{{ beszel_plist }}',
+          ]
+      when: agent_loaded.rc != 0
+      changed_when: true
+    - name: Complete any required agent restart before verification
+      ansible.builtin.meta: flush_handlers
+    - name: Independently check the agent postcondition
+      ansible.builtin.command:
+        argv: [/bin/launchctl, print, '{{ beszel_domain }}/{{ beszelDaemon }}']
+      changed_when: false
+      register: agent_state
+      retries: 5
+      delay: 2
+      until: "'state = running' in agent_state.stdout"
+  handlers:
+    # launchd caches a loaded definition: a changed plist needs a reload.
+    - name: Unload the stale agent definition
+      ansible.builtin.command:
+        argv:
+          [/bin/launchctl, bootout, '{{ beszel_domain }}/{{ beszelDaemon }}']
+      listen: Reload agent definition
+      failed_when: false
+      changed_when: true
+    - name: Load the current agent definition
+      ansible.builtin.command:
+        argv:
+          [
+            /bin/launchctl,
+            bootstrap,
+            '{{ beszel_domain }}',
+            '{{ beszel_plist }}',
+          ]
+      listen: Reload agent definition
+      register: agent_reload
+      # bootout completes asynchronously; retry until the label is free.
+      until: agent_reload.rc == 0
+      retries: 5
+      delay: 2
+      changed_when: true
+    - name: Restart agent
+      ansible.builtin.command:
+        argv:
+          [
+            /bin/launchctl,
+            kickstart,
+            -k,
+            '{{ beszel_domain }}/{{ beszelDaemon }}',
+          ]
+      failed_when: false
+      changed_when: true

package/ansible/monitoring/agent.yml

@@ -0,0 +1,134 @@
+---
+- name: Converge the native Beszel agent without replacing runtime identity
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: true
+  vars:
+    beszel_lock: "{{ lookup('ansible.builtin.file', 'lock.json') | from_json }}"
+    beszel_arch: "{{ {'x86_64': 'amd64', 'aarch64': 'arm64'}.get(ansible_facts.architecture, 'unsupported') }}"
+  tasks:
+    - name: Require supported platform and private hub policy
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.distribution == 'Ubuntu'
+          - beszel_arch in beszel_lock.agents
+          - beszel_node is match('^[a-z][a-z0-9-]{0,62}$')
+          - beszel_hub_url is match('^https://[a-z0-9.-]+\.ts\.net:8443$')
+    - name: Inspect existing native service ownership
+      ansible.builtin.stat:
+        path: /etc/systemd/system/beszel-agent.service
+        checksum_algorithm: sha256
+      register: existing_service
+    - name: Read existing service ownership marker
+      ansible.builtin.slurp:
+        src: /etc/systemd/system/beszel-agent.service
+      register: existing_unit
+      when: existing_service.stat.exists
+    - name: Require explicit adoption of any previously unmanaged service
+      ansible.builtin.assert:
+        that:
+          - "not existing_service.stat.exists or (existing_unit.content | default('') | b64decode).startswith('# Managed by personal Fleet:')"
+        fail_msg: Unmanaged Beszel unit exists. Review a source-controlled migration before replacing it.
+    - name: Create unprivileged service account
+      ansible.builtin.user:
+        name: beszel
+        system: true
+        create_home: false
+        shell: /usr/sbin/nologin
+    - name: Create restricted configuration and version directories
+      ansible.builtin.file:
+        path: '{{ item.path }}'
+        state: directory
+        owner: root
+        group: '{{ item.group }}'
+        mode: '{{ item.mode }}'
+      loop:
+        - { path: /etc/personal-beszel, group: beszel, mode: '0750' }
+        - {
+            path: '/usr/local/lib/personal-beszel/0.21.1',
+            group: root,
+            mode: '0755',
+          }
+    - name: Deliver node-specific token through private stdin, never command arguments
+      ansible.builtin.copy:
+        dest: '/etc/personal-beszel/{{ item.name }}'
+        content: '{{ item.value }}'
+        owner: root
+        group: beszel
+        mode: '0640'
+      loop:
+        - { name: hub-key, value: '{{ beszel_public_key }}' }
+        - { name: agent-token, value: '{{ beszel_agent_token }}' }
+      no_log: true
+      notify: Restart agent
+    - name: Require credentials delivered through the approved secret owner
+      ansible.builtin.stat:
+        path: '/etc/personal-beszel/{{ item }}'
+      loop: [hub-key, agent-token]
+      register: credentials
+      no_log: true
+    - name: Fail closed without node-specific credentials
+      ansible.builtin.assert:
+        that: item.stat.exists and item.stat.isreg and item.stat.size > 0
+        fail_msg: Beszel credentials missing; resume enrollment through Fleet.
+      loop: '{{ credentials.results }}'
+      no_log: true
+    - name: Restrict credential permissions
+      ansible.builtin.file:
+        path: '/etc/personal-beszel/{{ item }}'
+        owner: root
+        group: beszel
+        mode: '0640'
+      loop: [hub-key, agent-token]
+    - name: Download pinned native artifact with signature-preserving HTTPS and checksum
+      ansible.builtin.get_url:
+        url: 'https://github.com/henrygd/beszel/releases/download/v{{ beszel_lock.version }}/beszel-agent_linux_{{ beszel_arch }}.tar.gz'
+        dest: '/usr/local/lib/personal-beszel/{{ beszel_lock.version }}/agent.tar.gz'
+        checksum: 'sha256:{{ beszel_lock.agents[beszel_arch] }}'
+        mode: '0644'
+        timeout: 60
+    - name: Extract the pinned executable and repair file drift
+      ansible.builtin.unarchive:
+        src: '/usr/local/lib/personal-beszel/{{ beszel_lock.version }}/agent.tar.gz'
+        dest: '/usr/local/lib/personal-beszel/{{ beszel_lock.version }}'
+        remote_src: true
+      notify: Restart agent
+    - name: Install nonsecret node connection settings
+      ansible.builtin.copy:
+        dest: /etc/personal-beszel/agent.env
+        content: |
+          HUB_URL={{ beszel_hub_url }}
+          SYSTEM_NAME={{ beszel_node }}
+        owner: root
+        group: beszel
+        mode: '0640'
+        backup: true
+      notify: Restart agent
+    - name: Install source-owned systemd service
+      ansible.builtin.copy:
+        src: beszel-agent.service
+        backup: true
+        dest: /etc/systemd/system/beszel-agent.service
+        owner: root
+        group: root
+        mode: '0644'
+      notify: Restart agent
+    - name: Enable agent at boot
+      ansible.builtin.systemd_service:
+        name: beszel-agent.service
+        enabled: true
+        state: started
+        daemon_reload: true
+    - name: Complete any required agent restart before verification
+      ansible.builtin.meta: flush_handlers
+    - name: Independently check agent service postcondition
+      ansible.builtin.command:
+        argv: [systemctl, is-active, beszel-agent.service]
+      changed_when: false
+  handlers:
+    - name: Restart agent
+      ansible.builtin.systemd_service:
+        name: beszel-agent.service
+        state: restarted
+        daemon_reload: true

package/ansible/monitoring/beszel-agent.service

@@ -0,0 +1,42 @@
+# Managed by personal Fleet: ansible/monitoring
+[Unit]
+Description=Personal Fleet Beszel agent
+Wants=network-online.target tailscaled.service
+After=network-online.target tailscaled.service
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+User=beszel
+Group=beszel
+EnvironmentFile=/etc/personal-beszel/agent.env
+Environment=DATA_DIR=/var/lib/beszel-agent
+Environment=KEY_FILE=/etc/personal-beszel/hub-key
+Environment=TOKEN_FILE=/etc/personal-beszel/agent-token
+Environment=DISABLE_SSH=true
+Environment=SKIP_SYSTEMD_LOGS=true
+Environment=SERVICE_PATTERNS=ssh.service,tailscaled.service,t3code-desktop.service,personal-fleet-sync.service
+ExecStart=/usr/local/lib/personal-beszel/0.21.1/beszel-agent
+StateDirectory=beszel-agent
+StateDirectoryMode=0700
+Restart=always
+RestartSec=20
+TimeoutStopSec=20
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+MemoryMax=256M
+CPUQuota=25%
+TasksMax=128
+UMask=0077
+LogRateLimitIntervalSec=60
+LogRateLimitBurst=100
+
+[Install]
+WantedBy=multi-user.target

package/ansible/monitoring/compose.yml

@@ -0,0 +1,74 @@
+# Run on the manager only, through hub-darwin.yml from the verified checkout.
+# Never copy the hub data to a worker or run a second copy of its identity.
+name: personal-beszel
+services:
+  hub:
+    image: henrygd/beszel:0.21.1@sha256:8514a69d9bbbcb74f371a3205561ee231fc0289739cea64e8131f341d695b770
+    restart: unless-stopped
+    ports:
+      - '127.0.0.1:8090:8090'
+    environment:
+      APP_URL: '${BESZEL_APP_URL:-${BESZEL_HUB_URL:?private HTTPS hub URL required}}'
+      DISABLE_SSH: 'true'
+      CHECK_UPDATES: 'false'
+      # Single-operator private hub: fleet-registered systems are visible to every login.
+      SHARE_ALL_SYSTEMS: 'true'
+      # Visitors are signed in automatically as this read-only viewer account
+      # (never the fleet admin), so the dashboard needs no login. Empty keeps
+      # the normal login page.
+      AUTO_LOGIN: '${BESZEL_AUTO_LOGIN:-}'
+      # First start only (empty data directory): Beszel creates the fleet login
+      # as a verified user and superuser. hub-darwin.yml sets these just once.
+      USER_EMAIL: '${BESZEL_BOOTSTRAP_EMAIL:-}'
+      USER_PASSWORD: '${BESZEL_BOOTSTRAP_PASSWORD:-}'
+    volumes:
+      - type: bind
+        source: '${BESZEL_DATA_DIR:?per-user hub data directory required}'
+        target: /beszel_data
+        bind:
+          create_host_path: false
+    logging:
+      driver: local
+      options:
+        max-size: '10m'
+        max-file: '3'
+    mem_limit: 512m
+    cpus: 1.0
+    pids_limit: 128
+    stop_grace_period: 30s
+  # Outbound-only Cloudflare Tunnel for the public dashboard hostname. The
+  # connector token is delivered from the manager's Vault session to a 0600
+  # per-user file by hub-darwin.yml.
+  cloudflared:
+    profiles: [public-endpoint]
+    image: cloudflare/cloudflared:2026.9.3@sha256:072c067d25ccbe61d46e18f0d0723255f2bb5304f7317caa95b27031520ff92c
+    user: '1000:1000'
+    restart: unless-stopped
+    command:
+      [
+        'tunnel',
+        '--no-autoupdate',
+        'run',
+        '--token-file',
+        '/run/secrets/tunnel-token',
+      ]
+    volumes:
+      - type: bind
+        source: '${BESZEL_TUNNEL_TOKEN_FILE:?per-user connector token file required}'
+        target: /run/secrets/tunnel-token
+        read_only: true
+        bind:
+          create_host_path: false
+    depends_on:
+      - hub
+    read_only: true
+    cap_drop: [ALL]
+    security_opt: ['no-new-privileges:true']
+    mem_limit: 256m
+    cpus: 0.5
+    pids_limit: 128
+    logging:
+      driver: local
+      options:
+        max-size: '5m'
+        max-file: '2'

package/ansible/monitoring/hub-darwin.yml

@@ -0,0 +1,102 @@
+---
+# The Beszel hub runs only on the manager (the human's macOS machine) under
+# Docker Desktop, as that user: no become, per-user data and credential paths.
+# Runtime variables arrive through a private 0600 variables file, never argv.
+- name: Converge the Beszel hub on the manager
+  hosts: localhost
+  connection: local
+  become: false
+  gather_facts: true
+  vars:
+    beszel_lock: "{{ lookup('ansible.builtin.file', 'lock.json') | from_json }}"
+    beszel_compose:
+      - docker
+      - compose
+      - '-f'
+      - '{{ playbook_dir }}/compose.yml'
+    beszel_environment:
+      BESZEL_HUB_URL: '{{ beszel_hub_url }}'
+      BESZEL_APP_URL: '{{ beszel_public_url | default(beszel_hub_url) }}'
+      BESZEL_DATA_DIR: '{{ beszel_data_dir }}'
+      BESZEL_AUTO_LOGIN: '{{ beszel_auto_login | default("") }}'
+      BESZEL_TUNNEL_TOKEN_FILE: '{{ beszel_tunnel_dir }}/token'
+  tasks:
+    - name: Require the macOS manager and private dashboard policy
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.os_family == 'Darwin'
+          - beszel_hub_url is match('^https://[a-z0-9.-]+\.ts\.net:8443$')
+          - beszel_data_dir is match('^/Users/[^/]+/Library/Application Support/personal-beszel$')
+          - beszel_tunnel_dir is match('^/Users/[^/]+/Library/Application Support/personal-beszel-tunnel$')
+        fail_msg: BESZEL_NOT_MANAGER; the hub runs only on the macOS manager with per-user data.
+    - name: Require a running Docker Desktop engine with Compose
+      ansible.builtin.command:
+        argv: [docker, compose, version]
+      changed_when: false
+    - name: Inspect an existing hub image before any upgrade
+      ansible.builtin.command:
+        argv:
+          [
+            docker,
+            inspect,
+            '--format',
+            '{{ "{{.Config.Image}}" }}',
+            personal-beszel-hub-1,
+          ]
+      changed_when: false
+      failed_when: false
+      register: existing_hub
+    - name: Require explicit maintenance for a different existing image
+      ansible.builtin.assert:
+        that: existing_hub.rc != 0 or existing_hub.stdout == beszel_lock.image
+        fail_msg: BESZEL_HUB_UPGRADE_PENDING; take and verify a backup before an explicit maintenance upgrade.
+    - name: Create per-user hub data and connector directories without replacing data
+      ansible.builtin.file:
+        path: '{{ item }}'
+        state: directory
+        mode: '0700'
+      loop:
+        - '{{ beszel_data_dir }}'
+        - '{{ beszel_tunnel_dir }}'
+    - name: Write the public dashboard connector token for the current user only
+      ansible.builtin.copy:
+        dest: '{{ beszel_tunnel_dir }}/token'
+        content: '{{ beszel_tunnel_token }}'
+        mode: '0600'
+      when: beszel_tunnel_token | default('') | length > 0
+      no_log: true
+    - name: Detect a hub that has never started (no database yet)
+      ansible.builtin.stat:
+        path: '{{ beszel_data_dir }}/data.db'
+      register: hub_database
+    - name: Start pinned stock Compose service
+      ansible.builtin.command:
+        argv: "{{ beszel_compose + ['up', '-d', '--pull', 'missing', 'hub'] }}"
+      # A fresh hub creates the fleet login itself on first start, so no one
+      # has to create the account by hand. Existing data is never changed.
+      environment: >-
+        {{ beszel_environment | combine({
+             'BESZEL_BOOTSTRAP_EMAIL': beszel_fleet_identity,
+             'BESZEL_BOOTSTRAP_PASSWORD': beszel_fleet_password
+           } if (not hub_database.stat.exists
+                 and beszel_fleet_password | default('') | length > 0)
+           else {}) }}
+      no_log: true
+      register: hub_apply
+      changed_when: "'Started' in hub_apply.stderr or 'Created' in hub_apply.stderr or 'Recreated' in hub_apply.stderr"
+    - name: Start the public connector when its credential is present
+      ansible.builtin.command:
+        argv: "{{ beszel_compose + ['--profile', 'public-endpoint', 'up', '-d', '--pull', 'missing'] }}"
+      environment: '{{ beszel_environment }}'
+      when: beszel_tunnel_token | default('') | length > 0
+      register: tunnel_apply
+      changed_when: "'Started' in tunnel_apply.stderr or 'Created' in tunnel_apply.stderr or 'Recreated' in tunnel_apply.stderr"
+    - name: Independently verify the local hub health endpoint
+      ansible.builtin.uri:
+        url: http://127.0.0.1:8090/api/health
+        status_code: 200
+        return_content: false
+      retries: 10
+      delay: 2
+      register: hub_health
+      until: hub_health.status == 200

package/ansible/monitoring/lock.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.21.1",
+  "image": "henrygd/beszel:0.21.1@sha256:8514a69d9bbbcb74f371a3205561ee231fc0289739cea64e8131f341d695b770",
+  "agents": {
+    "amd64": "3b6ee592632ec03b9a43312e99a40203a7b3d83fe40dd0c25acda1eb915ea7c0",
+    "arm64": "a6ea544976b9a74398ac88d5da5bb96813d9a2e353a37bbfdb6a903fa8ba1838",
+    "darwin-arm64": "9246065f680cdb0af2885b7bf5876dc45b754019f2c90eb28550cf45db978eb8",
+    "darwin-amd64": "21f4a03fd90ae46869cfcbb69e21e8312f0f05deff49669d4602a3dee4866981"
+  },
+  "source": "https://github.com/henrygd/beszel/releases/tag/v0.21.1"
+}

package/ansible/net/remote-probe.sh

@@ -0,0 +1,13 @@
+# Read-only health probe that `dev-fleet net check` pipes to each host over SSH (`sh -s`).
+# Prints key=value lines; works on macOS and Linux (including WSL).
+if [ "$(uname)" = Darwin ]; then
+  echo "ncpu=$(sysctl -n hw.ncpu)"
+  echo "load=$(sysctl -n vm.loadavg | awk '{print $2}')"
+  echo "memfree=$(memory_pressure -Q 2>/dev/null | awk -F': ' '/percentage/{gsub("%","",$2); print $2}')"
+  sysctl -n vm.swapusage | awk '{t=$3; u=$6; gsub("M","",t); gsub("M","",u); if (t>0) print "swap=" int(u*100/t); else print "swap=0"}'
+else
+  echo "ncpu=$(nproc)"
+  echo "load=$(cut -d' ' -f1 /proc/loadavg)"
+  awk '/MemTotal/{t=$2} /MemAvailable/{a=$2} /SwapTotal/{st=$2} /SwapFree/{sf=$2} END{print "memfree=" int(a*100/t); if (st>0) print "swap=" int((st-sf)*100/st); else print "swap=0"}' /proc/meminfo
+fi
+echo "diskmb=$(df -Pk "$HOME" | awk 'NR==2{print int($4/1024)}')"

package/ansible/ubuntu/authorize-sudo.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+# Manager-led, explicitly approved initial privilege step. Run through a real
+# SSH terminal so sudo reads the operator's password itself; never capture it.
+set -eu
+umask 077
+case "$(uname -s)" in
+  Linux)
+    . /etc/os-release
+    [ "$ID" = ubuntu ] && [ "$VERSION_ID" = 26.04 ] || exit 1 ;;
+  Darwin)
+    [ "$(sw_vers -productVersion | cut -d. -f1)" -ge 14 ] || exit 1 ;;
+  *) exit 1 ;;
+esac
+user=$(id -un)
+case "$user" in root|''|*[!a-z0-9_-]*) exit 1;; esac
+command -v sudo >/dev/null 2>&1 || exit 1
+# The same operation lock used by remote bootstrap excludes another installer.
+root="$HOME/.local/share/personal/fleet"
+for path in "$HOME/.local" "$HOME/.local/share" "$HOME/.local/share/personal" "$root"; do
+  [ ! -L "$path" ] || exit 1
+done
+mkdir -p "$root"
+chmod 700 "$root"
+[ ! -L "$root/remote-operation.lock" ] || exit 1
+exec 9>"$root/remote-operation.lock"
+if command -v flock >/dev/null 2>&1; then
+  flock -n 9 || exit 1
+else
+  python3 -c 'import fcntl; fcntl.flock(9, fcntl.LOCK_EX | fcntl.LOCK_NB)' 9>&9 || exit 1
+fi
+sudo -v
+file=$(mktemp)
+trap 'rm -f "$file"' EXIT
+trap 'exit 1' HUP INT TERM
+printf '# Managed by personal Fleet: designated development user\n%s ALL=(ALL:ALL) NOPASSWD: ALL\n' "$user" >"$file"
+sudo -n visudo -cf "$file" >/dev/null
+# This dedicated path is owned by the same Workstation baseline. Preserve any
+# existing fragment for recovery before installing the validated declaration.
+target="/etc/sudoers.d/personal-fleet-$user"
+if sudo -n test -e "$target"; then
+  sudo -n test ! -L "$target" || exit 1
+  sudo -n grep -qxF '# Managed by personal Fleet: designated development user' "$target" || {
+    printf '%s\n' 'SUDOERS_OWNERSHIP_CONFLICT: preserve the existing fragment and review its source before migration.' >&2
+    exit 1
+  }
+  sudo -n cp -p -- "$target" "$target.before-fleet-enrollment"
+fi
+group=root
+[ "$(uname -s)" != Darwin ] || group=wheel
+sudo -n install -o root -g "$group" -m 0440 -- "$file" "$target"
+sudo -n true