@crvouga/dev-fleet 0.0.0-stage → 0.1.0

package/ansible/ubuntu/baseline.yml

@@ -0,0 +1,89 @@
+---
+- name: Apply reviewed Ubuntu development-server policy
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: true
+  vars_files:
+    - policy.json
+  pre_tasks:
+    - name: Require the supported common release and an explicit non-root user
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.distribution == 'Ubuntu'
+          - ansible_facts.distribution_version == release
+          - ansible_facts.architecture in ['x86_64', 'aarch64']
+          - development_user is match('^[a-z_][a-z0-9_-]{0,31}$')
+          - development_user != 'root'
+        fail_msg: Unsupported platform or user; no distribution upgrade is permitted.
+    - name: Read the designated existing account
+      ansible.builtin.getent:
+        database: passwd
+        key: '{{ development_user }}'
+    - name: Refuse a different user identity or home
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.getent_passwd[development_user][1] | int == development_uid | int
+          - ansible_facts.getent_passwd[development_user][4] == development_home
+    # Memory and disk safety must land even when the disk is nearly full.
+    - ansible.builtin.import_tasks: tasks/resources.yml
+    - name: Inspect capacity before package and service changes
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/python3
+          - '-c'
+          - |
+            import json, os
+            print(json.dumps([{"path": p, "freeMiB": (v.f_bavail * v.f_frsize) // (1024 * 1024), "freeInodes": v.f_favail} for p in ['/', '/var', os.environ['FLEET_HOME']] for v in [os.statvfs(p)]]))
+      environment:
+        FLEET_HOME: '{{ development_home }}'
+      changed_when: false
+      register: capacity
+    - name: Preserve management capacity instead of installing into an exhausted disk
+      ansible.builtin.assert:
+        that:
+          - item.freeMiB >= minimumFreeDiskMiB
+          - item.freeInodes >= minimumFreeInodes
+        fail_msg: RESOURCE_CAPACITY_REQUIRED; inspect disk space and inodes on the reported filesystem. Preserve developer work; no automatic cleanup or process killing.
+      loop: '{{ capacity.stdout | from_json }}'
+    - name: Inspect installed packages
+      ansible.builtin.package_facts:
+        manager: apt
+    - name: Preserve Docker installations owned by a different distribution
+      ansible.builtin.assert:
+        that: "'docker-ce' not in ansible_facts.packages and 'containerd.io' not in ansible_facts.packages"
+        fail_msg: DOCKER_OWNER_CONFLICT; migrate the existing Docker owner explicitly before applying the Ubuntu-native baseline.
+    - name: Inspect existing service ownership
+      ansible.builtin.service_facts:
+    - name: Wait for legitimate package transactions before inspecting dpkg
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/python3
+          - '-c'
+          - |
+            import fcntl
+            files = [open(path, 'a') for path in ['/var/lib/dpkg/lock-frontend', '/var/lib/dpkg/lock']]
+            for handle in files:
+                fcntl.lockf(handle, fcntl.LOCK_EX | fcntl.LOCK_NB)
+      register: apt_idle
+      changed_when: false
+      retries: 24
+      delay: 5
+      until: apt_idle.rc == 0
+    - name: Inspect package database consistency
+      ansible.builtin.command: dpkg --audit
+      changed_when: false
+      register: dpkg_audit
+    - name: Require package database recovery before modifying packages
+      ansible.builtin.assert:
+        that: dpkg_audit.stdout | trim == ''
+        fail_msg: APT_STATE_BROKEN; inspect dpkg --audit and use reviewed package recovery. Never remove package lock files.
+  tasks:
+    - ansible.builtin.import_tasks: tasks/packages.yml
+    - ansible.builtin.import_tasks: tasks/docker.yml
+    - ansible.builtin.import_tasks: tasks/services.yml
+    - ansible.builtin.import_tasks: tasks/power.yml
+    - ansible.builtin.import_tasks: tasks/user.yml
+    - ansible.builtin.import_tasks: tasks/ssh.yml
+    - ansible.builtin.import_tasks: tasks/credentials.yml
+      when: development_source is defined

package/ansible/ubuntu/disk-guard.py

@@ -0,0 +1,104 @@
+#!/usr/bin/python3
+"""Stop the user process group that is filling the disk before it runs out.
+
+Managed by personal fleet-sync (tasks/resources.yml) as
+personal-fleet-disk-guard.service. Every interval it measures free space on the
+watched filesystems and the bytes each leaf cgroup under user.slice wrote. When
+any watched filesystem is below the floor, it kills only the single cgroup that
+wrote the most during the last interval, and only if that is at least the write
+threshold. It never deletes files, never touches system services and never
+kills idle work. Free space must be recovered by a person.
+
+Usage: disk-guard.py --path / --path /home/me [--floor-mib N] [--write-mib N]
+                     [--interval S] [--cgroup-root DIR] [--dry-run]
+"""
+import argparse
+import json
+import os
+import sys
+import time
+from pathlib import Path
+
+MIB = 1024 * 1024
+
+
+def leaf_writes(root):
+    """Bytes written so far by every leaf cgroup below root, from io.stat."""
+    writes = {}
+    for current, dirs, files in os.walk(root):
+        if dirs or 'io.stat' not in files:
+            continue
+        try:
+            text = Path(current, 'io.stat').read_text()
+        except OSError:
+            continue
+        total = 0
+        for line in text.splitlines():
+            for field in line.split()[1:]:
+                key, _, value = field.partition('=')
+                if key == 'wbytes' and value.isdigit():
+                    total += int(value)
+        writes[current] = total
+    return writes
+
+
+def choose_victim(previous, current, low, threshold):
+    """The leaf that wrote the most since the previous sample, if it is a runaway."""
+    if not low:
+        return None
+    best, best_delta = None, 0
+    for path, total in current.items():
+        delta = total - previous.get(path, total)
+        if delta > best_delta:
+            best, best_delta = path, delta
+    if best is None or best_delta < threshold:
+        return None
+    return best, best_delta
+
+
+def free_bytes(path):
+    st = os.statvfs(path)
+    return st.f_bavail * st.f_frsize
+
+
+def log(**event):
+    print(json.dumps(event, sort_keys=True), flush=True)
+
+
+def main(argv):
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--path', action='append', required=True)
+    parser.add_argument('--floor-mib', type=int, default=3072)
+    parser.add_argument('--write-mib', type=int, default=32)
+    parser.add_argument('--interval', type=float, default=5.0)
+    parser.add_argument('--cgroup-root', default='/sys/fs/cgroup/user.slice')
+    parser.add_argument('--dry-run', action='store_true')
+    args = parser.parse_args(argv)
+    floor, threshold = args.floor_mib * MIB, args.write_mib * MIB
+    log(event='started', paths=args.path, floor_mib=args.floor_mib,
+        write_mib=args.write_mib, interval=args.interval, dry_run=args.dry_run)
+    previous = leaf_writes(args.cgroup_root)
+    while True:
+        time.sleep(args.interval)
+        try:
+            current = leaf_writes(args.cgroup_root)
+            free = {path: free_bytes(path) for path in args.path}
+            low = [path for path, value in free.items() if value < floor]
+            victim = choose_victim(previous, current, bool(low), threshold)
+            previous = current
+            if victim is None:
+                continue
+            path, delta = victim
+            event = dict(event='runaway_writer', cgroup=path,
+                         wrote_mib=delta // MIB, low=low,
+                         free_mib={p: v // MIB for p, v in free.items()})
+            if not args.dry_run:
+                Path(path, 'cgroup.kill').write_text('1\n')
+                event['killed'] = True
+            log(**event)
+        except OSError as exc:
+            log(event='check_failed', error=type(exc).__name__)
+
+
+if __name__ == '__main__':
+    main(sys.argv[1:])

package/ansible/ubuntu/policy.json

@@ -0,0 +1,43 @@
+{
+  "version": 1,
+  "release": "26.04",
+  "architectures": ["amd64", "arm64"],
+  "snapshot": "20261101T000000Z",
+  "packages": {
+    "sudo": "1.9.17p2-1ubuntu3.2",
+    "openssh-server": "1:10.2p1-2ubuntu3.8",
+    "dconf-cli": "0.49.0-4",
+    "docker.io": "29.1.3-0ubuntu4.1",
+    "docker-compose-v2": "2.40.3+ds1-0ubuntu1",
+    "docker-buildx": "0.30.1-0ubuntu1",
+    "build-essential": "12.12ubuntu2.26.04.2",
+    "ca-certificates": "20260816ubuntu0.26.04.2",
+    "curl": "8.18.0-1ubuntu2.8",
+    "git": "1:2.53.0-1ubuntu1.1",
+    "python3": "3.14.3-0ubuntu2",
+    "unzip": "6.0-29ubuntu1",
+    "xz-utils": "5.8.3-1ubuntu0.1"
+  },
+  "aptLockTimeoutSeconds": 120,
+  "minimumFreeDiskMiB": 4096,
+  "minimumFreeInodes": 10000,
+  "serviceStartLimitBurst": 5,
+  "serviceStartLimitIntervalSeconds": 300,
+  "alwaysOnServices": ["ssh", "tailscaled", "docker", "beszel-agent"],
+  "resourceSafety": {
+    "swapFileMiB": 8192,
+    "userMemoryMax": "90%",
+    "agentMemoryMax": "30%",
+    "agentSwapMax": "2G",
+    "journalMaxUse": "1G",
+    "journalKeepFree": "4G",
+    "tmpMaxSize": "25%",
+    "tmpAge": "2d",
+    "varTmpAge": "14d",
+    "diskGuardFloorMiB": 3072,
+    "diskGuardWriteMiB": 32,
+    "diskGuardIntervalSeconds": 5,
+    "dockerLogMaxSize": "50m",
+    "dockerLogMaxFiles": "3"
+  }
+}

package/ansible/ubuntu/recovery.yml

@@ -0,0 +1,15 @@
+---
+- name: Enable recovery for an already verified T3 desktop app
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Verify the desktop unit runs before adding any recovery trigger
+      ansible.builtin.command:
+        argv: [systemctl, --user, is-active, t3code-desktop.service]
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      changed_when: false
+    - ansible.builtin.import_tasks: tasks/recovery.yml

package/ansible/ubuntu/t3/policy.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 1,
+  "organization": "Personal developer fleet",
+  "limits": {
+    "updates": { "mode": "off", "allowNightly": true }
+  }
+}

package/ansible/ubuntu/t3-desktop.yml

@@ -0,0 +1,220 @@
+---
+# The worker's only T3 process: the pinned desktop app, which embeds the server
+# on 127.0.0.1:3773. GDM logs the designated user in automatically and the user
+# unit starts the app with the graphical session, so the UI is on screen and the
+# server is up after every boot. Starting or migrating is left to fleet-sync.
+#
+# The upstream .deb declares libxss1, which Ubuntu 26.04 no longer ships and the
+# binary does not link. Instead of patching the package or leaving apt with an
+# unmet dependency, the verified package payload is unpacked to its own path and
+# its real runtime libraries and bundled AppArmor profile are installed.
+- name: Install the pinned T3 Code desktop app and start it with the session
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  vars:
+    t3_desktop_dir: /opt/T3 Code (Nightly)
+    # The package's Depends without libxss1 (see above).
+    t3_desktop_libraries:
+      - libasound2t64
+      - libatspi2.0-0t64
+      - libgbm1
+      - libgtk-3-0t64
+      - libnotify4
+      - libnss3
+      - libsecret-1-0
+      - libuuid1
+      - libxtst6
+      - xdg-utils
+  tasks:
+    - name: Create the package cache
+      ansible.builtin.file:
+        path: /var/cache/personal-fleet
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+    - name: Download the pinned desktop package
+      ansible.builtin.get_url:
+        url: '{{ t3_desktop_url }}'
+        dest: '/var/cache/personal-fleet/{{ t3_desktop_name }}'
+        checksum: 'sha256:{{ t3_desktop_sha256 }}'
+        mode: '0644'
+        timeout: 300
+    - name: Install the desktop runtime libraries
+      ansible.builtin.apt:
+        name: '{{ t3_desktop_libraries }}'
+        state: present
+        lock_timeout: 120
+    - name: Read the unpacked app version
+      ansible.builtin.command:
+        argv: [cat, '{{ t3_desktop_dir }}/.personal-fleet-version']
+      register: t3_desktop_installed
+      changed_when: false
+      failed_when: false
+    - name: Unpack the pinned app when its version differs
+      when: t3_desktop_installed.stdout | default('') != t3_desktop_name
+      block:
+        - name: Clear the staging directory
+          ansible.builtin.file:
+            path: /opt/.t3code-staging
+            state: absent
+        - name: Unpack the verified package payload
+          ansible.builtin.command:
+            argv:
+              - dpkg-deb
+              - -x
+              - '/var/cache/personal-fleet/{{ t3_desktop_name }}'
+              - /opt/.t3code-staging
+          changed_when: true
+        - name: Record the unpacked package
+          ansible.builtin.copy:
+            dest: '/opt/.t3code-staging{{ t3_desktop_dir }}/.personal-fleet-version'
+            content: '{{ t3_desktop_name }}'
+            mode: '0644'
+        - name: Remove the copy kept from the previous update
+          ansible.builtin.file:
+            path: '{{ t3_desktop_dir }}.previous'
+            state: absent
+        - name: Inspect the current app directory
+          ansible.builtin.stat:
+            path: '{{ t3_desktop_dir }}'
+          register: t3_desktop_current
+        - name: Keep the current app until the next update (a running app keeps its files)
+          ansible.builtin.command:
+            argv:
+              [mv, -T, '{{ t3_desktop_dir }}', '{{ t3_desktop_dir }}.previous']
+          when: t3_desktop_current.stat.exists
+          changed_when: true
+        - name: Move the pinned app into place
+          ansible.builtin.command:
+            argv:
+              - mv
+              - -T
+              - '/opt/.t3code-staging{{ t3_desktop_dir }}'
+              - '{{ t3_desktop_dir }}'
+          changed_when: true
+        - name: Add the launcher entry and icon
+          ansible.builtin.copy:
+            src: '/opt/.t3code-staging/usr/share/{{ item }}'
+            dest: '/usr/share/{{ item }}'
+            remote_src: true
+            mode: '0644'
+          loop:
+            - applications/t3code.desktop
+            - icons/hicolor/512x512/apps/t3code.png
+        - name: Remove the staging directory
+          ansible.builtin.file:
+            path: /opt/.t3code-staging
+            state: absent
+    - name: Install the AppArmor profile the package ships
+      ansible.builtin.copy:
+        src: '{{ t3_desktop_dir }}/resources/apparmor-profile'
+        dest: /etc/apparmor.d/t3code
+        remote_src: true
+        mode: '0644'
+      register: t3_desktop_apparmor
+    - name: Load the AppArmor profile so the app sandbox can start
+      ansible.builtin.command:
+        argv:
+          [
+            apparmor_parser,
+            --replace,
+            --write-cache,
+            --skip-read-cache,
+            /etc/apparmor.d/t3code,
+          ]
+      when: t3_desktop_apparmor.changed
+      changed_when: true
+    - name: Inspect the GDM configuration
+      ansible.builtin.stat:
+        path: /etc/gdm3/custom.conf
+      register: gdm_config
+    - name: Log the designated user in automatically
+      ansible.builtin.lineinfile:
+        path: /etc/gdm3/custom.conf
+        regexp: '^#?\s*{{ item.key }}\s*='
+        line: '{{ item.key }} = {{ item.value }}'
+        insertafter: '^\[daemon\]'
+      loop:
+        - { key: AutomaticLoginEnable, value: 'true' }
+        - { key: AutomaticLogin, value: '{{ development_user }}' }
+      when: gdm_config.stat.exists
+    - name: Create the user unit directory
+      ansible.builtin.file:
+        path: '{{ development_home }}/.config/systemd/user'
+        state: directory
+        owner: '{{ development_user }}'
+        mode: '0700'
+    - name: Declare the desktop app as a session service
+      ansible.builtin.copy:
+        dest: '{{ development_home }}/.config/systemd/user/t3code-desktop.service'
+        owner: '{{ development_user }}'
+        mode: '0600'
+        content: |
+          # Managed by personal fleet-sync: ansible/ubuntu/t3-desktop.yml
+          [Unit]
+          Description=T3 Code desktop (UI and server)
+          PartOf=graphical-session.target
+          After=graphical-session.target
+          StartLimitIntervalSec=300
+          StartLimitBurst=5
+          [Service]
+          Type=simple
+          WorkingDirectory=%h
+          Environment=T3CODE_HOME=%h/.t3
+          # /tmp is RAM with a per-user quota that agent and build caches
+          # exhaust; agents use disk-backed /var/tmp (aged by tasks/resources.yml).
+          Environment=TMPDIR=/var/tmp
+          # Native Wayland hangs before the first window on Asahi (16K pages);
+          # XWayland works on every GNOME worker, so use it everywhere.
+          ExecStart="{{ t3_desktop_dir }}/t3code" --ozone-platform=x11
+          KillMode=mixed
+          Restart=always
+          RestartSec=5
+          CPUWeight=1000
+          IOWeight=1000
+          MemoryLow=1536M
+          OOMScoreAdjust=100
+          ManagedOOMPreference=avoid
+          [Install]
+          WantedBy=graphical-session.target
+    # Repoint recovery now: a timer still running an older revision's script
+    # would restart the headless server right after its approved migration.
+    - ansible.builtin.import_tasks: tasks/recovery.yml
+    - name: Enable the desktop app for every graphical login
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-desktop.service
+        daemon_reload: true
+        enabled: true
+    # One T3 process per worker: the desktop app. The former headless server
+    # (`t3 service install`) is retired; absent on machines that never had it.
+    - name: Retire the former headless T3 server
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code.service
+        state: stopped
+        enabled: false
+      failed_when: false
+    # Starting needs the auto-login graphical session, which a machine has only
+    # after its first reboot; the running state is measured after this play.
+    - name: Start the desktop app without restarting a running one
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-desktop.service
+        state: started
+      failed_when: false

package/ansible/ubuntu/t3-health.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+# Keep the worker T3 desktop app (UI and server) up and responsive. Run every minute by
+# personal-worker-recovery.timer (managed by fleet-sync, tasks/recovery.yml).
+# Stopped or failed: start it. Running but its local API has not answered for
+# three checks in a row: restart it, since a hung server serves no turns.
+set -u
+url=http://127.0.0.1:3773/.well-known/t3/environment
+state="${XDG_RUNTIME_DIR:?}/personal-t3-health-failures"
+limit=3
+
+# The former headless server still runs until its approved migration; never
+# start a second T3 next to it.
+if systemctl --user is-active --quiet t3code.service; then
+  echo "Headless T3 still runs; desktop migration pending."
+  exit 0
+fi
+if ! systemctl --user is-active --quiet t3code-desktop.service; then
+  rm -f "$state"
+  echo "T3 is not running; starting it."
+  exec systemctl --user start t3code-desktop.service
+fi
+if curl --fail --silent --max-time 10 --output /dev/null "$url"; then
+  rm -f "$state"
+  exit 0
+fi
+failures=$(($(cat "$state" 2>/dev/null || echo 0) + 1))
+echo "$failures" > "$state"
+echo "T3 local API did not answer ($failures/$limit)."
+if [ "$failures" -ge "$limit" ]; then
+  rm -f "$state"
+  echo "T3 is unresponsive; restarting it."
+  exec systemctl --user restart t3code-desktop.service
+fi

package/ansible/ubuntu/t3-policy.yml

@@ -0,0 +1,76 @@
+---
+- name: Stage the native T3 policy and make the running app load it
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Inspect existing administrator policy
+      ansible.builtin.stat:
+        path: /etc/t3code/policy.json
+      register: policy_file
+    - name: Inspect Fleet ownership marker
+      ansible.builtin.stat:
+        path: /etc/t3code/.personal-fleet-policy
+      register: policy_owner
+    - name: Refuse to overwrite an unrelated administrator policy
+      ansible.builtin.assert:
+        that: not policy_file.stat.exists or policy_owner.stat.exists
+        fail_msg: T3_POLICY_OWNER_CONFLICT; review and merge the existing administrator policy in Git before adoption.
+    - name: Create administrator-owned policy directory
+      ansible.builtin.file:
+        path: /etc/t3code
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+    - name: Record policy ownership before resumable installation
+      ansible.builtin.copy:
+        dest: /etc/t3code/.personal-fleet-policy
+        content: "ansible/ubuntu/t3/policy.json\n"
+        owner: root
+        group: root
+        mode: '0644'
+    - name: Stage validated policy with backup
+      ansible.builtin.copy:
+        content: "{{ t3_policy_document | default(lookup('ansible.builtin.file', 't3/policy.json') | from_json) | to_nice_json }}"
+        validate: '{{ t3_executable | quote }} policy check %s'
+        dest: /etc/t3code/policy.json
+        owner: root
+        group: root
+        mode: '0644'
+        backup: true
+    # T3 reads its policy once, at startup. A running app that has not loaded
+    # the staged policy is restarted (this ends its running turns) so every
+    # node offers the same providers after every sync.
+    - name: Check whether the desktop app is running
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.command:
+        argv: [systemctl, --user, is-active, --quiet, t3code-desktop.service]
+      register: t3_desktop_active
+      changed_when: false
+      failed_when: false
+    - name: Ask the running T3 which policy it loaded
+      become: true
+      become_user: '{{ development_user }}'
+      ansible.builtin.command:
+        argv: ['{{ t3_executable }}', policy, show]
+      register: t3_policy_loaded
+      changed_when: false
+      failed_when: false
+      when: t3_desktop_active.rc == 0
+    - name: Restart T3 so it loads the staged policy
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-desktop.service
+        state: restarted
+      when:
+        - t3_desktop_active.rc == 0
+        - t3_policy_loaded.stdout is not search('loaded this policy\.\s*$')

package/ansible/ubuntu/t3-route.yml

@@ -0,0 +1,28 @@
+---
+# The worker's T3 is reached over the tailnet only: Tailscale Serve terminates
+# HTTPS on port 443 and proxies to the loopback T3 server. Never Funnel. A
+# port 443 that already has any owner is left alone (reported, never reset).
+- name: Serve the worker T3 privately over the tailnet
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Require the declared loopback target
+      ansible.builtin.assert:
+        that: "t3_route_target is match('^http://127\\.0\\.0\\.1:[0-9]+$')"
+
+    - name: Read this node's Serve configuration
+      ansible.builtin.command:
+        argv: [tailscale, serve, status, --json]
+      register: t3_serve_status
+      changed_when: false
+    - name: Publish T3 on tailnet HTTPS port 443
+      ansible.builtin.command:
+        argv: [tailscale, serve, --bg, --https=443, '{{ t3_route_target }}']
+      vars:
+        serve: "{{ t3_serve_status.stdout | default('{}', true) | from_json }}"
+      when:
+        - "'443' not in (serve.TCP | default({}))"
+        - "(serve.Web | default({})) | select('search', ':443$') | list | length == 0"
+      changed_when: true