@crvouga/dev-fleet 0.0.0-stage → 0.1.0

package/ansible/ubuntu/tailscale.yml

@@ -0,0 +1,75 @@
+---
+- name: Converge native Tailscale without replacing its device identity
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: true
+  tasks:
+    - name: Require supported Ubuntu
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.distribution == 'Ubuntu'
+          - ansible_facts.distribution_version == '26.04'
+    - name: Inspect installed packages before possible network interruption
+      ansible.builtin.package_facts:
+        manager: apt
+    - name: Require maintenance for an installed version change
+      ansible.builtin.assert:
+        that: "'tailscale' not in ansible_facts.packages or ansible_facts.packages.tailscale[0].version == '1.104.5'"
+        fail_msg: TAILSCALE_UPGRADE_PENDING; upgrading an active VPN can disconnect SSH. Review an explicit maintenance operation.
+    - name: Inspect existing package-source ownership before writing
+      ansible.builtin.find:
+        paths: /etc/apt/sources.list.d
+        patterns: ['*.list', '*.sources']
+        contains: '.*pkgs.tailscale.com.*'
+        read_whole_file: true
+      register: existing_sources
+    - name: Refuse duplicate or custom sources instead of breaking APT
+      ansible.builtin.assert:
+        that:
+          - existing_sources.matched <= 1
+          - existing_sources.matched == 0 or existing_sources.files[0].path == '/etc/apt/sources.list.d/tailscale.list'
+        fail_msg: TAILSCALE_SOURCE_OWNER_CONFLICT; review the existing signed source and its migration before creating another repository entry.
+    - name: Install pinned upstream signing key
+      ansible.builtin.get_url:
+        url: https://pkgs.tailscale.com/stable/ubuntu/resolute.noarmor.gpg
+        dest: /usr/share/keyrings/tailscale-archive-keyring.gpg
+        checksum: sha256:3e03dacf222698c60b8e2f990b809ca1b3e104de127767864284e6c228f1fb39
+        owner: root
+        group: root
+        mode: '0644'
+        timeout: 30
+    - name: Declare the signed upstream package source
+      ansible.builtin.apt_repository:
+        repo: deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu resolute main
+        filename: tailscale
+        state: present
+        update_cache: false
+      register: tailscale_source
+    - name: Install the approved version only when absent
+      ansible.builtin.apt:
+        name: tailscale=1.104.5
+        state: present
+        update_cache: true
+        cache_valid_time: 0
+        lock_timeout: 120
+        allow_downgrade: false
+        allow_unauthenticated: false
+      when: "'tailscale' not in ansible_facts.packages"
+    - name: Enable and start the native daemon, preserving existing identity
+      ansible.builtin.systemd_service:
+        name: tailscaled.service
+        enabled: true
+        state: started
+    - name: Inspect native authentication without prompting or opening a browser
+      ansible.builtin.command:
+        argv: [tailscale, status, '--json']
+      changed_when: false
+      failed_when: false
+      register: tailscale_status
+      no_log: true
+    - name: Require genuine device authentication before claiming connectivity
+      ansible.builtin.assert:
+        that: (tailscale_status.stdout | from_json).BackendState == 'Running'
+        fail_msg: TAILSCALE_LOGIN_REQUIRED; authorize this device through its native login. Existing state is never copied or reset.
+      no_log: true

package/ansible/ubuntu/tasks/credentials.yml

@@ -0,0 +1,47 @@
+---
+- name: Create persistent worker credential renewal units
+  ansible.builtin.file:
+    path: '{{ development_home }}/.config/systemd/user'
+    state: directory
+    owner: '{{ development_user }}'
+    mode: '0700'
+- name: Declare native self-token renewal without copying credentials
+  ansible.builtin.copy:
+    dest: '{{ development_home }}/.config/systemd/user/personal-worker-auth.service'
+    owner: '{{ development_user }}'
+    mode: '0600'
+    content: |
+      [Unit]
+      Description=Renew this worker's own Vault authorization
+      [Service]
+      Type=oneshot
+      WorkingDirectory={{ development_source }}
+      ExecStart={{ development_home }}/.local/bin/mise exec -- bun bootstrap/worker-auth.ts
+      Environment="PATH={{ development_home }}/.local/share/mise/shims:{{ development_home }}/.local/bin:/usr/local/bin:/usr/bin:/bin"
+      UMask=0077
+      TimeoutStartSec=45
+- name: Declare bounded persistent renewal schedule
+  ansible.builtin.copy:
+    dest: '{{ development_home }}/.config/systemd/user/personal-worker-auth.timer'
+    owner: '{{ development_user }}'
+    mode: '0600'
+    content: |
+      [Unit]
+      Description=Keep enrolled worker Vault authorization renewed
+      [Timer]
+      OnBootSec=2min
+      OnUnitActiveSec=10min
+      Persistent=true
+      [Install]
+      WantedBy=timers.target
+- name: Enable this user's credential renewal timer
+  become: true
+  become_user: '{{ development_user }}'
+  environment:
+    XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+  ansible.builtin.systemd_service:
+    scope: user
+    name: personal-worker-auth.timer
+    daemon_reload: true
+    enabled: true
+    state: started

package/ansible/ubuntu/tasks/docker.yml

@@ -0,0 +1,31 @@
+---
+- name: Rotate container logs by default (new containers, after the next Docker restart)
+  ansible.builtin.copy:
+    dest: /etc/docker/daemon.json
+    force: false
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      {
+        "log-driver": "json-file",
+        "log-opts": { "max-size": "{{ resourceSafety.dockerLogMaxSize }}", "max-file": "{{ resourceSafety.dockerLogMaxFiles }}" }
+      }
+    validate: dockerd --validate --config-file %s
+- name: Start the native Docker engine without restarting existing workloads
+  ansible.builtin.systemd_service:
+    name: docker.service
+    enabled: true
+    state: started
+- name: Grant the designated developer access to the local Docker engine
+  ansible.builtin.user:
+    name: '{{ development_user }}'
+    groups: docker
+    append: true
+- name: Verify native Docker Compose and Buildx installation
+  ansible.builtin.command:
+    argv: '{{ item }}'
+  loop:
+    - [docker, compose, version]
+    - [docker, buildx, version]
+  changed_when: false

package/ansible/ubuntu/tasks/packages.yml

@@ -0,0 +1,56 @@
+---
+- name: Create owned APT configuration directory
+  ansible.builtin.file:
+    path: /etc/personal-fleet
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+- name: Declare snapshot sources used only for managed package transactions
+  ansible.builtin.copy:
+    dest: /etc/personal-fleet/ubuntu.sources
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
+    content: |
+      Types: deb
+      URIs: https://snapshot.ubuntu.com/ubuntu/{{ snapshot }}/
+      Suites: resolute resolute-updates resolute-security
+      Components: main universe restricted multiverse
+      Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+  register: snapshot_sources
+- name: Isolate snapshot selection from unrelated APT operations
+  ansible.builtin.copy:
+    dest: /etc/personal-fleet/apt.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      Dir::Etc::sourcelist "/etc/personal-fleet/ubuntu.sources";
+      Dir::Etc::sourceparts "-";
+      DPkg::Lock::Timeout "{{ aptLockTimeoutSeconds }}";
+- name: Inspect immutable snapshot package index
+  ansible.builtin.stat:
+    path: '/var/lib/apt/lists/snapshot.ubuntu.com_ubuntu_{{ snapshot }}_dists_resolute_InRelease'
+  register: snapshot_index
+- name: Fetch signed snapshot indexes after source change or interrupted setup
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 0
+    lock_timeout: '{{ aptLockTimeoutSeconds }}'
+  environment:
+    APT_CONFIG: /etc/personal-fleet/apt.conf
+  when: snapshot_sources.changed or not snapshot_index.stat.exists
+- name: Install exact managed packages without downgrading or restarting services
+  ansible.builtin.apt:
+    name: '{{ item.key }}={{ item.value }}'
+    state: present
+    lock_timeout: '{{ aptLockTimeoutSeconds }}'
+    allow_downgrade: false
+    allow_unauthenticated: false
+    fail_on_autoremove: true
+    policy_rc_d: 101
+  environment:
+    APT_CONFIG: /etc/personal-fleet/apt.conf
+  loop: '{{ packages | dict2items }}'

package/ansible/ubuntu/tasks/power.yml

@@ -0,0 +1,51 @@
+---
+- name: Ensure systemd policy directories exist
+  ansible.builtin.file:
+    path: '{{ item }}'
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  loop:
+    - /etc/systemd/logind.conf.d
+    - /etc/systemd/sleep.conf.d
+- name: Declare idle and lid policy without restarting login sessions
+  ansible.builtin.copy:
+    dest: /etc/systemd/logind.conf.d/60-personal-fleet.conf
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
+    content: |
+      # Managed by personal fleet-sync. Effective after logind reload/reboot.
+      [Login]
+      HandleLidSwitch=ignore
+      HandleLidSwitchExternalPower=ignore
+      HandleLidSwitchDocked=ignore
+      IdleAction=ignore
+      KillUserProcesses=no
+      StopIdleSessionSec=infinity
+- name: Declare supported sleep policy
+  ansible.builtin.copy:
+    dest: /etc/systemd/sleep.conf.d/60-personal-fleet.conf
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
+    content: |
+      [Sleep]
+      AllowSuspend=no
+      AllowHibernation=no
+      AllowSuspendThenHibernate=no
+      AllowHybridSleep=no
+- name: Mask sleep transitions without stopping running user sessions
+  ansible.builtin.systemd_service:
+    name: '{{ item }}'
+    masked: true
+    daemon_reload: true
+  loop:
+    - sleep.target
+    - suspend.target
+    - hibernate.target
+    - hybrid-sleep.target
+    - suspend-then-hibernate.target

package/ansible/ubuntu/tasks/recovery.yml

@@ -0,0 +1,39 @@
+---
+- name: Declare bounded recovery of the worker T3 desktop app
+  ansible.builtin.copy:
+    dest: '{{ development_home }}/.config/systemd/user/personal-worker-recovery.service'
+    owner: '{{ development_user }}'
+    mode: '0600'
+    content: |
+      # Managed by personal fleet-sync: ansible/ubuntu/t3-health.sh
+      [Unit]
+      Description=Keep the worker T3 desktop app running and responsive
+      [Service]
+      Type=oneshot
+      ExecStart=/bin/sh {{ development_source }}/ansible/ubuntu/t3-health.sh
+      TimeoutStartSec=90
+- name: Declare persistent service recovery checks
+  ansible.builtin.copy:
+    dest: '{{ development_home }}/.config/systemd/user/personal-worker-recovery.timer'
+    owner: '{{ development_user }}'
+    mode: '0600'
+    content: |
+      [Unit]
+      Description=Check the worker T3 desktop app every minute
+      [Timer]
+      OnBootSec=1min
+      OnUnitActiveSec=1min
+      Persistent=true
+      [Install]
+      WantedBy=timers.target
+- name: Enable bounded T3 recovery without restarting active sessions
+  become: true
+  become_user: '{{ development_user }}'
+  environment:
+    XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+  ansible.builtin.systemd_service:
+    scope: user
+    name: personal-worker-recovery.timer
+    daemon_reload: true
+    enabled: true
+    state: started

package/ansible/ubuntu/tasks/resources.yml

@@ -0,0 +1,252 @@
+---
+# Memory and disk safety: a runaway workload is stopped on its own before the
+# machine, SSH, Tailscale or the T3 server run out of memory or disk. These
+# tasks run before the capacity preflight because they matter most when a disk
+# is nearly full; they only write small files and never delete user data.
+- name: Inspect active swap
+  ansible.builtin.command:
+    argv: [swapon, --show=NAME, --noheadings]
+  changed_when: false
+  check_mode: false
+  register: active_swap
+- name: Measure root free space before creating swap
+  ansible.builtin.command:
+    argv: [df, --output=avail, -BM, /]
+  changed_when: false
+  check_mode: false
+  register: swap_capacity
+  when: active_swap.stdout | trim == ''
+- name: Refuse to create swap on a nearly full disk
+  ansible.builtin.assert:
+    that: (swap_capacity.stdout_lines | last | trim | regex_replace('M$', '') | int) >= resourceSafety.swapFileMiB + minimumFreeDiskMiB
+    fail_msg: SWAP_CAPACITY_REQUIRED; free disk space so a swap file can be created. No swap is active.
+  when: active_swap.stdout | trim == ''
+- name: Create a swap file when the node has no swap
+  ansible.builtin.command:
+    argv: [fallocate, -l, '{{ resourceSafety.swapFileMiB }}M', /swap.fleet]
+    creates: /swap.fleet
+  when: active_swap.stdout | trim == ''
+- name: Restrict the fleet swap file
+  ansible.builtin.file:
+    path: /swap.fleet
+    owner: root
+    group: root
+    mode: '0600'
+  when: active_swap.stdout | trim == ''
+- name: Format the fleet swap file
+  ansible.builtin.command:
+    argv: [mkswap, /swap.fleet]
+  when: active_swap.stdout | trim == ''
+- name: Activate the fleet swap file
+  ansible.builtin.command:
+    argv: [swapon, /swap.fleet]
+  when: active_swap.stdout | trim == ''
+- name: Activate the fleet swap file at boot
+  ansible.builtin.lineinfile:
+    path: /etc/fstab
+    line: /swap.fleet none swap sw 0 0
+  when: active_swap.stdout | trim == ''
+
+- name: Install the systemd userspace OOM killer
+  ansible.builtin.apt:
+    name: systemd-oomd
+    state: present
+- name: Create memory and disk policy directories
+  ansible.builtin.file:
+    path: '{{ item }}'
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  loop:
+    - /etc/systemd/oomd.conf.d
+    - /etc/systemd/system/-.slice.d
+    - /etc/systemd/system/user.slice.d
+    - /etc/systemd/user/t3code-.scope.d
+    - /etc/systemd/journald.conf.d
+    - /etc/systemd/system/systemd-tmpfiles-clean.timer.d
+    - /etc/tmpfiles.d
+- name: Declare systemd-oomd limits
+  ansible.builtin.copy:
+    dest: /etc/systemd/oomd.conf.d/60-personal-fleet.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      # Managed by personal fleet-sync: kill one cgroup before swap or memory pressure stalls the node.
+      [OOM]
+      SwapUsedLimit=90%
+      DefaultMemoryPressureLimit=60%
+      DefaultMemoryPressureDurationSec=20s
+  register: oomd_config
+- name: Declare memory reserve and OOM policy for system and user slices
+  ansible.builtin.copy:
+    dest: '{{ item.dest }}'
+    owner: root
+    group: root
+    mode: '0644'
+    content: '{{ item.content }}'
+  loop:
+    - dest: /etc/systemd/system/-.slice.d/60-personal-fleet.conf
+      content: |
+        # Managed by personal fleet-sync: when swap is exhausted, oomd kills the largest swap user.
+        [Slice]
+        ManagedOOMSwap=kill
+    - dest: /etc/systemd/system/user.slice.d/60-personal-fleet.conf
+      content: |
+        # Managed by personal fleet-sync: user workloads can never take the memory SSH, Tailscale and system services need.
+        [Slice]
+        MemoryMax={{ resourceSafety.userMemoryMax }}
+  loop_control:
+    label: '{{ item.dest }}'
+  register: slice_policy
+- name: Bound each T3 agent so a runaway loses one process, not the session or the node
+  ansible.builtin.copy:
+    dest: /etc/systemd/user/t3code-.scope.d/60-personal-fleet.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      # Managed by personal fleet-sync. Applies to every t3code-*.scope T3 starts for an agent.
+      # OOMPolicy=continue: the kernel kills the largest process in the agent; the agent itself keeps running.
+      [Scope]
+      MemoryMax={{ resourceSafety.agentMemoryMax }}
+      MemorySwapMax={{ resourceSafety.agentSwapMax }}
+      OOMPolicy=continue
+  register: agent_policy
+- name: Apply slice limits without restarting services
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: slice_policy.changed
+- name: Load the agent limits into the running user manager for new agents
+  become: true
+  become_user: '{{ development_user }}'
+  environment:
+    XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+  ansible.builtin.systemd_service:
+    scope: user
+    daemon_reload: true
+  when: agent_policy.changed
+  failed_when: false
+- name: Run systemd-oomd
+  ansible.builtin.systemd_service:
+    name: systemd-oomd.service
+    enabled: true
+    state: '{{ "restarted" if oomd_config.changed else "started" }}'
+
+- name: Cap the system journal
+  ansible.builtin.copy:
+    dest: /etc/systemd/journald.conf.d/60-personal-fleet.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      # Managed by personal fleet-sync.
+      [Journal]
+      SystemMaxUse={{ resourceSafety.journalMaxUse }}
+      SystemKeepFree={{ resourceSafety.journalKeepFree }}
+      RuntimeMaxUse=256M
+  register: journal_policy
+- name: Apply the journal cap
+  ansible.builtin.systemd_service:
+    name: systemd-journald.service
+    state: restarted
+  when: journal_policy.changed
+- name: Age out abandoned temporary files
+  ansible.builtin.copy:
+    dest: /etc/tmpfiles.d/tmp.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      # Managed by personal fleet-sync; overrides /usr/lib/tmpfiles.d/tmp.conf.
+      q /tmp 1777 root root {{ resourceSafety.tmpAge }}
+      q /var/tmp 1777 root root {{ resourceSafety.varTmpAge }}
+- name: Clean temporary files hourly instead of daily
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/systemd-tmpfiles-clean.timer.d/60-personal-fleet.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      # Managed by personal fleet-sync.
+      [Timer]
+      OnUnitActiveSec=1h
+  register: tmpfiles_timer
+- name: Inspect the RAM-backed /tmp unit
+  ansible.builtin.stat:
+    path: /usr/lib/systemd/system/tmp.mount
+  register: tmp_mount
+- name: Create the /tmp mount policy directory
+  ansible.builtin.file:
+    path: /etc/systemd/system/tmp.mount.d
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  when: tmp_mount.stat.exists
+- name: Bound RAM-backed /tmp (effective after the next reboot)
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/tmp.mount.d/60-personal-fleet.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      # Managed by personal fleet-sync: /tmp is RAM; keep it from taking half of memory.
+      [Mount]
+      Options=mode=1777,strictatime,nosuid,nodev,size={{ resourceSafety.tmpMaxSize }},nr_inodes=1m,x-systemd.graceful-option=usrquota
+  when: tmp_mount.stat.exists
+  register: tmp_policy
+- name: Reload the cleanup timer and /tmp definitions
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: tmpfiles_timer.changed or tmp_policy.changed
+
+- name: Read the tracked disk guard
+  ansible.builtin.stat:
+    path: '{{ development_source }}/ansible/ubuntu/disk-guard.py'
+    checksum_algorithm: sha256
+  register: disk_guard_source
+  when: development_source is defined
+- name: Declare the disk guard service
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/personal-fleet-disk-guard.service
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      # Managed by personal fleet-sync: ansible/ubuntu/disk-guard.py
+      # Source sha256 {{ disk_guard_source.stat.checksum }}
+      [Unit]
+      Description=Personal Fleet disk guard (stops a runaway user writer before the disk fills)
+      StartLimitIntervalSec=0
+      [Service]
+      Type=simple
+      ExecStart=/usr/bin/python3 -I -B {{ disk_guard_source.stat.path }} --path / --path {{ development_home }} --floor-mib {{ resourceSafety.diskGuardFloorMiB }} --write-mib {{ resourceSafety.diskGuardWriteMiB }} --interval {{ resourceSafety.diskGuardIntervalSeconds }}
+      Restart=always
+      RestartSec=5
+      OOMScoreAdjust=-1000
+      MemoryMax=64M
+      MemorySwapMax=0
+      CPUQuota=10%
+      TasksMax=4
+      NoNewPrivileges=true
+      PrivateTmp=true
+      PrivateNetwork=true
+      ProtectSystem=strict
+      ProtectHome=read-only
+      ReadWritePaths=/sys/fs/cgroup
+      ProtectKernelModules=true
+      LogRateLimitIntervalSec=60
+      LogRateLimitBurst=20
+      [Install]
+      WantedBy=multi-user.target
+  when: development_source is defined and disk_guard_source.stat.exists
+  register: disk_guard_unit
+- name: Run the disk guard
+  ansible.builtin.systemd_service:
+    name: personal-fleet-disk-guard.service
+    daemon_reload: '{{ disk_guard_unit.changed }}'
+    enabled: true
+    state: '{{ "restarted" if disk_guard_unit.changed else "started" }}'
+  when: development_source is defined and disk_guard_source.stat.exists

package/ansible/ubuntu/tasks/services.yml

@@ -0,0 +1,31 @@
+---
+# Always-on recovery for the system services every worker depends on. Drop-ins
+# change restart policy only; running services are never restarted here.
+- name: Create recovery drop-in directories for required system services
+  ansible.builtin.file:
+    path: '/etc/systemd/system/{{ item }}.service.d'
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  loop: '{{ alwaysOnServices }}'
+- name: Declare unlimited automatic restart for required system services
+  ansible.builtin.copy:
+    dest: '/etc/systemd/system/{{ item }}.service.d/60-personal-fleet.conf'
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
+    content: |
+      # Managed by personal fleet-sync: keep this worker service always on.
+      [Unit]
+      StartLimitIntervalSec=0
+      [Service]
+      Restart=always
+      RestartSec=5
+  loop: '{{ alwaysOnServices }}'
+  register: recovery_dropins
+- name: Reload unit definitions without restarting running services
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: recovery_dropins.changed

package/ansible/ubuntu/tasks/ssh.yml

@@ -0,0 +1,71 @@
+---
+- name: Inspect effective SSH configuration before changes
+  ansible.builtin.command: /usr/sbin/sshd -T
+  changed_when: false
+  register: effective_ssh
+- name: Inspect any existing managed SSH fragment
+  ansible.builtin.stat:
+    path: /etc/ssh/sshd_config.d/60-personal-fleet.conf
+  register: ssh_owned_file
+- name: Read previous fragment for validation rollback
+  ansible.builtin.slurp:
+    src: /etc/ssh/sshd_config.d/60-personal-fleet.conf
+  when: ssh_owned_file.stat.exists
+  register: ssh_previous
+  no_log: true
+- name: Refuse to overwrite unmanaged SSH configuration
+  ansible.builtin.assert:
+    that:
+      - not ssh_owned_file.stat.exists or (ssh_previous.content | b64decode).startswith('# Managed by personal Fleet')
+    fail_msg: SSH_UNMANAGED_CONFIG_CONFLICT; review the existing fragment before adoption.
+- name: Stage and validate forwarding policy while preserving listeners and authentication
+  block:
+    - name: Write forwarding-only owned fragment
+      ansible.builtin.copy:
+        dest: /etc/ssh/sshd_config.d/60-personal-fleet.conf
+        owner: root
+        group: root
+        mode: '0644'
+        backup: true
+        content: |
+          # Managed by personal Fleet; listeners and authentication remain explicit policy.
+          AllowTcpForwarding yes
+          ClientAliveInterval 30
+          ClientAliveCountMax 3
+      register: ssh_fragment
+    - name: Validate complete SSH configuration
+      ansible.builtin.command: /usr/sbin/sshd -t
+      changed_when: false
+  rescue:
+    - name: Restore previous fragment after validation failure
+      ansible.builtin.copy:
+        content: '{{ ssh_previous.content | b64decode }}'
+        dest: /etc/ssh/sshd_config.d/60-personal-fleet.conf
+        owner: root
+        group: root
+        mode: '0644'
+      when: ssh_owned_file.stat.exists
+      no_log: true
+    - name: Remove rejected new fragment
+      ansible.builtin.file:
+        path: /etc/ssh/sshd_config.d/60-personal-fleet.conf
+        state: absent
+      when: not ssh_owned_file.stat.exists
+    - name: Report validation failure without reloading sshd
+      ansible.builtin.fail:
+        msg: SSH_CONFIG_REJECTED; previous configuration restored, active service untouched.
+- name: Enable existing SSH service at boot
+  ansible.builtin.systemd_service:
+    name: ssh.service
+    enabled: true
+    state: started
+- name: Reload validated forwarding policy without terminating sessions
+  ansible.builtin.systemd_service:
+    name: ssh.service
+    state: reloaded
+  when: ssh_fragment.changed
+- name: Verify effective forwarding after reload
+  ansible.builtin.command: /usr/sbin/sshd -T
+  changed_when: false
+  register: ssh_verified
+  failed_when: "'allowtcpforwarding yes' not in ssh_verified.stdout"