@crvouga/dev-fleet 0.0.0-stage → 0.2.0

package/ansible/monitoring/compose.yml

@@ -0,0 +1,74 @@
+# Run on the manager only, through hub-darwin.yml from the verified checkout.
+# Never copy the hub data to a worker or run a second copy of its identity.
+name: personal-beszel
+services:
+  hub:
+    image: henrygd/beszel:0.21.1@sha256:8514a69d9bbbcb74f371a3205561ee231fc0289739cea64e8131f341d695b770
+    restart: unless-stopped
+    ports:
+      - '127.0.0.1:8090:8090'
+    environment:
+      APP_URL: '${BESZEL_APP_URL:-${BESZEL_HUB_URL:?private HTTPS hub URL required}}'
+      DISABLE_SSH: 'true'
+      CHECK_UPDATES: 'false'
+      # Single-operator private hub: fleet-registered systems are visible to every login.
+      SHARE_ALL_SYSTEMS: 'true'
+      # Visitors are signed in automatically as this read-only viewer account
+      # (never the fleet admin), so the dashboard needs no login. Empty keeps
+      # the normal login page.
+      AUTO_LOGIN: '${BESZEL_AUTO_LOGIN:-}'
+      # First start only (empty data directory): Beszel creates the fleet login
+      # as a verified user and superuser. hub-darwin.yml sets these just once.
+      USER_EMAIL: '${BESZEL_BOOTSTRAP_EMAIL:-}'
+      USER_PASSWORD: '${BESZEL_BOOTSTRAP_PASSWORD:-}'
+    volumes:
+      - type: bind
+        source: '${BESZEL_DATA_DIR:?per-user hub data directory required}'
+        target: /beszel_data
+        bind:
+          create_host_path: false
+    logging:
+      driver: local
+      options:
+        max-size: '10m'
+        max-file: '3'
+    mem_limit: 512m
+    cpus: 1.0
+    pids_limit: 128
+    stop_grace_period: 30s
+  # Outbound-only Cloudflare Tunnel for the public dashboard hostname. The
+  # connector token is delivered from the manager's Vault session to a 0600
+  # per-user file by hub-darwin.yml.
+  cloudflared:
+    profiles: [public-endpoint]
+    image: cloudflare/cloudflared:2026.9.3@sha256:072c067d25ccbe61d46e18f0d0723255f2bb5304f7317caa95b27031520ff92c
+    user: '1000:1000'
+    restart: unless-stopped
+    command:
+      [
+        'tunnel',
+        '--no-autoupdate',
+        'run',
+        '--token-file',
+        '/run/secrets/tunnel-token',
+      ]
+    volumes:
+      - type: bind
+        source: '${BESZEL_TUNNEL_TOKEN_FILE:?per-user connector token file required}'
+        target: /run/secrets/tunnel-token
+        read_only: true
+        bind:
+          create_host_path: false
+    depends_on:
+      - hub
+    read_only: true
+    cap_drop: [ALL]
+    security_opt: ['no-new-privileges:true']
+    mem_limit: 256m
+    cpus: 0.5
+    pids_limit: 128
+    logging:
+      driver: local
+      options:
+        max-size: '5m'
+        max-file: '2'

package/ansible/monitoring/hub-darwin.yml

@@ -0,0 +1,102 @@
+---
+# The Beszel hub runs only on the manager (the human's macOS machine) under
+# Docker Desktop, as that user: no become, per-user data and credential paths.
+# Runtime variables arrive through a private 0600 variables file, never argv.
+- name: Converge the Beszel hub on the manager
+  hosts: localhost
+  connection: local
+  become: false
+  gather_facts: true
+  vars:
+    beszel_lock: "{{ lookup('ansible.builtin.file', 'lock.json') | from_json }}"
+    beszel_compose:
+      - docker
+      - compose
+      - '-f'
+      - '{{ playbook_dir }}/compose.yml'
+    beszel_environment:
+      BESZEL_HUB_URL: '{{ beszel_hub_url }}'
+      BESZEL_APP_URL: '{{ beszel_public_url | default(beszel_hub_url) }}'
+      BESZEL_DATA_DIR: '{{ beszel_data_dir }}'
+      BESZEL_AUTO_LOGIN: '{{ beszel_auto_login | default("") }}'
+      BESZEL_TUNNEL_TOKEN_FILE: '{{ beszel_tunnel_dir }}/token'
+  tasks:
+    - name: Require the macOS manager and private dashboard policy
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.os_family == 'Darwin'
+          - beszel_hub_url is match('^https://[a-z0-9.-]+\.ts\.net:8443$')
+          - beszel_data_dir is match('^/Users/[^/]+/Library/Application Support/personal-beszel$')
+          - beszel_tunnel_dir is match('^/Users/[^/]+/Library/Application Support/personal-beszel-tunnel$')
+        fail_msg: BESZEL_NOT_MANAGER; the hub runs only on the macOS manager with per-user data.
+    - name: Require a running Docker Desktop engine with Compose
+      ansible.builtin.command:
+        argv: [docker, compose, version]
+      changed_when: false
+    - name: Inspect an existing hub image before any upgrade
+      ansible.builtin.command:
+        argv:
+          [
+            docker,
+            inspect,
+            '--format',
+            '{{ "{{.Config.Image}}" }}',
+            personal-beszel-hub-1,
+          ]
+      changed_when: false
+      failed_when: false
+      register: existing_hub
+    - name: Require explicit maintenance for a different existing image
+      ansible.builtin.assert:
+        that: existing_hub.rc != 0 or existing_hub.stdout == beszel_lock.image
+        fail_msg: BESZEL_HUB_UPGRADE_PENDING; take and verify a backup before an explicit maintenance upgrade.
+    - name: Create per-user hub data and connector directories without replacing data
+      ansible.builtin.file:
+        path: '{{ item }}'
+        state: directory
+        mode: '0700'
+      loop:
+        - '{{ beszel_data_dir }}'
+        - '{{ beszel_tunnel_dir }}'
+    - name: Write the public dashboard connector token for the current user only
+      ansible.builtin.copy:
+        dest: '{{ beszel_tunnel_dir }}/token'
+        content: '{{ beszel_tunnel_token }}'
+        mode: '0600'
+      when: beszel_tunnel_token | default('') | length > 0
+      no_log: true
+    - name: Detect a hub that has never started (no database yet)
+      ansible.builtin.stat:
+        path: '{{ beszel_data_dir }}/data.db'
+      register: hub_database
+    - name: Start pinned stock Compose service
+      ansible.builtin.command:
+        argv: "{{ beszel_compose + ['up', '-d', '--pull', 'missing', 'hub'] }}"
+      # A fresh hub creates the fleet login itself on first start, so no one
+      # has to create the account by hand. Existing data is never changed.
+      environment: >-
+        {{ beszel_environment | combine({
+             'BESZEL_BOOTSTRAP_EMAIL': beszel_fleet_identity,
+             'BESZEL_BOOTSTRAP_PASSWORD': beszel_fleet_password
+           } if (not hub_database.stat.exists
+                 and beszel_fleet_password | default('') | length > 0)
+           else {}) }}
+      no_log: true
+      register: hub_apply
+      changed_when: "'Started' in hub_apply.stderr or 'Created' in hub_apply.stderr or 'Recreated' in hub_apply.stderr"
+    - name: Start the public connector when its credential is present
+      ansible.builtin.command:
+        argv: "{{ beszel_compose + ['--profile', 'public-endpoint', 'up', '-d', '--pull', 'missing'] }}"
+      environment: '{{ beszel_environment }}'
+      when: beszel_tunnel_token | default('') | length > 0
+      register: tunnel_apply
+      changed_when: "'Started' in tunnel_apply.stderr or 'Created' in tunnel_apply.stderr or 'Recreated' in tunnel_apply.stderr"
+    - name: Independently verify the local hub health endpoint
+      ansible.builtin.uri:
+        url: http://127.0.0.1:8090/api/health
+        status_code: 200
+        return_content: false
+      retries: 10
+      delay: 2
+      register: hub_health
+      until: hub_health.status == 200

package/ansible/monitoring/hub-route-darwin.yml

@@ -0,0 +1,51 @@
+---
+# The manager's hub is reached over the tailnet only: Tailscale Serve
+# terminates HTTPS on the declared port and proxies to the loopback hub. Never
+# Funnel. A port that already has any owner is left alone: fleet-sync refuses
+# a conflicting owner before this runs and reads the route back afterwards.
+- name: Serve the manager hub privately over the tailnet
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  vars:
+    beszel_serve:
+      [
+        '{{ beszel_tailscale_cli }}',
+        serve,
+        --bg,
+        '--https={{ beszel_route_port }}',
+        '{{ beszel_route_target }}',
+      ]
+  tasks:
+    - name: Require the declared loopback target and port
+      ansible.builtin.assert:
+        that:
+          - "beszel_route_target is match('^http://127\\.0\\.0\\.1:[0-9]+$')"
+          - "beszel_route_port is match('^[0-9]+$')"
+          - "beszel_tailscale_cli is match('^/')"
+
+    - name: Read this node's Serve configuration
+      ansible.builtin.command:
+        argv: ['{{ beszel_tailscale_cli }}', serve, status, --json]
+      register: beszel_serve_status
+      changed_when: false
+    - name: Publish the hub on the tailnet HTTPS port as the signed-in user
+      ansible.builtin.command:
+        argv: '{{ beszel_serve }}'
+      vars:
+        serve: "{{ beszel_serve_status.stdout | default('{}', true) | from_json }}"
+      when:
+        - beszel_route_port not in (serve.TCP | default({}))
+        - "(serve.Web | default({})) | select('search', ':' ~ beszel_route_port ~ '$') | list | length == 0"
+      register: beszel_served
+      changed_when: beszel_served.rc == 0
+      failed_when: false
+    # The standalone daemon accepts Serve changes from an administrator only.
+    - name: Publish the hub with administrator rights where the daemon requires them
+      ansible.builtin.command:
+        argv: '{{ beszel_serve }}'
+      become: true
+      when:
+        - beszel_served is not skipped
+        - beszel_served.rc != 0
+      changed_when: true

package/ansible/monitoring/lock.json

@@ -0,0 +1,16 @@
+{
+  "version": "0.21.1",
+  "image": "henrygd/beszel:0.21.1@sha256:8514a69d9bbbcb74f371a3205561ee231fc0289739cea64e8131f341d695b770",
+  "tunnelImage": "cloudflare/cloudflared:2026.9.3@sha256:072c067d25ccbe61d46e18f0d0723255f2bb5304f7317caa95b27031520ff92c",
+  "agents": {
+    "amd64": "3b6ee592632ec03b9a43312e99a40203a7b3d83fe40dd0c25acda1eb915ea7c0",
+    "arm64": "a6ea544976b9a74398ac88d5da5bb96813d9a2e353a37bbfdb6a903fa8ba1838",
+    "darwin-arm64": "9246065f680cdb0af2885b7bf5876dc45b754019f2c90eb28550cf45db978eb8",
+    "darwin-amd64": "21f4a03fd90ae46869cfcbb69e21e8312f0f05deff49669d4602a3dee4866981"
+  },
+  "agentBinaries": {
+    "amd64": "5c84416b63028f7ad86ebafa4c8a7a27977d485a838de357216ded3ab844b2b5",
+    "arm64": "eb4e7ac9340d380b19ab18261301b18813c1e46ebab5f0e4bf8cb6c86b4d5c20"
+  },
+  "source": "https://github.com/henrygd/beszel/releases/tag/v0.21.1"
+}

package/ansible/net/remote-probe.sh

@@ -0,0 +1,13 @@
+# Read-only health probe that `dev-fleet net check` pipes to each host over SSH (`sh -s`).
+# Prints key=value lines; works on macOS and Linux (including WSL).
+if [ "$(uname)" = Darwin ]; then
+  echo "ncpu=$(sysctl -n hw.ncpu)"
+  echo "load=$(sysctl -n vm.loadavg | awk '{print $2}')"
+  echo "memfree=$(memory_pressure -Q 2>/dev/null | awk -F': ' '/percentage/{gsub("%","",$2); print $2}')"
+  sysctl -n vm.swapusage | awk '{t=$3; u=$6; gsub("M","",t); gsub("M","",u); if (t>0) print "swap=" int(u*100/t); else print "swap=0"}'
+else
+  echo "ncpu=$(nproc)"
+  echo "load=$(cut -d' ' -f1 /proc/loadavg)"
+  awk '/MemTotal/{t=$2} /MemAvailable/{a=$2} /SwapTotal/{st=$2} /SwapFree/{sf=$2} END{print "memfree=" int(a*100/t); if (st>0) print "swap=" int((st-sf)*100/st); else print "swap=0"}' /proc/meminfo
+fi
+echo "diskmb=$(df -Pk "$HOME" | awk 'NR==2{print int($4/1024)}')"

package/ansible/pyproject.toml

@@ -0,0 +1,12 @@
+# The Ansible the manager runs these playbooks with: one release, on one
+# Python, with every dependency hash-locked in uv.lock. A worker runs the
+# exact ansible-core package ubuntu/policy.json names instead. Change the
+# version here, then run `uv lock` in this directory.
+[project]
+name = "dev-fleet-ansible"
+version = "0"
+requires-python = "==3.13.16"
+dependencies = ["ansible-core==2.19.9"]
+
+[tool.uv]
+package = false

package/ansible/ubuntu/authorize-sudo.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+# Manager-led, explicitly approved initial privilege step. Run through a real
+# SSH terminal so sudo reads the operator's password itself; never capture it.
+set -eu
+umask 077
+case "$(uname -s)" in
+  Linux)
+    . /etc/os-release
+    [ "$ID" = ubuntu ] && [ "$VERSION_ID" = 26.04 ] || exit 1 ;;
+  Darwin)
+    [ "$(sw_vers -productVersion | cut -d. -f1)" -ge 14 ] || exit 1 ;;
+  *) exit 1 ;;
+esac
+user=$(id -un)
+case "$user" in root|''|*[!a-z0-9_-]*) exit 1;; esac
+command -v sudo >/dev/null 2>&1 || exit 1
+# The same operation lock used by remote bootstrap excludes another installer.
+root="$HOME/.local/share/personal/fleet"
+for path in "$HOME/.local" "$HOME/.local/share" "$HOME/.local/share/personal" "$root"; do
+  [ ! -L "$path" ] || exit 1
+done
+mkdir -p "$root"
+chmod 700 "$root"
+[ ! -L "$root/remote-operation.lock" ] || exit 1
+exec 9>"$root/remote-operation.lock"
+if command -v flock >/dev/null 2>&1; then
+  flock -n 9 || exit 1
+else
+  python3 -c 'import fcntl; fcntl.flock(9, fcntl.LOCK_EX | fcntl.LOCK_NB)' 9>&9 || exit 1
+fi
+sudo -v
+file=$(mktemp)
+trap 'rm -f "$file"' EXIT
+trap 'exit 1' HUP INT TERM
+printf '# Managed by personal Fleet: designated development user\n%s ALL=(ALL:ALL) NOPASSWD: ALL\n' "$user" >"$file"
+sudo -n visudo -cf "$file" >/dev/null
+# This dedicated path is owned by the same Workstation baseline. Preserve any
+# existing fragment for recovery before installing the validated declaration.
+target="/etc/sudoers.d/personal-fleet-$user"
+if sudo -n test -e "$target"; then
+  sudo -n test ! -L "$target" || exit 1
+  sudo -n grep -qxF '# Managed by personal Fleet: designated development user' "$target" || {
+    printf '%s\n' 'SUDOERS_OWNERSHIP_CONFLICT: preserve the existing fragment and review its source before migration.' >&2
+    exit 1
+  }
+  sudo -n cp -p -- "$target" "$target.before-fleet-enrollment"
+fi
+group=root
+[ "$(uname -s)" != Darwin ] || group=wheel
+sudo -n install -o root -g "$group" -m 0440 -- "$file" "$target"
+sudo -n true

package/ansible/ubuntu/baseline.yml

@@ -0,0 +1,89 @@
+---
+- name: Apply reviewed Ubuntu development-server policy
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: true
+  vars_files:
+    - policy.json
+  pre_tasks:
+    - name: Require the supported common release and an explicit non-root user
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.distribution == 'Ubuntu'
+          - ansible_facts.distribution_version == release
+          - ansible_facts.architecture in ['x86_64', 'aarch64']
+          - development_user is match('^[a-z_][a-z0-9_-]{0,31}$')
+          - development_user != 'root'
+        fail_msg: Unsupported platform or user; no distribution upgrade is permitted.
+    - name: Read the designated existing account
+      ansible.builtin.getent:
+        database: passwd
+        key: '{{ development_user }}'
+    - name: Refuse a different user identity or home
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.getent_passwd[development_user][1] | int == development_uid | int
+          - ansible_facts.getent_passwd[development_user][4] == development_home
+    # Memory and disk safety must land even when the disk is nearly full.
+    - ansible.builtin.import_tasks: tasks/resources.yml
+    - name: Inspect capacity before package and service changes
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/python3
+          - '-c'
+          - |
+            import json, os
+            print(json.dumps([{"path": p, "freeMiB": (v.f_bavail * v.f_frsize) // (1024 * 1024), "freeInodes": v.f_favail} for p in ['/', '/var', os.environ['FLEET_HOME']] for v in [os.statvfs(p)]]))
+      environment:
+        FLEET_HOME: '{{ development_home }}'
+      changed_when: false
+      register: capacity
+    - name: Preserve management capacity instead of installing into an exhausted disk
+      ansible.builtin.assert:
+        that:
+          - item.freeMiB >= minimumFreeDiskMiB
+          - item.freeInodes >= minimumFreeInodes
+        fail_msg: RESOURCE_CAPACITY_REQUIRED; inspect disk space and inodes on the reported filesystem. Preserve developer work; the disk GC removes only build output and caches, so what remains needs a person.
+      loop: '{{ capacity.stdout | from_json }}'
+    - name: Inspect installed packages
+      ansible.builtin.package_facts:
+        manager: apt
+    - name: Preserve Docker installations owned by a different distribution
+      ansible.builtin.assert:
+        that: "'docker-ce' not in ansible_facts.packages and 'containerd.io' not in ansible_facts.packages"
+        fail_msg: DOCKER_OWNER_CONFLICT; migrate the existing Docker owner explicitly before applying the Ubuntu-native baseline.
+    - name: Inspect existing service ownership
+      ansible.builtin.service_facts:
+    - name: Wait for legitimate package transactions before inspecting dpkg
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/python3
+          - '-c'
+          - |
+            import fcntl
+            files = [open(path, 'a') for path in ['/var/lib/dpkg/lock-frontend', '/var/lib/dpkg/lock']]
+            for handle in files:
+                fcntl.lockf(handle, fcntl.LOCK_EX | fcntl.LOCK_NB)
+      register: apt_idle
+      changed_when: false
+      retries: 24
+      delay: 5
+      until: apt_idle.rc == 0
+    - name: Inspect package database consistency
+      ansible.builtin.command: dpkg --audit
+      changed_when: false
+      register: dpkg_audit
+    - name: Require package database recovery before modifying packages
+      ansible.builtin.assert:
+        that: dpkg_audit.stdout | trim == ''
+        fail_msg: APT_STATE_BROKEN; inspect dpkg --audit and use reviewed package recovery. Never remove package lock files.
+  tasks:
+    - ansible.builtin.import_tasks: tasks/packages.yml
+    - ansible.builtin.import_tasks: tasks/docker.yml
+    - ansible.builtin.import_tasks: tasks/services.yml
+    - ansible.builtin.import_tasks: tasks/power.yml
+    - ansible.builtin.import_tasks: tasks/user.yml
+    - ansible.builtin.import_tasks: tasks/ssh.yml
+    - ansible.builtin.import_tasks: tasks/credentials.yml
+      when: development_source is defined