@crvouga/dev-fleet 0.0.0-stage → 0.2.0

package/ansible/ubuntu/t3-desktop.yml

@@ -0,0 +1,220 @@
+---
+# The worker's only T3 process: the pinned desktop app, which embeds the server
+# on 127.0.0.1:3773. GDM logs the designated user in automatically and the user
+# unit starts the app with the graphical session, so the UI is on screen and the
+# server is up after every boot. Starting or migrating is left to fleet-sync.
+#
+# The upstream .deb declares libxss1, which Ubuntu 26.04 no longer ships and the
+# binary does not link. Instead of patching the package or leaving apt with an
+# unmet dependency, the verified package payload is unpacked to its own path and
+# its real runtime libraries and bundled AppArmor profile are installed.
+- name: Install the pinned T3 Code desktop app and start it with the session
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  vars:
+    t3_desktop_dir: /opt/T3 Code (Nightly)
+    # The package's Depends without libxss1 (see above).
+    t3_desktop_libraries:
+      - libasound2t64
+      - libatspi2.0-0t64
+      - libgbm1
+      - libgtk-3-0t64
+      - libnotify4
+      - libnss3
+      - libsecret-1-0
+      - libuuid1
+      - libxtst6
+      - xdg-utils
+  tasks:
+    - name: Create the package cache
+      ansible.builtin.file:
+        path: /var/cache/personal-fleet
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+    - name: Download the pinned desktop package
+      ansible.builtin.get_url:
+        url: '{{ t3_desktop_url }}'
+        dest: '/var/cache/personal-fleet/{{ t3_desktop_name }}'
+        checksum: 'sha256:{{ t3_desktop_sha256 }}'
+        mode: '0644'
+        timeout: 300
+    - name: Install the desktop runtime libraries
+      ansible.builtin.apt:
+        name: '{{ t3_desktop_libraries }}'
+        state: present
+        lock_timeout: 120
+    - name: Read the unpacked app version
+      ansible.builtin.command:
+        argv: [cat, '{{ t3_desktop_dir }}/.personal-fleet-version']
+      register: t3_desktop_installed
+      changed_when: false
+      failed_when: false
+    - name: Unpack the pinned app when its version differs
+      when: t3_desktop_installed.stdout | default('') != t3_desktop_name
+      block:
+        - name: Clear the staging directory
+          ansible.builtin.file:
+            path: /opt/.t3code-staging
+            state: absent
+        - name: Unpack the verified package payload
+          ansible.builtin.command:
+            argv:
+              - dpkg-deb
+              - -x
+              - '/var/cache/personal-fleet/{{ t3_desktop_name }}'
+              - /opt/.t3code-staging
+          changed_when: true
+        - name: Record the unpacked package
+          ansible.builtin.copy:
+            dest: '/opt/.t3code-staging{{ t3_desktop_dir }}/.personal-fleet-version'
+            content: '{{ t3_desktop_name }}'
+            mode: '0644'
+        - name: Remove the copy kept from the previous update
+          ansible.builtin.file:
+            path: '{{ t3_desktop_dir }}.previous'
+            state: absent
+        - name: Inspect the current app directory
+          ansible.builtin.stat:
+            path: '{{ t3_desktop_dir }}'
+          register: t3_desktop_current
+        - name: Keep the current app until the next update (a running app keeps its files)
+          ansible.builtin.command:
+            argv:
+              [mv, -T, '{{ t3_desktop_dir }}', '{{ t3_desktop_dir }}.previous']
+          when: t3_desktop_current.stat.exists
+          changed_when: true
+        - name: Move the pinned app into place
+          ansible.builtin.command:
+            argv:
+              - mv
+              - -T
+              - '/opt/.t3code-staging{{ t3_desktop_dir }}'
+              - '{{ t3_desktop_dir }}'
+          changed_when: true
+        - name: Add the launcher entry and icon
+          ansible.builtin.copy:
+            src: '/opt/.t3code-staging/usr/share/{{ item }}'
+            dest: '/usr/share/{{ item }}'
+            remote_src: true
+            mode: '0644'
+          loop:
+            - applications/t3code.desktop
+            - icons/hicolor/512x512/apps/t3code.png
+        - name: Remove the staging directory
+          ansible.builtin.file:
+            path: /opt/.t3code-staging
+            state: absent
+    - name: Install the AppArmor profile the package ships
+      ansible.builtin.copy:
+        src: '{{ t3_desktop_dir }}/resources/apparmor-profile'
+        dest: /etc/apparmor.d/t3code
+        remote_src: true
+        mode: '0644'
+      register: t3_desktop_apparmor
+    - name: Load the AppArmor profile so the app sandbox can start
+      ansible.builtin.command:
+        argv:
+          [
+            apparmor_parser,
+            --replace,
+            --write-cache,
+            --skip-read-cache,
+            /etc/apparmor.d/t3code,
+          ]
+      when: t3_desktop_apparmor.changed
+      changed_when: true
+    - name: Inspect the GDM configuration
+      ansible.builtin.stat:
+        path: /etc/gdm3/custom.conf
+      register: gdm_config
+    - name: Log the designated user in automatically
+      ansible.builtin.lineinfile:
+        path: /etc/gdm3/custom.conf
+        regexp: '^#?\s*{{ item.key }}\s*='
+        line: '{{ item.key }} = {{ item.value }}'
+        insertafter: '^\[daemon\]'
+      loop:
+        - { key: AutomaticLoginEnable, value: 'true' }
+        - { key: AutomaticLogin, value: '{{ development_user }}' }
+      when: gdm_config.stat.exists
+    - name: Create the user unit directory
+      ansible.builtin.file:
+        path: '{{ development_home }}/.config/systemd/user'
+        state: directory
+        owner: '{{ development_user }}'
+        mode: '0700'
+    - name: Declare the desktop app as a session service
+      ansible.builtin.copy:
+        dest: '{{ development_home }}/.config/systemd/user/t3code-desktop.service'
+        owner: '{{ development_user }}'
+        mode: '0600'
+        content: |
+          # Managed by personal fleet-sync: ansible/ubuntu/t3-desktop.yml
+          [Unit]
+          Description=T3 Code desktop (UI and server)
+          PartOf=graphical-session.target
+          After=graphical-session.target
+          StartLimitIntervalSec=300
+          StartLimitBurst=5
+          [Service]
+          Type=simple
+          WorkingDirectory=%h
+          Environment=T3CODE_HOME=%h/.t3
+          # /tmp is RAM with a per-user quota that agent and build caches
+          # exhaust; agents use disk-backed /var/tmp (aged by tasks/resources.yml).
+          Environment=TMPDIR=/var/tmp
+          # Native Wayland hangs before the first window on Asahi (16K pages);
+          # XWayland works on every GNOME worker, so use it everywhere.
+          ExecStart="{{ t3_desktop_dir }}/t3code" --ozone-platform=x11
+          KillMode=mixed
+          Restart=always
+          RestartSec=5
+          CPUWeight=1000
+          IOWeight=1000
+          MemoryLow=1536M
+          OOMScoreAdjust=100
+          ManagedOOMPreference=avoid
+          [Install]
+          WantedBy=graphical-session.target
+    # Repoint recovery now: a timer still running an older revision's script
+    # would restart the headless server right after its approved migration.
+    - ansible.builtin.import_tasks: tasks/recovery.yml
+    - name: Enable the desktop app for every graphical login
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-desktop.service
+        daemon_reload: true
+        enabled: true
+    # One T3 process per worker: the desktop app. The former headless server
+    # (`t3 service install`) is retired; absent on machines that never had it.
+    - name: Retire the former headless T3 server
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code.service
+        state: stopped
+        enabled: false
+      failed_when: false
+    # Starting needs the auto-login graphical session, which a machine has only
+    # after its first reboot; the running state is measured after this play.
+    - name: Start the desktop app without restarting a running one
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-desktop.service
+        state: started
+      failed_when: false

package/ansible/ubuntu/t3-health.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+# Keep the worker T3 desktop app (UI and server) up and responsive. Run every minute by
+# personal-worker-recovery.timer (managed by fleet-sync, tasks/recovery.yml).
+# Stopped or failed: start it. Running but its local API has not answered for
+# three checks in a row: restart it, since a hung server serves no turns.
+set -u
+url=http://127.0.0.1:3773/.well-known/t3/environment
+state="${XDG_RUNTIME_DIR:?}/personal-t3-health-failures"
+limit=3
+
+# The former headless server still runs until its approved migration; never
+# start a second T3 next to it.
+if systemctl --user is-active --quiet t3code.service; then
+  echo "Headless T3 still runs; desktop migration pending."
+  exit 0
+fi
+if ! systemctl --user is-active --quiet t3code-desktop.service; then
+  rm -f "$state"
+  echo "T3 is not running; starting it."
+  exec systemctl --user start t3code-desktop.service
+fi
+if curl --fail --silent --max-time 10 --output /dev/null "$url"; then
+  rm -f "$state"
+  exit 0
+fi
+failures=$(($(cat "$state" 2>/dev/null || echo 0) + 1))
+echo "$failures" > "$state"
+echo "T3 local API did not answer ($failures/$limit)."
+if [ "$failures" -ge "$limit" ]; then
+  rm -f "$state"
+  echo "T3 is unresponsive; restarting it."
+  exec systemctl --user restart t3code-desktop.service
+fi

package/ansible/ubuntu/t3-policy.yml

@@ -0,0 +1,76 @@
+---
+- name: Stage the native T3 policy and make the running app load it
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Inspect existing administrator policy
+      ansible.builtin.stat:
+        path: /etc/t3code/policy.json
+      register: policy_file
+    - name: Inspect Fleet ownership marker
+      ansible.builtin.stat:
+        path: /etc/t3code/.personal-fleet-policy
+      register: policy_owner
+    - name: Refuse to overwrite an unrelated administrator policy
+      ansible.builtin.assert:
+        that: not policy_file.stat.exists or policy_owner.stat.exists
+        fail_msg: T3_POLICY_OWNER_CONFLICT; review and merge the existing administrator policy in Git before adoption.
+    - name: Create administrator-owned policy directory
+      ansible.builtin.file:
+        path: /etc/t3code
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+    - name: Record policy ownership before resumable installation
+      ansible.builtin.copy:
+        dest: /etc/t3code/.personal-fleet-policy
+        content: "ansible/ubuntu/t3/policy.json\n"
+        owner: root
+        group: root
+        mode: '0644'
+    - name: Stage validated policy with backup
+      ansible.builtin.copy:
+        content: "{{ t3_policy_document | default(lookup('ansible.builtin.file', 't3/policy.json') | from_json) | to_nice_json }}"
+        validate: '{{ t3_executable | quote }} policy check %s'
+        dest: /etc/t3code/policy.json
+        owner: root
+        group: root
+        mode: '0644'
+        backup: true
+    # T3 reads its policy once, at startup. A running app that has not loaded
+    # the staged policy is restarted (this ends its running turns) so every
+    # node offers the same providers after every sync.
+    - name: Check whether the desktop app is running
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.command:
+        argv: [systemctl, --user, is-active, --quiet, t3code-desktop.service]
+      register: t3_desktop_active
+      changed_when: false
+      failed_when: false
+    - name: Ask the running T3 which policy it loaded
+      become: true
+      become_user: '{{ development_user }}'
+      ansible.builtin.command:
+        argv: ['{{ t3_executable }}', policy, show]
+      register: t3_policy_loaded
+      changed_when: false
+      failed_when: false
+      when: t3_desktop_active.rc == 0
+    - name: Restart T3 so it loads the staged policy
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-desktop.service
+        state: restarted
+      when:
+        - t3_desktop_active.rc == 0
+        - t3_policy_loaded.stdout is not search('loaded this policy\.\s*$')

package/ansible/ubuntu/t3-route.yml

@@ -0,0 +1,28 @@
+---
+# The worker's T3 is reached over the tailnet only: Tailscale Serve terminates
+# HTTPS on port 443 and proxies to the loopback T3 server. Never Funnel. A
+# port 443 that already has any owner is left alone (reported, never reset).
+- name: Serve the worker T3 privately over the tailnet
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  tasks:
+    - name: Require the declared loopback target
+      ansible.builtin.assert:
+        that: "t3_route_target is match('^http://127\\.0\\.0\\.1:[0-9]+$')"
+
+    - name: Read this node's Serve configuration
+      ansible.builtin.command:
+        argv: [tailscale, serve, status, --json]
+      register: t3_serve_status
+      changed_when: false
+    - name: Publish T3 on tailnet HTTPS port 443
+      ansible.builtin.command:
+        argv: [tailscale, serve, --bg, --https=443, '{{ t3_route_target }}']
+      vars:
+        serve: "{{ t3_serve_status.stdout | default('{}', true) | from_json }}"
+      when:
+        - "'443' not in (serve.TCP | default({}))"
+        - "(serve.Web | default({})) | select('search', ':443$') | list | length == 0"
+      changed_when: true

package/ansible/ubuntu/tailscale.yml

@@ -0,0 +1,78 @@
+---
+- name: Converge native Tailscale without replacing its device identity
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: true
+  # The approved version and the signing key's digest: `tailscale` in policy.json.
+  vars_files:
+    - policy.json
+  tasks:
+    - name: Require supported Ubuntu
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.distribution == 'Ubuntu'
+          - ansible_facts.distribution_version == release
+    - name: Inspect installed packages before possible network interruption
+      ansible.builtin.package_facts:
+        manager: apt
+    - name: Require maintenance for an installed version change
+      ansible.builtin.assert:
+        that: "'tailscale' not in ansible_facts.packages or ansible_facts.packages.tailscale[0].version == tailscale.version"
+        fail_msg: TAILSCALE_UPGRADE_PENDING; upgrading an active VPN can disconnect SSH. Review an explicit maintenance operation.
+    - name: Inspect existing package-source ownership before writing
+      ansible.builtin.find:
+        paths: /etc/apt/sources.list.d
+        patterns: ['*.list', '*.sources']
+        contains: '.*pkgs.tailscale.com.*'
+        read_whole_file: true
+      register: existing_sources
+    - name: Refuse duplicate or custom sources instead of breaking APT
+      ansible.builtin.assert:
+        that:
+          - existing_sources.matched <= 1
+          - existing_sources.matched == 0 or existing_sources.files[0].path == '/etc/apt/sources.list.d/tailscale.list'
+        fail_msg: TAILSCALE_SOURCE_OWNER_CONFLICT; review the existing signed source and its migration before creating another repository entry.
+    - name: Install pinned upstream signing key
+      ansible.builtin.get_url:
+        url: https://pkgs.tailscale.com/stable/ubuntu/resolute.noarmor.gpg
+        dest: /usr/share/keyrings/tailscale-archive-keyring.gpg
+        checksum: 'sha256:{{ tailscale.keySha256 }}'
+        owner: root
+        group: root
+        mode: '0644'
+        timeout: 30
+    - name: Declare the signed upstream package source
+      ansible.builtin.apt_repository:
+        repo: deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu resolute main
+        filename: tailscale
+        state: present
+        update_cache: false
+      register: tailscale_source
+    - name: Install the approved version only when absent
+      ansible.builtin.apt:
+        name: 'tailscale={{ tailscale.version }}'
+        state: present
+        update_cache: true
+        cache_valid_time: 0
+        lock_timeout: '{{ aptLockTimeoutSeconds }}'
+        allow_downgrade: false
+        allow_unauthenticated: false
+      when: "'tailscale' not in ansible_facts.packages"
+    - name: Enable and start the native daemon, preserving existing identity
+      ansible.builtin.systemd_service:
+        name: tailscaled.service
+        enabled: true
+        state: started
+    - name: Inspect native authentication without prompting or opening a browser
+      ansible.builtin.command:
+        argv: [tailscale, status, '--json']
+      changed_when: false
+      failed_when: false
+      register: tailscale_status
+      no_log: true
+    - name: Require genuine device authentication before claiming connectivity
+      ansible.builtin.assert:
+        that: (tailscale_status.stdout | from_json).BackendState == 'Running'
+        fail_msg: TAILSCALE_LOGIN_REQUIRED; authorize this device through its native login. Existing state is never copied or reset.
+      no_log: true

package/ansible/ubuntu/tasks/credentials.yml

@@ -0,0 +1,47 @@
+---
+- name: Create persistent worker credential renewal units
+  ansible.builtin.file:
+    path: '{{ development_home }}/.config/systemd/user'
+    state: directory
+    owner: '{{ development_user }}'
+    mode: '0700'
+- name: Declare native self-token renewal without copying credentials
+  ansible.builtin.copy:
+    dest: '{{ development_home }}/.config/systemd/user/personal-worker-auth.service'
+    owner: '{{ development_user }}'
+    mode: '0600'
+    content: |
+      [Unit]
+      Description=Renew this worker's own Vault authorization
+      [Service]
+      Type=oneshot
+      WorkingDirectory={{ development_source }}
+      ExecStart={{ development_home }}/.local/bin/mise exec -- bun bootstrap/worker-auth.ts
+      Environment="PATH={{ development_home }}/.local/share/mise/shims:{{ development_home }}/.local/bin:/usr/local/bin:/usr/bin:/bin"
+      UMask=0077
+      TimeoutStartSec=45
+- name: Declare bounded persistent renewal schedule
+  ansible.builtin.copy:
+    dest: '{{ development_home }}/.config/systemd/user/personal-worker-auth.timer'
+    owner: '{{ development_user }}'
+    mode: '0600'
+    content: |
+      [Unit]
+      Description=Keep enrolled worker Vault authorization renewed
+      [Timer]
+      OnBootSec=2min
+      OnUnitActiveSec=10min
+      Persistent=true
+      [Install]
+      WantedBy=timers.target
+- name: Enable this user's credential renewal timer
+  become: true
+  become_user: '{{ development_user }}'
+  environment:
+    XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+  ansible.builtin.systemd_service:
+    scope: user
+    name: personal-worker-auth.timer
+    daemon_reload: true
+    enabled: true
+    state: started

package/ansible/ubuntu/tasks/docker.yml

@@ -0,0 +1,31 @@
+---
+- name: Rotate container logs by default (new containers, after the next Docker restart)
+  ansible.builtin.copy:
+    dest: /etc/docker/daemon.json
+    force: false
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      {
+        "log-driver": "json-file",
+        "log-opts": { "max-size": "{{ resourceSafety.dockerLogMaxSize }}", "max-file": "{{ resourceSafety.dockerLogMaxFiles }}" }
+      }
+    validate: dockerd --validate --config-file %s
+- name: Start the native Docker engine without restarting existing workloads
+  ansible.builtin.systemd_service:
+    name: docker.service
+    enabled: true
+    state: started
+- name: Grant the designated developer access to the local Docker engine
+  ansible.builtin.user:
+    name: '{{ development_user }}'
+    groups: docker
+    append: true
+- name: Verify native Docker Compose and Buildx installation
+  ansible.builtin.command:
+    argv: '{{ item }}'
+  loop:
+    - [docker, compose, version]
+    - [docker, buildx, version]
+  changed_when: false

package/ansible/ubuntu/tasks/packages.yml

@@ -0,0 +1,56 @@
+---
+- name: Create owned APT configuration directory
+  ansible.builtin.file:
+    path: /etc/personal-fleet
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+- name: Declare snapshot sources used only for managed package transactions
+  ansible.builtin.copy:
+    dest: /etc/personal-fleet/ubuntu.sources
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
+    content: |
+      Types: deb
+      URIs: https://snapshot.ubuntu.com/ubuntu/{{ snapshot }}/
+      Suites: resolute resolute-updates resolute-security
+      Components: main universe restricted multiverse
+      Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+  register: snapshot_sources
+- name: Isolate snapshot selection from unrelated APT operations
+  ansible.builtin.copy:
+    dest: /etc/personal-fleet/apt.conf
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      Dir::Etc::sourcelist "/etc/personal-fleet/ubuntu.sources";
+      Dir::Etc::sourceparts "-";
+      DPkg::Lock::Timeout "{{ aptLockTimeoutSeconds }}";
+- name: Inspect immutable snapshot package index
+  ansible.builtin.stat:
+    path: '/var/lib/apt/lists/snapshot.ubuntu.com_ubuntu_{{ snapshot }}_dists_resolute_InRelease'
+  register: snapshot_index
+- name: Fetch signed snapshot indexes after source change or interrupted setup
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 0
+    lock_timeout: '{{ aptLockTimeoutSeconds }}'
+  environment:
+    APT_CONFIG: /etc/personal-fleet/apt.conf
+  when: snapshot_sources.changed or not snapshot_index.stat.exists
+- name: Install exact managed packages without downgrading or restarting services
+  ansible.builtin.apt:
+    name: '{{ item.key }}={{ item.value }}'
+    state: present
+    lock_timeout: '{{ aptLockTimeoutSeconds }}'
+    allow_downgrade: false
+    allow_unauthenticated: false
+    fail_on_autoremove: true
+    policy_rc_d: 101
+  environment:
+    APT_CONFIG: /etc/personal-fleet/apt.conf
+  loop: '{{ packages | dict2items }}'

package/ansible/ubuntu/tasks/power.yml

@@ -0,0 +1,51 @@
+---
+- name: Ensure systemd policy directories exist
+  ansible.builtin.file:
+    path: '{{ item }}'
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  loop:
+    - /etc/systemd/logind.conf.d
+    - /etc/systemd/sleep.conf.d
+- name: Declare idle and lid policy without restarting login sessions
+  ansible.builtin.copy:
+    dest: /etc/systemd/logind.conf.d/60-personal-fleet.conf
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
+    content: |
+      # Managed by personal fleet-sync. Effective after logind reload/reboot.
+      [Login]
+      HandleLidSwitch=ignore
+      HandleLidSwitchExternalPower=ignore
+      HandleLidSwitchDocked=ignore
+      IdleAction=ignore
+      KillUserProcesses=no
+      StopIdleSessionSec=infinity
+- name: Declare supported sleep policy
+  ansible.builtin.copy:
+    dest: /etc/systemd/sleep.conf.d/60-personal-fleet.conf
+    owner: root
+    group: root
+    mode: '0644'
+    backup: true
+    content: |
+      [Sleep]
+      AllowSuspend=no
+      AllowHibernation=no
+      AllowSuspendThenHibernate=no
+      AllowHybridSleep=no
+- name: Mask sleep transitions without stopping running user sessions
+  ansible.builtin.systemd_service:
+    name: '{{ item }}'
+    masked: true
+    daemon_reload: true
+  loop:
+    - sleep.target
+    - suspend.target
+    - hibernate.target
+    - hybrid-sleep.target
+    - suspend-then-hibernate.target

package/ansible/ubuntu/tasks/recovery.yml

@@ -0,0 +1,39 @@
+---
+- name: Declare bounded recovery of the worker T3 desktop app
+  ansible.builtin.copy:
+    dest: '{{ development_home }}/.config/systemd/user/personal-worker-recovery.service'
+    owner: '{{ development_user }}'
+    mode: '0600'
+    content: |
+      # Managed by personal fleet-sync: ansible/ubuntu/t3-health.sh
+      [Unit]
+      Description=Keep the worker T3 desktop app running and responsive
+      [Service]
+      Type=oneshot
+      ExecStart=/bin/sh {{ development_source }}/ansible/ubuntu/t3-health.sh
+      TimeoutStartSec=90
+- name: Declare persistent service recovery checks
+  ansible.builtin.copy:
+    dest: '{{ development_home }}/.config/systemd/user/personal-worker-recovery.timer'
+    owner: '{{ development_user }}'
+    mode: '0600'
+    content: |
+      [Unit]
+      Description=Check the worker T3 desktop app every minute
+      [Timer]
+      OnBootSec=1min
+      OnUnitActiveSec=1min
+      Persistent=true
+      [Install]
+      WantedBy=timers.target
+- name: Enable bounded T3 recovery without restarting active sessions
+  become: true
+  become_user: '{{ development_user }}'
+  environment:
+    XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+  ansible.builtin.systemd_service:
+    scope: user
+    name: personal-worker-recovery.timer
+    daemon_reload: true
+    enabled: true
+    state: started