@crvouga/dev-fleet 0.8.0 → 0.9.0

package/ansible/ubuntu/policy.json

@@ -5,9 +5,56 @@
       "release": "26.04",
       "codename": "resolute",
       "architectures": ["amd64", "arm64"]
+    },
+    {
+      "release": "24.04",
+      "codename": "noble",
+      "architectures": ["amd64", "arm64"],
+      "packages": {
+        "sudo": "1.9.15p5-3ubuntu5.24.04.4",
+        "openssh-server": "1:9.6p1-3ubuntu13.20",
+        "dconf-cli": "0.40.0-4ubuntu0.1",
+        "docker.io": "29.1.3-0ubuntu3~24.04.2",
+        "docker-compose-v2": "2.40.3+ds1-0ubuntu1~24.04.1",
+        "docker-buildx": "0.30.1-0ubuntu1~24.04.1",
+        "build-essential": "12.10ubuntu1",
+        "ca-certificates": "20260816ubuntu0.24.04.2",
+        "curl": "8.5.0-2ubuntu10.16",
+        "git": "1:2.43.0-1ubuntu7.4",
+        "python3": "3.12.3-0ubuntu2.1",
+        "unzip": "6.0-28ubuntu4.1",
+        "xz-utils": "5.6.1+really5.4.5-1ubuntu0.4",
+        "ansible-core": "2.16.3-0ubuntu2",
+        "systemd-oomd": "255.4-1ubuntu8.18",
+        "nftables": "1.0.9-1ubuntu0.1"
+      },
+      "browserPackages": {
+        "fonts-liberation": "1:2.1.5-3",
+        "libasound2t64": "1.2.11-1ubuntu0.3",
+        "libatk-bridge2.0-0t64": "2.52.0-1build1",
+        "libatk1.0-0t64": "2.52.0-1build1",
+        "libatspi2.0-0t64": "2.52.0-1build1",
+        "libcairo2": "1.18.0-3build1",
+        "libcups2t64": "2.4.7-1.2ubuntu7.14",
+        "libdbus-1-3": "1.14.10-4ubuntu4.1",
+        "libdrm2": "2.4.125-1ubuntu0.1~24.04.2",
+        "libgbm1": "25.2.8-0ubuntu0.24.04.4",
+        "libglib2.0-0t64": "2.80.0-6ubuntu3.10",
+        "libnspr4": "2:4.35-1.1build1",
+        "libnss3": "2:3.98-1ubuntu0.3",
+        "libpango-1.0-0": "1.52.1+ds-1build1",
+        "libx11-6": "2:1.8.7-1ubuntu0.1",
+        "libxcb1": "1.15-1ubuntu2",
+        "libxcomposite1": "1:0.4.5-1build3",
+        "libxdamage1": "1:1.1.6-1build1",
+        "libxext6": "2:1.3.4-1build2",
+        "libxfixes3": "1:6.0.0-2build1",
+        "libxkbcommon0": "1.6.0-1build1",
+        "libxrandr2": "2:1.5.2-2build1"
+      }
     }
   ],
-  "snapshot": "20261101T000000Z",
+  "snapshot": "20261108T000000Z",
   "packages": {
     "sudo": "1.9.17p2-1ubuntu3.2",
     "openssh-server": "1:10.2p1-2ubuntu3.8",
@@ -23,19 +70,81 @@
     "unzip": "6.0-29ubuntu1",
     "xz-utils": "5.8.3-1ubuntu0.1",
     "ansible-core": "2.20.1-1",
-    "systemd-oomd": "259.9-0ubuntu0.1"
+    "systemd-oomd": "259.9-0ubuntu0.1",
+    "nftables": "1.1.6-1"
   },
   "tailscale": {
     "version": "1.104.5",
     "keySha256": "3e03dacf222698c60b8e2f990b809ca1b3e104de127767864284e6c228f1fb39"
   },
   "aptLockTimeoutSeconds": 120,
-  "minimumFreeDiskMiB": 4096,
   "minimumFreeInodes": 10000,
   "t3RestartMaxDeferralHours": 24,
   "alwaysOnServices": ["ssh", "tailscaled", "docker", "beszel-agent"],
+  "features": {
+    "containers": {
+      "packages": ["docker.io", "docker-compose-v2", "docker-buildx"],
+      "services": ["docker"],
+      "groups": ["docker"],
+      "tools": ["docker-cli"]
+    },
+    "desktop": {
+      "packages": ["dconf-cli"]
+    }
+  },
+  "sizing": {
+    "minimumWorker": {
+      "memoryMiB": 3584,
+      "diskMiB": 20480,
+      "cpus": 2
+    },
+    "footprintMiB": {
+      "baseTools": 5120,
+      "checkouts": 1024,
+      "profiles": { "web": 256, "go": 1024, "rust": 2048, "jvm": 640 }
+    },
+    "agentSessionMiB": 1024,
+    "t3ReservedMiB": 1536,
+    "thresholds": {
+      "swapFile": {
+        "of": "memory",
+        "share": 0.5,
+        "minMiB": 1024,
+        "maxMiB": 8192
+      },
+      "minimumFreeDisk": {
+        "of": "disk",
+        "share": 0.05,
+        "minMiB": 2048,
+        "maxMiB": 4096
+      },
+      "diskGuardFloor": {
+        "of": "disk",
+        "share": 0.03,
+        "minMiB": 1024,
+        "maxMiB": 3072
+      },
+      "diskGcPressure": {
+        "of": "disk",
+        "share": 0.15,
+        "minMiB": 4096,
+        "maxMiB": 15360
+      },
+      "capacityWarn": {
+        "of": "disk",
+        "share": 0.1,
+        "minMiB": 3072,
+        "maxMiB": 10240
+      },
+      "capacityFail": {
+        "of": "disk",
+        "share": 0.02,
+        "minMiB": 1024,
+        "maxMiB": 2048
+      }
+    }
+  },
   "resourceSafety": {
-    "swapFileMiB": 8192,
     "userMemoryMax": "90%",
     "agentMemoryMax": "30%",
     "agentSwapMax": "2G",
@@ -44,11 +153,9 @@
     "tmpMaxSize": "25%",
     "tmpAge": "2d",
     "varTmpAge": "14d",
-    "diskGuardFloorMiB": 3072,
     "diskGuardWriteMiB": 32,
     "diskGuardIntervalSeconds": 5,
     "diskGcIdleDays": 7,
-    "diskGcPressureMiB": 15360,
     "diskGcPressureIdleHours": 12,
     "diskGcDockerAgeHours": 168,
     "diskGcPressureDockerAgeHours": 24,
@@ -72,6 +179,18 @@
     "failOffsetSeconds": 30
   },
   "rebootPendingFailDays": 14,
+  "exposure": {
+    "tailnetInterface": "tailscale0",
+    "tailscalePort": 41641,
+    "containerInterfaces": ["docker0", "br-*"],
+    "systemListeners": [
+      { "protocol": "udp", "port": 68 },
+      { "protocol": "udp", "port": 546 },
+      { "protocol": "udp", "port": 5353 },
+      { "protocol": "udp", "port": 5355 },
+      { "protocol": "tcp", "port": 5355 }
+    ]
+  },
   "dockerSmokeTest": {
     "image": "busybox:1.37.0@sha256:a7dbc319b1438115a207e11930dc4bb3e643dcb3ec0bdd694bb36cd8fad289ec",
     "timeoutSeconds": 60

package/ansible/ubuntu/reboot.yml

@@ -0,0 +1,89 @@
+---
+# One worker rebooted from the manager, only while its T3 runs no agent turn
+# (a reboot ends every running turn), then waited for until it answers again.
+# fleet-sync applies it for a worker's first converge, which nothing can be
+# running on yet, and for --maintenance-reboot, one worker at a time. After
+# it returns, fleet-sync converges the worker again to verify it is ready.
+# Variables: target (the SSH alias, or the declared tailnet name), login
+# (empty for the alias's own user), ssh_options (the SSH options every session
+# of the manager takes, src/ssh-connection.ts), home (the account's home
+# directory),
+# revision (the checkout whose t3-idle.py is asked), reason (first-converge
+# or maintenance) and force (reboot even while agent turns run).
+- name: Address the worker
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  tasks:
+    - name: Check the request
+      ansible.builtin.assert:
+        that:
+          - "target is match('^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$')"
+          - ssh_options is string and ssh_options is match('^-o ')
+          - "home is match('^/[A-Za-z0-9._/-]{1,4000}$')"
+          - "revision is match('^[a-f0-9]{40}$')"
+          - reason in ['first-converge', 'maintenance']
+    - name: Address the worker by its alias, with strict host keys
+      ansible.builtin.add_host:
+        name: '{{ target }}'
+        groups: [fleet_reboot]
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_args: -o ControlMaster=no -o ControlPath=none
+        ansible_ssh_common_args: '{{ ssh_options }}'
+        worker_home: '{{ home }}'
+        worker_revision: '{{ revision }}'
+        reboot_reason: '{{ reason }}'
+        reboot_force: '{{ force | default(false) | bool }}'
+      changed_when: false
+      when: login | default('') == ''
+    # A worker whose account fleet-sync created this run, over an alias that
+    # still logs in as root.
+    - name: Address the worker by its alias as the declared account
+      ansible.builtin.add_host:
+        name: '{{ target }}'
+        groups: [fleet_reboot]
+        ansible_python_interpreter: /usr/bin/python3
+        ansible_ssh_args: -o ControlMaster=no -o ControlPath=none
+        ansible_ssh_common_args: '{{ ssh_options }}'
+        ansible_user: '{{ login }}'
+        worker_home: '{{ home }}'
+        worker_revision: '{{ revision }}'
+        reboot_reason: '{{ reason }}'
+        reboot_force: '{{ force | default(false) | bool }}'
+      changed_when: false
+      when: login | default('') is match('^[a-z_][a-z0-9_-]{0,31}$')
+
+- name: Reboot the worker while it runs no agent turn
+  hosts: fleet_reboot
+  gather_facts: false
+  serial: 1
+  tasks:
+    - name: Find the state T3 records its runs in
+      ansible.builtin.stat:
+        path: '{{ worker_home }}/.t3/userdata/statev2.sqlite'
+      register: t3_state
+    - name: Ask T3 whether an agent turn is running
+      ansible.builtin.command:
+        argv:
+          - python3
+          - -I
+          - -B
+          - '{{ worker_home }}/.local/share/personal/fleet/revisions/{{ worker_revision }}/ansible/ubuntu/t3-idle.py'
+          - --state
+          - '{{ worker_home }}/.t3/userdata/statev2.sqlite'
+      register: t3_idle
+      changed_when: false
+      check_mode: false
+      failed_when: false
+      when: t3_state.stat.exists
+    # A worker that never ran T3 has no turn to end. One that cannot tell
+    # counts as busy: a reboot never ends a turn on a guess.
+    - name: Refuse while an agent turn runs
+      ansible.builtin.assert:
+        that: not t3_state.stat.exists or t3_idle.rc == 0 or reboot_force | bool
+        fail_msg: WORKER_REBOOT_BUSY; an agent turn is running on the worker, so it was not rebooted.
+    - name: Reboot, and wait for the worker to answer again
+      become: true
+      ansible.builtin.reboot:
+        msg: dev-fleet {{ reboot_reason }} reboot
+        reboot_timeout: 900

package/ansible/ubuntu/recovery.yml

@@ -7,11 +7,21 @@
   # fleet-repair re-applies this play alone for worker:service-recovery.
   tags: [recovery]
   tasks:
-    - name: Verify the desktop unit runs before adding any recovery trigger
+    # t3_unit is t3code-headless.service on a headless worker.
+    - name: Verify the T3 unit runs before adding any recovery trigger
       ansible.builtin.command:
-        argv: [systemctl, --user, is-active, t3code-desktop.service]
+        argv:
+          [
+            systemctl,
+            --user,
+            is-active,
+            "{{ t3_unit | default('t3code-desktop.service') }}",
+          ]
+      become: true
       become_user: '{{ development_user }}'
       environment:
         XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
       changed_when: false
-    - ansible.builtin.import_tasks: tasks/recovery.yml
+      check_mode: false
+    - name: Enable recovery
+      ansible.builtin.import_tasks: tasks/recovery.yml

package/ansible/ubuntu/t3/policy.json

@@ -1,6 +1,9 @@
 {
   "schemaVersion": 1,
   "organization": "Personal developer fleet",
+  "settings": {
+    "linkedEnvironmentsEnabled": { "value": true, "locked": true }
+  },
   "limits": {
     "updates": { "mode": "off", "allowNightly": true }
   }

package/ansible/ubuntu/t3-desktop.yml

@@ -52,6 +52,7 @@
         argv: [cat, '{{ t3_desktop_dir }}/.personal-fleet-version']
       register: t3_desktop_installed
       changed_when: false
+      check_mode: false
       failed_when: false
     - name: Check whether the desktop app is running before an update
       become: true
@@ -62,6 +63,7 @@
         argv: [systemctl, --user, is-active, --quiet, t3code-desktop.service]
       register: t3_desktop_was_active
       changed_when: false
+      check_mode: false
       failed_when: false
     - name: Unpack the pinned app when its version differs
       when: t3_desktop_installed.stdout | default('') != t3_desktop_name
@@ -193,7 +195,8 @@
           WantedBy=graphical-session.target
     # Repoint recovery now: a timer still running an older revision's script
     # would restart the headless server right after its approved migration.
-    - ansible.builtin.import_tasks: tasks/recovery.yml
+    - name: Repoint recovery to this revision
+      ansible.builtin.import_tasks: tasks/recovery.yml
     - name: Enable the desktop app for every graphical login
       become: true
       become_user: '{{ development_user }}'
@@ -204,6 +207,23 @@
         name: t3code-desktop.service
         daemon_reload: true
         enabled: true
+    # A worker that was a headless worker (t3-headless.yml) keeps its data in
+    # ~/.t3; only the server's user service goes.
+    - name: Stop the T3 server of a worker that was a headless worker
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-headless.service
+        state: stopped
+        enabled: false
+      failed_when: false
+    - name: Remove the T3 server's user service
+      ansible.builtin.file:
+        path: '{{ development_home }}/.config/systemd/user/t3code-headless.service'
+        state: absent
     # One T3 process per worker: the desktop app. The former headless server
     # (`t3 service install`) is retired; absent on machines that never had it.
     - name: Retire the former headless T3 server
@@ -233,7 +253,8 @@
     # just installed, only while it runs no agent turn. Otherwise
     # personal-worker-recovery restarts it at the first idle check, and
     # t3:running-version reports T3_RESTART_PENDING until then.
-    - ansible.builtin.import_tasks: tasks/t3-restart.yml
+    - name: Restart T3 when it is idle
+      ansible.builtin.import_tasks: tasks/t3-restart.yml
       when:
         - t3_desktop_was_active.rc == 0
         - t3_desktop_updated is changed

package/ansible/ubuntu/t3-headless.yml

@@ -0,0 +1,128 @@
+---
+# The worker's only T3 process on a headless worker (fleet.json
+# features.session "headless"): the pinned native T3 server, which the release
+# ships as its own archive beside the desktop package (mise.toml t3_version
+# and t3_linux_*_sha256; bootstrap/native-t3.ts installs it in every worker's
+# toolchain). `t3 serve` runs the same server the desktop app embeds, with no
+# browser, display or GPU. It is a lingering user service: the designated user
+# lingers (tasks/user.yml), so its user manager starts it at boot with nobody
+# logged in. It listens on 127.0.0.1:3773 like the desktop app, so the private
+# route, the policy, the provider instances, the recovery timer and the checks
+# are the same for both session types. ~/.t3 is kept when a worker changes
+# type. Starting or migrating is left to fleet-sync.
+- name: Run the pinned T3 server as a lingering user service
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  vars_files:
+    - policy.json
+  tasks:
+    - name: Require the pinned server from the worker's toolchain
+      ansible.builtin.stat:
+        path: '{{ t3_server_path }}'
+      register: t3_server_binary
+    - name: Refuse to declare a service for a server that is not installed
+      ansible.builtin.assert:
+        that:
+          - t3_server_binary.stat.exists
+          - t3_server_binary.stat.executable
+        fail_msg: T3_SERVER_INSTALL_FAILED; the pinned T3 server is not installed. Run fleet-sync, which installs the toolchain first.
+    - name: Check whether the server is running before an update
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.command:
+        argv: [systemctl, --user, is-active, --quiet, t3code-headless.service]
+      register: t3_headless_was_active
+      changed_when: false
+      check_mode: false
+      failed_when: false
+    # One T3 process per worker: a worker that was a desktop worker keeps its
+    # data in ~/.t3; only the app's session service goes.
+    - name: Stop the desktop app of a worker that was a desktop worker
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-desktop.service
+        state: stopped
+        enabled: false
+      failed_when: false
+    - name: Remove the desktop app's session service
+      ansible.builtin.file:
+        path: '{{ development_home }}/.config/systemd/user/t3code-desktop.service'
+        state: absent
+    - name: Create the user unit directory
+      ansible.builtin.file:
+        path: '{{ development_home }}/.config/systemd/user'
+        state: directory
+        owner: '{{ development_user }}'
+        mode: '0700'
+    - name: Declare the T3 server as a lingering user service
+      ansible.builtin.copy:
+        dest: '{{ development_home }}/.config/systemd/user/t3code-headless.service'
+        owner: '{{ development_user }}'
+        mode: '0600'
+        content: |
+          # Managed by personal fleet-sync: ansible/ubuntu/t3-headless.yml
+          [Unit]
+          Description=T3 Code server (headless)
+          StartLimitIntervalSec=300
+          StartLimitBurst=5
+          [Service]
+          Type=simple
+          WorkingDirectory=%h
+          Environment=T3CODE_HOME=%h/.t3
+          # /tmp is RAM with a per-user quota that agent and build caches
+          # exhaust; agents use disk-backed /var/tmp (aged by tasks/resources.yml).
+          Environment=TMPDIR=/var/tmp
+          ExecStart="{{ t3_server_path }}" serve --mode web --host 127.0.0.1 --port 3773 --base-dir %h/.t3 --no-browser
+          KillMode=mixed
+          Restart=always
+          RestartSec=5
+          CPUWeight=1000
+          IOWeight=1000
+          MemoryLow={{ sizing.t3ReservedMiB }}M
+          OOMScoreAdjust=100
+          ManagedOOMPreference=avoid
+          [Install]
+          WantedBy=default.target
+      register: t3_headless_unit
+    # Repoint recovery now: a timer still running an older revision's script
+    # would act on the unit of the other session type.
+    - name: Repoint recovery to this revision
+      ansible.builtin.import_tasks: tasks/recovery.yml
+    - name: Enable the T3 server for every boot, with nobody logged in
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-headless.service
+        daemon_reload: true
+        enabled: true
+    - name: Start the T3 server without restarting a running one
+      become: true
+      become_user: '{{ development_user }}'
+      environment:
+        XDG_RUNTIME_DIR: '/run/user/{{ development_uid }}'
+      ansible.builtin.systemd_service:
+        scope: user
+        name: t3code-headless.service
+        state: started
+    # A running server keeps the files of its release: restart it into the
+    # one just declared, only while it runs no agent turn (as the desktop
+    # app). Otherwise personal-worker-recovery restarts it at the first idle
+    # check, and t3:running-version reports T3_RESTART_PENDING until then.
+    - name: Restart T3 when it is idle
+      ansible.builtin.import_tasks: tasks/t3-restart.yml
+      vars:
+        t3_unit: t3code-headless.service
+      when:
+        - t3_headless_was_active.rc == 0
+        - t3_headless_unit is changed

package/ansible/ubuntu/t3-health.sh

@@ -1,12 +1,16 @@
 #!/bin/sh
-# Keep the worker T3 desktop app (UI and server) up, responsive and on the
-# installed release. Run every minute by personal-worker-recovery.timer
-# (managed by fleet-sync, tasks/recovery.yml), from the stable copy the role
-# installs beside t3-idle.py.
-# - The former headless server is stopped and disabled: one T3 per worker.
-# - No graphical session: T3_NO_GRAPHICAL_SESSION; after three checks in a row
-#   the display manager is restarted so auto-login starts one, three times at
-#   most until a session is seen again.
+# Keep the worker's T3 up, responsive and on the installed release: the
+# desktop app (UI and server) on a desktop worker, the native server
+# (t3code-headless.service, t3-headless.yml) on a headless one. Run every
+# minute by personal-worker-recovery.timer (managed by fleet-sync,
+# tasks/recovery.yml), from the stable copy the role installs beside
+# t3-idle.py.
+# - The former upstream server unit (t3code.service) is stopped and
+#   disabled: one T3 per worker.
+# - Desktop only. No graphical session: T3_NO_GRAPHICAL_SESSION; after three
+#   checks in a row the display manager is restarted so auto-login starts
+#   one, three times at most until a session is seen again. A headless
+#   worker has no session to wait for.
 # - Stopped or failed: reset its start limit and start it.
 # - Running but its local API has not answered for three checks in a row:
 #   restart it, since a hung server serves no turns.
@@ -15,6 +19,11 @@
 set -u
 url=http://127.0.0.1:3773/.well-known/t3/environment
 unit=t3code-desktop.service
+headless=
+if systemctl --user is-enabled --quiet t3code-headless.service; then
+  unit=t3code-headless.service
+  headless=1
+fi
 runtime="${XDG_RUNTIME_DIR:?}"
 failures="$runtime/personal-t3-health-failures"
 no_session="$runtime/personal-t3-no-session"
@@ -40,7 +49,7 @@ if systemctl --user is-active --quiet t3code.service ||
   fi
 fi
 
-if ! systemctl --user is-active --quiet graphical-session.target; then
+if [ -z "$headless" ] && ! systemctl --user is-active --quiet graphical-session.target; then
   rm -f "$failures"
   seen=$(count "$no_session")
   echo "T3_NO_GRAPHICAL_SESSION ($seen/$limit)."
@@ -78,7 +87,12 @@ fi
 rm -f "$failures"
 
 running=$(printf '%s' "$environment" | sed -n 's/.*"serverVersion" *: *"\([^"]*\)".*/\1/p')
-release=$(sed -n 's/^T3-Code-\(.*\)-[a-z0-9]*\.deb$/\1/p' "$installed" 2>/dev/null)
+if [ -n "$headless" ]; then
+  # The release is the versioned directory the unit runs the server from.
+  release=$(systemctl --user show --property=ExecStart --value "$unit" | sed -n 's|.*/t3-\([^/ ]*\)-linux-[a-z0-9]*/t3 .*|\1|p' | head -n 1)
+else
+  release=$(sed -n 's/^T3-Code-\(.*\)-[a-z0-9]*\.deb$/\1/p' "$installed" 2>/dev/null)
+fi
 reason=
 [ -f "$pending" ] && reason="the staged policy"
 if [ -n "$release" ] && [ "$running" != "$release" ]; then

package/ansible/ubuntu/t3-idle.py

@@ -5,17 +5,29 @@ T3 offers no command that lists the running turns of every project, so this
 reads the runs T3 records in its own state database, read-only. Anything it
 cannot read counts as busy: a restart never ends a turn on a guess.
 
-Usage: t3-idle.py --state ~/.t3/userdata/statev2.sqlite
+With --activity it prints one JSON line for fleet-status instead and exits 0:
+how many agent turns are under way and when the last one was requested or
+ended. Only the status and the times of a run are read, never its content.
+
+Usage: t3-idle.py --state ~/.t3/userdata/statev2.sqlite [--activity]
 """
 import argparse
+import json
 import sqlite3
 import sys
 
 IDLE, BUSY, UNKNOWN = 0, 1, 2
 
+# The statuses of a turn that has not ended yet.
+UNDER_WAY = ('queued', 'preparing', 'starting', 'running', 'waiting')
+
+
+def connect(state):
+    return sqlite3.connect(f'file:{state}?mode=ro', uri=True, timeout=5)
+
 
 def running_turns(state):
-    connection = sqlite3.connect(f'file:{state}?mode=ro', uri=True, timeout=5)
+    connection = connect(state)
     try:
         (count,) = connection.execute(
             "SELECT count(*) FROM orchestration_v2_projection_runs WHERE status = 'running'"
@@ -25,10 +37,33 @@ def running_turns(state):
         connection.close()
 
 
+def activity(state):
+    connection = connect(state)
+    try:
+        marks = ','.join('?' for _ in UNDER_WAY)
+        (under_way,) = connection.execute(
+            f'SELECT count(*) FROM orchestration_v2_projection_runs WHERE status IN ({marks})',
+            UNDER_WAY,
+        ).fetchone()
+        (last,) = connection.execute(
+            'SELECT max(coalesce(completed_at, requested_at)) FROM orchestration_v2_projection_runs'
+        ).fetchone()
+        return {'version': 1, 'running': under_way, 'lastActivity': last}
+    finally:
+        connection.close()
+
+
 def main():
     parser = argparse.ArgumentParser()
     parser.add_argument('--state', required=True)
+    parser.add_argument('--activity', action='store_true')
     args = parser.parse_args()
+    if args.activity:
+        try:
+            print(json.dumps(activity(args.state)))
+        except sqlite3.Error:
+            print(json.dumps({'version': 1, 'unknown': True}))
+        return 0
     try:
         count = running_turns(args.state)
     except sqlite3.Error:

package/ansible/ubuntu/t3-policy.yml

@@ -53,6 +53,7 @@
         argv: [systemctl, --user, is-active, --quiet, t3code-desktop.service]
       register: t3_desktop_active
       changed_when: false
+      check_mode: false
       failed_when: false
     - name: Ask the running T3 which policy it loaded
       become: true
@@ -61,9 +62,11 @@
         argv: ['{{ t3_executable }}', policy, show]
       register: t3_policy_loaded
       changed_when: false
+      check_mode: false
       failed_when: false
       when: t3_desktop_active.rc == 0
-    - ansible.builtin.import_tasks: tasks/t3-restart.yml
+    - name: Restart T3 when it is idle
+      ansible.builtin.import_tasks: tasks/t3-restart.yml
       when:
         - t3_desktop_active.rc == 0
         - t3_policy_loaded.stdout is not search('loaded this policy\.\s*$')

package/ansible/ubuntu/t3-route.yml

@@ -17,6 +17,7 @@
         argv: [tailscale, serve, status, --json]
       register: t3_serve_status
       changed_when: false
+      check_mode: false
     - name: Publish T3 on tailnet HTTPS port 443
       ansible.builtin.command:
         argv: [tailscale, serve, --bg, --https=443, '{{ t3_route_target }}']