@crvouga/dev-fleet 0.8.0 → 0.9.1

package/ansible/macos/manager.yml

@@ -1,11 +1,17 @@
 ---
+# The manager's own policy, applied by fleet-sync on every applying run:
+# check mode first, then for real, with a receipt (macos-manager) that a full
+# re-apply replaces at least once a day. It never asks for a password and no
+# play becomes root: what needs root runs through the narrow grant
+# manager-privilege.yml installs once (with the T3 policy and the log
+# rotation), and without the grant it is skipped here and reported by its
+# check.
+#
 # Manager power policy. Workers depend on the manager's singleton services
 # (CLI proxy, Beszel hub), so the manager never sleeps on AC power and starts
 # again by itself when power returns (autorestart). Sleep on battery is left
 # to the human. The settings are the `pmset` object in policy.json; fleet-sync
-# measures the same object as manager:power and applies this playbook on every
-# run, without a prompt, because `pmset -c` runs through the narrow grant
-# manager-privilege.yml installs once.
+# measures the same object as manager:power.
 - name: Keep the fleet manager awake on AC power
   hosts: localhost
   connection: local
@@ -17,7 +23,32 @@
       ansible.builtin.command:
         argv: [/usr/bin/pmset, -g, custom]
       changed_when: false
+      check_mode: false
       register: pmset_custom
+    # Lists, never runs: whether `pmset -c` may run without a password.
+    - name: Inspect the manager's power grant
+      ansible.builtin.command:
+        argv: [/usr/bin/sudo, -n, -l, /usr/bin/pmset, -c, sleep, '0']
+      changed_when: false
+      check_mode: false
+      failed_when: false
+      register: pmset_grant
+    - name: Report that the power settings wait for the grant
+      ansible.builtin.debug:
+        msg: 'The power grant is not in place; manager:power says how to give it once.'
+      when: pmset_grant.rc != 0
+    # pmset accepts a setting this Mac does not have and keeps nothing (a
+    # virtual Mac has no Wake-on-LAN, so no womp): applying it again on every
+    # run would never converge. It is reported instead of applied.
+    - name: Report the declared AC power settings this Mac does not have
+      ansible.builtin.debug:
+        msg: 'pmset on this Mac has no AC setting {{ item.key }}; it is not applied.'
+      loop: '{{ pmset | dict2items }}'
+      loop_control:
+        label: '{{ item.key }}'
+      vars:
+        ac_section: "{{ pmset_custom.stdout.split('AC Power:') | last }}"
+      when: ac_section is not search('^\\s*' ~ item.key ~ '\\s', multiline=True)
     - name: Apply the declared AC power settings
       ansible.builtin.command:
         argv:
@@ -35,7 +66,9 @@
       vars:
         ac_section: "{{ pmset_custom.stdout.split('AC Power:') | last }}"
         observed: "{{ ac_section | regex_findall('^\\s*' ~ item.key ~ '\\s+(\\S+)', multiline=True) | first | default('') }}"
-      when: observed != item.value
+      when:
+        - pmset_grant.rc == 0
+        - observed not in ['', item.value]
       changed_when: true
 
 # Docker Desktop hosts the CLI proxy and the monitoring hub, so it starts at
@@ -72,7 +105,121 @@
       # Docker Desktop writes the file the first time it runs.
       when:
         - docker_settings_file.stat.exists
-        - (current[dockerDesktop.key] | default(false)) != true
+        - not (current[dockerDesktop.key] | default(false) | bool)
+
+# fleet-watch compares the fleet's health with its last run, notifies on a
+# change and stores the heartbeat the off-machine workflow
+# (.github/workflows/fleet-heartbeat.yml) reads. It runs from the checkout
+# fleet-sync last applied (fleet/current) with that checkout's locked Bun, on
+# the interval `manager.schedule.watchMinutes` in fleet.json sets
+# (fleet_watch_minutes), or else policy.json's. manager:watch measures it.
+- name: Watch the fleet on a schedule
+  hosts: localhost
+  connection: local
+  become: false
+  gather_facts: true
+  gather_subset: ['!all']
+  vars_files:
+    - policy.json
+  vars:
+    watch_home: '{{ ansible_facts.env.HOME }}'
+    watch_label: '{{ fleetWatch.label }}'
+    watch_minutes: '{{ fleet_watch_minutes | default(fleetWatch.intervalMinutes) | int }}'
+    watch_logs: '{{ watch_home }}/{{ jobLogs.directory }}'
+    watch_plist: '{{ watch_home }}/Library/LaunchAgents/{{ watch_label }}.plist'
+    watch_domain: 'gui/{{ ansible_facts.user_uid }}'
+  tasks:
+    - name: Require an interval the schema allows
+      ansible.builtin.assert:
+        that:
+          - watch_minutes | int >= 5
+          - watch_minutes | int <= 1440
+        fail_msg: MANAGER_WATCH_INTERVAL_INVALID; manager.schedule.watchMinutes is from 5 to 1440.
+    - name: Create the directories of the watch job
+      ansible.builtin.file:
+        path: '{{ item }}'
+        state: directory
+        mode: '0700'
+      loop:
+        - '{{ watch_logs }}'
+        - '{{ watch_home }}/Library/LaunchAgents'
+    - name: Install the fleet-watch launch agent
+      ansible.builtin.copy:
+        dest: '{{ watch_plist }}'
+        mode: '0644'
+        content: |
+          <?xml version="1.0" encoding="UTF-8"?>
+          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+          <!-- Managed by dev-fleet: fleet-watch -->
+          <plist version="1.0"><dict>
+            <key>Label</key><string>{{ watch_label }}</string>
+            <key>ProgramArguments</key><array>
+              <string>{{ watch_home }}/.local/bin/mise</string>
+              <string>exec</string>
+              <string>--locked</string>
+              <string>bun</string>
+              <string>--</string>
+              <string>bun</string>
+              <string>src/cli/cli.ts</string>
+              <string>fleet-watch</string>
+              <string>--json</string>
+            </array>
+            <key>WorkingDirectory</key><string>{{ watch_home }}/.local/share/personal/fleet/current</string>
+            <key>EnvironmentVariables</key><dict>
+              <key>PATH</key><string>{{ watch_home }}/.local/share/mise/shims:{{ watch_home }}/.local/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+              <key>DEVFLEET_TRIGGER</key><string>watch</string>
+            </dict>
+            <key>StartInterval</key><integer>{{ watch_minutes | int * 60 }}</integer>
+            <key>ProcessType</key><string>Background</string>
+            <key>LowPriorityIO</key><true/>
+            <key>Nice</key><integer>10</integer>
+            <key>Umask</key><integer>63</integer>
+            <key>StandardOutPath</key><string>{{ watch_logs }}/{{ watch_label }}.out.log</string>
+            <key>StandardErrorPath</key><string>{{ watch_logs }}/{{ watch_label }}.err.log</string>
+          </dict></plist>
+      register: watch_agent
+    - name: Inspect whether the watch job is loaded
+      ansible.builtin.command:
+        argv: [/bin/launchctl, print, '{{ watch_domain }}/{{ watch_label }}']
+      changed_when: false
+      check_mode: false
+      failed_when: false
+      register: watch_loaded
+    # launchd caches a loaded definition: a changed plist needs a reload.
+    - name: Unload a stale watch job definition
+      ansible.builtin.command:
+        argv: [/bin/launchctl, bootout, '{{ watch_domain }}/{{ watch_label }}']
+      when: watch_agent.changed and watch_loaded.rc == 0
+      failed_when: false
+      changed_when: true
+    - name: Load the watch job
+      ansible.builtin.command:
+        argv:
+          [/bin/launchctl, bootstrap, '{{ watch_domain }}', '{{ watch_plist }}']
+      when: watch_agent.changed or watch_loaded.rc != 0
+      changed_when: true
 
-- name: Stage the fleet's T3 policy
-  ansible.builtin.import_playbook: t3-policy.yml
+# A skewed clock breaks TLS, token validation and Vault logins with errors
+# that never mention time, and every worker's offset is measured against the
+# manager's. macOS keeps its own time service; this asserts it is on.
+# Reading it needs root, through the grant manager-privilege.yml installs;
+# without the grant it is not asserted here, and manager:clock says so.
+- name: Keep the manager's clock on network time
+  hosts: localhost
+  connection: local
+  become: false
+  gather_facts: false
+  tasks:
+    - name: Read whether network time is on
+      ansible.builtin.command:
+        argv: [/usr/bin/sudo, -n, /usr/sbin/systemsetup, -getusingnetworktime]
+      changed_when: false
+      check_mode: false
+      failed_when: false
+      register: network_time
+    - name: Require network time
+      ansible.builtin.assert:
+        that:
+          - "network_time.stdout is search('Network Time:\\s*On')"
+        fail_msg: MANAGER_CLOCK_NOT_SYNCHRONISED; turn on Set time and date automatically in System Settings > General > Date & Time.
+      when: network_time.rc == 0

package/ansible/macos/policy.json

@@ -21,5 +21,18 @@
   "dockerDesktop": {
     "settings": "Library/Group Containers/group.com.docker/settings-store.json",
     "key": "AutoStart"
+  },
+  "fleetSync": {
+    "label": "personal-fleet-sync",
+    "intervalMinutes": 30
+  },
+  "fleetWatch": {
+    "label": "dev.devfleet.fleet-watch",
+    "intervalMinutes": 15
+  },
+  "jobLogs": {
+    "directory": ".local/share/personal/fleet/manager/logs",
+    "maxKiB": 1024,
+    "keep": 3
   }
 }

package/ansible/macos/t3-policy.yml

@@ -1,10 +1,12 @@
 ---
 # T3 Code on the manager reads the same administrator policy as on every
-# worker (ansible/ubuntu/t3/policy.json): updates off, so the manager's T3
-# changes only when the fleet's pin does. Provider instances are reconciled
+# worker (ansible/ubuntu/t3/policy.json): linked environments on, so the
+# manager pairs with a replaced worker's T3 by itself, and updates off, so
+# the manager's T3 changes only when the fleet's pin does. Provider instances are reconciled
 # by fleet-sync on every run and stay unlocked here: locking them needs an
 # administrator for each change of the account roster. fleet-sync measures
-# the result as t3:updates. Needs an administrator: ansible-playbook -K manager.yml
+# the result as t3:updates. Needs an administrator, once, through
+# manager-privilege.yml: ansible-playbook -K manager-privilege.yml -e user=$(id -un)
 - name: Stage the fleet's T3 policy on the manager
   hosts: localhost
   connection: local

package/ansible/macos/vault-renew.yml

@@ -0,0 +1,85 @@
+---
+# The manager's own Vault session renews itself, as every worker's does
+# (personal-worker-auth): without it the session lapses while nobody runs
+# fleet-sync, and the manager can no longer read the secrets its services and
+# its agents use. The job only renews; a lapsed session needs one login by a
+# person. Measured as manager:vault-renewal. fleet-sync passes vault_address
+# (the fleet configuration's secrets block) and mise (its absolute path).
+- name: Keep the manager's Vault session renewed
+  hosts: localhost
+  connection: local
+  become: false
+  gather_facts: true
+  vars:
+    renew_label: dev.devfleet.vault-renew
+    renew_plist: '{{ ansible_facts.env.HOME }}/Library/LaunchAgents/{{ renew_label }}.plist'
+    renew_domain: 'gui/{{ ansible_facts.user_uid }}'
+  tasks:
+    - name: Require the macOS manager and an HTTPS Vault
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.os_family == 'Darwin'
+          - vault_address is match('^https://[A-Za-z0-9.-]+$')
+          - mise is match('^/')
+        fail_msg: VAULT_RENEWAL_NOT_MANAGER; the renewal job is for the macOS manager's own session.
+    - name: Create the launch agents directory
+      ansible.builtin.file:
+        path: '{{ ansible_facts.env.HOME }}/Library/LaunchAgents'
+        state: directory
+        mode: '0700'
+    # Every ten minutes, like the workers, and at load: a renewal never
+    # outlives the token, so a missed run only shortens the margin. Output is
+    # dropped (the lease, or why it failed): manager:vault-renewal measures the
+    # session itself.
+    - name: Install the renewal job's launch agent
+      ansible.builtin.copy:
+        dest: '{{ renew_plist }}'
+        mode: '0644'
+        content: |
+          <?xml version="1.0" encoding="UTF-8"?>
+          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+          <!-- Managed by personal Fleet: Vault session renewal -->
+          <plist version="1.0"><dict>
+            <key>Label</key><string>{{ renew_label }}</string>
+            <key>ProgramArguments</key><array>
+              <string>{{ mise }}</string>
+              <string>exec</string>
+              <string>--</string>
+              <string>vault</string>
+              <string>token</string>
+              <string>renew</string>
+              <string>-address={{ vault_address }}</string>
+              <string>-increment=24h</string>
+            </array>
+            <key>WorkingDirectory</key><string>{{ ansible_facts.env.HOME }}</string>
+            <key>EnvironmentVariables</key><dict>
+              <key>PATH</key><string>{{ mise | dirname }}:/usr/local/bin:/usr/bin:/bin</string>
+            </dict>
+            <key>RunAtLoad</key><true/>
+            <key>StartInterval</key><integer>600</integer>
+            <key>ProcessType</key><string>Background</string>
+            <key>Umask</key><integer>63</integer>
+            <key>StandardOutPath</key><string>/dev/null</string>
+            <key>StandardErrorPath</key><string>/dev/null</string>
+          </dict></plist>
+      register: renew_agent
+    - name: Inspect whether the renewal job is loaded
+      ansible.builtin.command:
+        argv: [/bin/launchctl, print, '{{ renew_domain }}/{{ renew_label }}']
+      changed_when: false
+      check_mode: false
+      failed_when: false
+      register: renew_loaded
+    # launchd caches a loaded definition: a changed plist needs a reload.
+    - name: Unload a stale renewal job definition
+      ansible.builtin.command:
+        argv: [/bin/launchctl, bootout, '{{ renew_domain }}/{{ renew_label }}']
+      when: renew_agent.changed and renew_loaded.rc == 0
+      failed_when: false
+      changed_when: true
+    - name: Load the renewal job
+      ansible.builtin.command:
+        argv:
+          [/bin/launchctl, bootstrap, '{{ renew_domain }}', '{{ renew_plist }}']
+      when: renew_agent.changed or renew_loaded.rc != 0
+      changed_when: true

package/ansible/monitoring/agent-darwin.yml

@@ -137,6 +137,7 @@
       ansible.builtin.command:
         argv: [/bin/launchctl, print, '{{ beszel_domain }}/{{ beszelDaemon }}']
       changed_when: false
+      check_mode: false
       failed_when: false
       register: agent_loaded
     - name: Load the agent at login and now
@@ -156,6 +157,8 @@
       ansible.builtin.command:
         argv: [/bin/launchctl, print, '{{ beszel_domain }}/{{ beszelDaemon }}']
       changed_when: false
+      # Verifies a change a dry run does not make.
+      when: not ansible_check_mode
       register: agent_state
       retries: 5
       delay: 2

package/ansible/monitoring/agent.yml

@@ -166,6 +166,8 @@
       ansible.builtin.command:
         argv: [systemctl, is-active, beszel-agent.service]
       changed_when: false
+      # Verifies a change a dry run does not make.
+      when: not ansible_check_mode
   handlers:
     - name: Restart agent
       ansible.builtin.systemd_service:

package/ansible/monitoring/hub-darwin.yml

@@ -39,6 +39,7 @@
       ansible.builtin.command:
         argv: [docker, compose, version]
       changed_when: false
+      check_mode: false
     - name: Inspect an existing hub image before any upgrade
       ansible.builtin.command:
         argv:
@@ -50,6 +51,7 @@
             personal-beszel-hub-1,
           ]
       changed_when: false
+      check_mode: false
       failed_when: false
       register: existing_hub
     - name: Require explicit maintenance for a different existing image
@@ -221,6 +223,7 @@
         argv:
           [/bin/launchctl, print, '{{ watchdog_domain }}/{{ watchdog_label }}']
       changed_when: false
+      check_mode: false
       failed_when: false
       register: watchdog_loaded
     # launchd caches a loaded definition: a changed plist needs a reload.

package/ansible/monitoring/hub-route-darwin.yml

@@ -29,6 +29,7 @@
         argv: ['{{ beszel_tailscale_cli }}', serve, status, --json]
       register: beszel_serve_status
       changed_when: false
+      check_mode: false
     - name: Publish the hub on the tailnet HTTPS port as the signed-in user
       ansible.builtin.command:
         argv: '{{ beszel_serve }}'

package/ansible/net/remote-probe.sh

@@ -12,7 +12,10 @@ else
   df -Pi "$HOME" | awk 'NR==2 && $2>0{print "inodefree=" int($4*100/$2)}'
   # Clock synchronisation, as systemd sees it: 1 or 0.
   timedatectl show -p NTPSynchronized -p NTP 2>/dev/null | awk -F= '{v=($2=="yes")?1:0} $1=="NTP"{print "ntp=" v} $1=="NTPSynchronized"{print "ntpsync=" v}'
-  awk '/MemTotal/{t=$2} /MemAvailable/{a=$2} /SwapTotal/{st=$2} /SwapFree/{sf=$2} END{print "memfree=" int(a*100/t); if (st>0) print "swap=" int((st-sf)*100/st); else print "swap=0"}' /proc/meminfo
+  # Agent sessions running now: the scopes T3 starts its agents in.
+  echo "agentsessions=$(systemctl --user list-units --type=scope --state=active --no-legend 't3code-*.scope' 2>/dev/null | grep -c .)"
+  awk '/MemTotal/{t=$2} /MemAvailable/{a=$2} /SwapTotal/{st=$2} /SwapFree/{sf=$2} END{print "memfree=" int(a*100/t); print "memtotalmb=" int(t/1024); if (st>0) print "swap=" int((st-sf)*100/st); else print "swap=0"}' /proc/meminfo
 fi
 echo "diskmb=$(df -Pk "$HOME" | awk 'NR==2{print int($4/1024)}')"
+echo "disktotalmb=$(df -Pk "$HOME" | awk 'NR==2{print int($2/1024)}')"
 echo "epoch=$(date +%s)"

package/ansible/platforms.json

@@ -31,7 +31,7 @@
       "versions": "any",
       "architectures": "any",
       "status": "refused",
-      "note": "UBUNTU_BASELINE_MISMATCH"
+      "note": "UBUNTU_BASELINE_MISMATCH; not yet supported (see below)."
     },
     {
       "role": "worker",
@@ -39,7 +39,7 @@
       "versions": "any",
       "architectures": "any",
       "status": "refused",
-      "note": "The fleet configuration accepts only Linux workers."
+      "note": "The fleet configuration accepts only Linux workers; not yet supported (see below)."
     },
     {
       "role": "worker",

package/ansible/pyproject.toml

@@ -10,3 +10,8 @@ dependencies = ["ansible-core==2.19.9"]
 
 [tool.uv]
 package = false
+
+# The linter CI runs on every playbook (`uv run --locked --group lint
+# ansible-lint`). A separate group: the manager never installs it.
+[dependency-groups]
+lint = ["ansible-lint==26.11.0"]

package/ansible/ubuntu/baseline.yml

@@ -7,8 +7,13 @@
   vars_files:
     - policy.json
   pre_tasks:
-    - ansible.builtin.import_tasks: tasks/release.yml
+    - name: Require a supported Ubuntu release
+      ansible.builtin.import_tasks: tasks/release.yml
       tags: [always]
+    - name: Require the minimum worker size and size the disk and memory lines
+      ansible.builtin.import_tasks: tasks/sizing.yml
+    - name: Leave out what the features this worker lacks would install
+      ansible.builtin.import_tasks: tasks/features.yml
     - name: Require an explicit non-root user
       ansible.builtin.assert:
         that:
@@ -27,10 +32,12 @@
           - ansible_facts.getent_passwd[development_user][1] | int == development_uid | int
           - ansible_facts.getent_passwd[development_user][4] == development_home
       tags: [always]
-    - ansible.builtin.import_tasks: tasks/dpkg.yml
+    - name: Recover or refuse a broken package database
+      ansible.builtin.import_tasks: tasks/dpkg.yml
     # Memory and disk safety must land even when the disk is nearly full.
     # fleet-repair re-applies them alone (--tags disk) for worker:capacity:*.
-    - ansible.builtin.import_tasks: tasks/resources.yml
+    - name: Apply memory and disk safety
+      ansible.builtin.import_tasks: tasks/resources.yml
       tags: [disk]
     - name: Inspect capacity before package and service changes
       ansible.builtin.command:
@@ -43,11 +50,12 @@
       environment:
         FLEET_HOME: '{{ development_home }}'
       changed_when: false
+      check_mode: false
       register: capacity
     - name: Preserve management capacity instead of installing into an exhausted disk
       ansible.builtin.assert:
         that:
-          - item.freeMiB >= minimumFreeDiskMiB
+          - item.freeMiB >= worker_minimum_free_disk_mib | int
           - item.freeInodes >= minimumFreeInodes
         fail_msg: RESOURCE_CAPACITY_REQUIRED; inspect disk space and inodes on the reported filesystem. Preserve developer work; the disk GC removes only build output and caches, so what remains needs a person.
       loop: '{{ capacity.stdout | from_json }}'
@@ -58,18 +66,36 @@
       ansible.builtin.assert:
         that: "'docker-ce' not in ansible_facts.packages and 'containerd.io' not in ansible_facts.packages"
         fail_msg: DOCKER_OWNER_CONFLICT; migrate the existing Docker owner explicitly before applying the Ubuntu-native baseline.
+      when: worker_containers_on | bool
     - name: Inspect existing service ownership
       ansible.builtin.service_facts:
   tasks:
-    - ansible.builtin.import_tasks: tasks/packages.yml
-    - ansible.builtin.import_tasks: tasks/docker.yml
-    - ansible.builtin.import_tasks: tasks/browser.yml
+    - name: Install the pinned packages
+      ansible.builtin.import_tasks: tasks/packages.yml
+    - name: Configure Docker
+      ansible.builtin.import_tasks: tasks/docker.yml
+      when: worker_containers_on | bool
+    - name: Remove what dev-fleet installed for containers
+      ansible.builtin.import_tasks: tasks/containers-off.yml
+      when: not worker_containers_on | bool
+    - name: Install the browser for web workers
+      ansible.builtin.import_tasks: tasks/browser.yml
       when: "'web' in worker_tool_profiles | default([])"
-    - ansible.builtin.import_tasks: tasks/services.yml
-    - ansible.builtin.import_tasks: tasks/power.yml
-    - ansible.builtin.import_tasks: tasks/user.yml
-    - ansible.builtin.import_tasks: tasks/ssh.yml
-    - ansible.builtin.import_tasks: tasks/credentials.yml
+    - name: Keep the always-on services running
+      ansible.builtin.import_tasks: tasks/services.yml
+    - name: Apply the power policy
+      ansible.builtin.import_tasks: tasks/power.yml
+    - name: Configure the development user
+      ansible.builtin.import_tasks: tasks/user.yml
+    - name: Configure SSH
+      ansible.builtin.import_tasks: tasks/ssh.yml
+    # A container's network belongs to its host, which owns the firewall.
+    - name: Admit inbound traffic only over loopback and the tailnet
+      ansible.builtin.import_tasks: tasks/firewall.yml
+      when: ansible_facts.virtualization_type not in ['docker', 'container', 'podman', 'lxc', 'systemd-nspawn']
+    - name: Install the credential helpers
+      ansible.builtin.import_tasks: tasks/credentials.yml
       when: development_source is defined
-    - ansible.builtin.import_tasks: tasks/github.yml
+    - name: Sign the worker in to GitHub
+      ansible.builtin.import_tasks: tasks/github.yml
       when: development_source is defined

package/ansible/ubuntu/disk-gc.py

@@ -32,7 +32,7 @@ the last one says how many MiB were reclaimed.
 
 Usage: disk-gc.py --home H [--path P ...] [--idle-days N] [--pressure-mib N]
                   [--pressure-inode-percent N] [--pressure-idle-hours N] [--docker-age-hours N]
-                  [--pressure-docker-age-hours N] [--pressure-cache DIR ...]
+                  [--pressure-docker-age-hours N] [--no-docker] [--pressure-cache DIR ...]
                   [--worktree-root DIR ...] [--worktree-idle-days N]
                   [--cache-cap DIR=MIB ...] [--keep-newest DIR=N ...]
                   [--mise PATH] [--user NAME]
@@ -476,6 +476,9 @@ def main(argv):
     parser.add_argument('--pressure-idle-hours', type=float, default=12)
     parser.add_argument('--docker-age-hours', type=int, default=168)
     parser.add_argument('--pressure-docker-age-hours', type=int, default=24)
+    # A worker without containers (fleet.json features.containers) has no
+    # Docker to prune.
+    parser.add_argument('--no-docker', action='store_true')
     parser.add_argument('--pressure-cache', action='append', default=[])
     parser.add_argument('--worktree-root', action='append', default=[])
     parser.add_argument('--worktree-idle-days', type=float, default=30)
@@ -523,11 +526,12 @@ def main(argv):
             prune = ['runuser', '-u', args.user, '--', 'env', f'HOME={home}'] + prune
         command(prune, args.dry_run, 'mise_prune')
         reclaimed += max(0, before_mise - size_of(installs))
-    if not args.home_only:
+    if not args.home_only and not args.no_docker:
         command(['docker', 'image', 'prune', '--all', '--force', '--filter',
                  f'until={docker_age}h'], args.dry_run, 'docker_images')
         command(['docker', 'builder', 'prune', '--all', '--force', '--filter',
                  f'until={docker_age}h'], args.dry_run, 'docker_build_cache')
+    if not args.home_only:
         command(['apt-get', 'clean'], args.dry_run, 'apt_cache')
 
     after = {p: free_bytes(p) for p in paths}

package/ansible/ubuntu/firewall.nft.j2

@@ -0,0 +1,50 @@
+# Managed by personal Fleet; inbound only over loopback and the tailnet (worker exposure policy).
+# Loaded at boot by personal-fleet-firewall.service. Replaces only its own
+# table: Docker's and Tailscale's tables are left to their owners.
+table inet personal_fleet
+delete table inet personal_fleet
+
+table inet personal_fleet {
+	chain input {
+		type filter hook input priority filter - 10; policy drop;
+		iif "lo" accept
+		ct state invalid drop
+		ct state established,related accept
+		iifname "{{ exposure.tailnetInterface }}" accept
+{% if firewall_docker | bool %}
+{% for interface in exposure.containerInterfaces %}
+		iifname "{{ interface }}" accept comment "containers reach the host"
+{% endfor %}
+{% endif %}
+		udp dport {{ exposure.tailscalePort }} accept comment "tailscaled"
+		meta l4proto ipv6-icmp accept
+		meta l4proto icmp accept
+		udp sport 67 udp dport 68 accept comment "dhcp"
+		ip6 saddr fe80::/10 udp sport 547 udp dport 546 accept comment "dhcpv6"
+{% if firewall_public_ssh | bool %}
+{% for port in firewall_ssh_ports %}
+		tcp dport {{ port }} accept comment "public-ssh"
+{% endfor %}
+{% endif %}
+{% for entry in firewall_policy.publicPorts | default([]) %}
+		{{ entry.protocol }} dport {{ entry.port }} accept comment "public-port"
+{% endfor %}
+	}
+{% if firewall_docker | bool %}
+
+	# A published container port is reached by forwarding, not input: from
+	# outside the tailnet it is dropped before Docker's own chains accept it.
+	chain forward {
+		type filter hook forward priority filter - 10; policy accept;
+		ct state established,related accept
+		iifname "{{ exposure.tailnetInterface }}" accept
+{% for interface in exposure.containerInterfaces %}
+		iifname "{{ interface }}" accept
+{% endfor %}
+		ct status dnat drop comment "container-port"
+{% for interface in exposure.containerInterfaces %}
+		oifname "{{ interface }}" drop comment "container-port"
+{% endfor %}
+	}
+{% endif %}
+}