@crvouga/dev-fleet 0.8.0 → 0.9.1

package/ansible/ubuntu/tailscale.yml

@@ -10,7 +10,8 @@
   vars_files:
     - policy.json
   tasks:
-    - ansible.builtin.import_tasks: tasks/release.yml
+    - name: Require a supported Ubuntu release
+      ansible.builtin.import_tasks: tasks/release.yml
     - name: Inspect installed packages before possible network interruption
       ansible.builtin.package_facts:
         manager: apt
@@ -55,12 +56,16 @@
         group: root
         mode: '0644'
         timeout: 30
+    # The same one-line file apt_repository wrote and the first-boot seed
+    # writes, without apt_repository's need for gpg, which a minimal image
+    # does not have.
     - name: Declare the signed upstream package source
-      ansible.builtin.apt_repository:
-        repo: deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu {{ ubuntu_release.codename }} main
-        filename: tailscale
-        state: present
-        update_cache: false
+      ansible.builtin.copy:
+        dest: /etc/apt/sources.list.d/tailscale.list
+        content: "deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu {{ ubuntu_release.codename }} main\n"
+        owner: root
+        group: root
+        mode: '0644'
       register: tailscale_source
     - name: Install the approved version only when absent
       ansible.builtin.apt:
@@ -81,11 +86,52 @@
       ansible.builtin.command:
         argv: [tailscale, status, '--json']
       changed_when: false
+      check_mode: false
       failed_when: false
       register: tailscale_status
       no_log: true
+    # A new worker joins with a single-use, pre-authorised, tagged key that
+    # the seed or the bootstrap left in a root-only file. It joins only when
+    # it has never been logged in (NeedsLogin): a node with Tailscale state
+    # keeps its identity, and is never re-joined or reset. The key is read
+    # from the file by tailscale itself, so it is never an argument. The tag
+    # comes with the key and is never advertised as well: Headscale refuses a
+    # pre-authorised join that advertises tags (features/tailnet-box).
+    - name: Look for a single-use enrolment key
+      ansible.builtin.stat:
+        path: /run/devfleet/tailnet-auth-key
+      register: tailnet_key
+    - name: Join the tailnet as the declared worker, with its tag, when never logged in
+      ansible.builtin.command:
+        argv: >-
+          {{ ['tailscale', 'up', '--auth-key=file:/run/devfleet/tailnet-auth-key',
+              '--hostname=' ~ tailnet_hostname, '--ssh=false', '--timeout=120s']
+             + (['--login-server=' ~ tailnet_login_server] if tailnet_login_server | default('') else []) }}
+      when:
+        - tailnet_key.stat.exists
+        - tailnet_hostname | default('') is match('^[a-z0-9][a-z0-9-]{0,62}$')
+        - tailscale_status.rc == 0
+        - (tailscale_status.stdout | from_json).BackendState == 'NeedsLogin'
+      changed_when: true
+      # A used or expired key fails here; the assertion below names it.
+      failed_when: false
+      register: tailnet_join
+      no_log: true
+    - name: Forget the enrolment key once it was offered
+      ansible.builtin.file:
+        path: /run/devfleet/tailnet-auth-key
+        state: absent
+    - name: Inspect native authentication after the join
+      ansible.builtin.command:
+        argv: [tailscale, status, '--json']
+      changed_when: false
+      check_mode: false
+      failed_when: false
+      register: tailscale_joined
+      no_log: true
+      when: tailnet_join is changed
     - name: Require genuine device authentication before claiming connectivity
       ansible.builtin.assert:
-        that: (tailscale_status.stdout | from_json).BackendState == 'Running'
-        fail_msg: TAILSCALE_LOGIN_REQUIRED; authorize this device through its native login. Existing state is never copied or reset.
+        that: ((tailscale_joined if tailnet_join is changed else tailscale_status).stdout | from_json).BackendState == 'Running'
+        fail_msg: TAILSCALE_LOGIN_REQUIRED; authorize this device through its native login, or declare tailnet in fleet.json so fleet-sync enrols it with a single-use key. Existing state is never copied or reset.
       no_log: true

package/ansible/ubuntu/tasks/browser.yml

@@ -51,6 +51,9 @@
       - --disable-gpu
       - --dump-dom
       - about:blank
+  become: true
   become_user: '{{ development_user }}'
   timeout: '{{ browser.launchTimeoutSeconds }}'
   changed_when: false
+  # Verifies a change a dry run does not make.
+  when: not ansible_check_mode

package/ansible/ubuntu/tasks/containers-off.yml

@@ -0,0 +1,43 @@
+---
+# A worker whose `containers` feature is off (fleet.json features.containers)
+# keeps none of what tasks/docker.yml and the pinned packages gave it: the
+# developer leaves the docker group, the restart drop-in goes, and the Ubuntu
+# Docker packages dev-fleet pinned are removed (not purged: images and volumes
+# under /var/lib/docker stay until a person deletes them). A Docker that
+# another distribution owns (docker-ce) was never dev-fleet's and is left
+# alone. fleet-sync --dry-run lists what this removes; the worker:features
+# check reports what it removed.
+- name: Read the members of the groups containers gave the developer
+  ansible.builtin.getent:
+    database: group
+    key: '{{ item }}'
+    fail_key: false
+  loop: '{{ features.containers.groups }}'
+  register: container_groups
+- name: Take the developer out of the groups containers gave it
+  ansible.builtin.command:
+    argv: [gpasswd, --delete, '{{ development_user }}', '{{ item.item }}']
+  loop: '{{ container_groups.results }}'
+  loop_control:
+    label: '{{ item.item }}'
+  when: >-
+    (item.ansible_facts.getent_group[item.item] | default(none)) is not none
+    and development_user in (item.ansible_facts.getent_group[item.item][2] | default('')).split(',')
+  changed_when: true
+- name: Remove the restart drop-in of the container services
+  ansible.builtin.file:
+    path: '/etc/systemd/system/{{ item }}.service.d/60-personal-fleet.conf'
+    state: absent
+  loop: '{{ features.containers.services }}'
+  register: container_dropins
+- name: Reload unit definitions after removing the drop-ins
+  ansible.builtin.systemd_service:
+    daemon_reload: true
+  when: container_dropins.changed
+- name: Remove the Docker packages dev-fleet pinned
+  ansible.builtin.apt:
+    name: '{{ features.containers.packages }}'
+    state: absent
+    purge: false
+    autoremove: false
+    lock_timeout: '{{ aptLockTimeoutSeconds }}'

package/ansible/ubuntu/tasks/docker.yml

@@ -29,14 +29,26 @@
     - [docker, compose, version]
     - [docker, buildx, version]
   changed_when: false
+  # Verifies a change a dry run does not make.
+  when: not ansible_check_mode
 # The engine answering is not proof that an agent can use it: run a pinned
 # image and build a one-line image as the developer, in a fresh session that
 # reads the docker group from scratch. The image is cached here so the same
 # test works offline in worker:docker-run.
+#
+# The fresh session is made here, by runuser as root, and not by
+# `become_user`: Ansible skips becoming the user who already runs the play,
+# which the developer does on a worker. The command then ran in the session
+# that started before the group was granted, and the first sync of a new
+# worker ended with "permission denied" on the Docker socket.
 - name: Look for the cached smoke-test image
   ansible.builtin.command:
     argv:
       [
+        runuser,
+        -u,
+        '{{ development_user }}',
+        --,
         docker,
         image,
         inspect,
@@ -44,21 +56,37 @@
         '{{ "{{.Id}}" }}',
         '{{ dockerSmokeTest.image }}',
       ]
-  become_user: '{{ development_user }}'
+  environment:
+    HOME: '{{ development_home }}'
   check_mode: false
   changed_when: false
   failed_when: false
   register: docker_smoke_image
 - name: Cache the pinned smoke-test image
   ansible.builtin.command:
-    argv: [docker, pull, --quiet, '{{ dockerSmokeTest.image }}']
-  become_user: '{{ development_user }}'
+    argv:
+      [
+        runuser,
+        -u,
+        '{{ development_user }}',
+        --,
+        docker,
+        pull,
+        --quiet,
+        '{{ dockerSmokeTest.image }}',
+      ]
+  environment:
+    HOME: '{{ development_home }}'
   when: docker_smoke_image.rc | default(0) != 0
   changed_when: true
 - name: Run a container as the developer, offline (DOCKER_RUN_FAILED)
   ansible.builtin.command:
     argv:
       [
+        runuser,
+        -u,
+        '{{ development_user }}',
+        --,
         docker,
         run,
         --rm,
@@ -69,15 +97,34 @@
         '{{ dockerSmokeTest.image }}',
         'true',
       ]
-  become_user: '{{ development_user }}'
+  environment:
+    HOME: '{{ development_home }}'
   timeout: '{{ dockerSmokeTest.timeoutSeconds }}'
   changed_when: false
+  # Verifies a change a dry run does not make.
+  when: not ansible_check_mode
 - name: Build a one-line image as the developer, offline (DOCKER_BUILD_FAILED)
   ansible.builtin.command:
-    argv: [docker, build, --quiet, --pull=false, --network, none, '-']
+    argv:
+      [
+        runuser,
+        -u,
+        '{{ development_user }}',
+        --,
+        docker,
+        build,
+        --quiet,
+        --pull=false,
+        --network,
+        none,
+        '-',
+      ]
     stdin: |
       FROM {{ dockerSmokeTest.image }}
       RUN true
-  become_user: '{{ development_user }}'
+  environment:
+    HOME: '{{ development_home }}'
   timeout: '{{ dockerSmokeTest.timeoutSeconds }}'
   changed_when: false
+  # Verifies a change a dry run does not make.
+  when: not ansible_check_mode

package/ansible/ubuntu/tasks/dpkg.yml

@@ -13,12 +13,14 @@
             fcntl.lockf(handle, fcntl.LOCK_EX | fcntl.LOCK_NB)
   register: apt_idle
   changed_when: false
+  check_mode: false
   retries: 24
   delay: 5
   until: apt_idle.rc == 0
 - name: Inspect package database consistency
   ansible.builtin.command: dpkg --audit
   changed_when: false
+  check_mode: false
   register: dpkg_audit
 # Power lost during a package run leaves dpkg half-configured. Finishing
 # that run is the standard safe repair: it is tried once, bounded, after
@@ -30,11 +32,13 @@
     - name: Finish configuring every unpacked package, bounded
       ansible.builtin.command:
         argv: [timeout, '600', dpkg, --configure, -a]
+      changed_when: true
       environment:
         DEBIAN_FRONTEND: noninteractive
     - name: Inspect package database consistency after the repair
       ansible.builtin.command: dpkg --audit
       changed_when: false
+      check_mode: false
       register: dpkg_reaudit
   rescue:
     - name: Report a package run the repair could not finish

package/ansible/ubuntu/tasks/features.yml

@@ -0,0 +1,22 @@
+---
+# The declared worker features (fleet.json `features`, resolved by
+# bootstrap/worker-features.ts): `worker_containers` and `worker_session` are
+# passed by fleet-sync. Absent, a worker has containers and a desktop session,
+# as every worker had before features existed. What a feature that is off
+# would install is left out here, as policy.json `features` lists it.
+- name: Require a known session type
+  ansible.builtin.assert:
+    that: worker_session | default('desktop') in ['desktop', 'headless']
+    fail_msg: WORKER_FEATURES_INVALID; the session is desktop or headless (fleet.json features.session).
+  tags: [always]
+- name: Select what the features this worker lacks would install
+  ansible.builtin.set_fact:
+    worker_containers_on: '{{ worker_containers | default(true) | bool }}'
+    worker_headless: "{{ worker_session | default('desktop') == 'headless' }}"
+    worker_packages_off: "{{ ([] if worker_containers | default(true) | bool else features.containers.packages) + (features.desktop.packages if worker_session | default('desktop') == 'headless' else []) }}"
+    worker_always_on_services: '{{ alwaysOnServices | difference([] if worker_containers | default(true) | bool else features.containers.services) }}'
+  tags: [always]
+- name: Pin only the packages of the features this worker has
+  ansible.builtin.set_fact:
+    packages: "{{ packages | dict2items | rejectattr('key', 'in', worker_packages_off) | items2dict }}"
+  tags: [always]

package/ansible/ubuntu/tasks/firewall.yml

@@ -0,0 +1,172 @@
+---
+# Inbound traffic reaches a worker only over loopback and the tailnet, apart
+# from what tailscaled itself needs and what the exposure policy opens
+# (worker_exposure, src/exposure.ts). The same rules apply with or without a
+# public address. Measured as worker:exposure.
+#
+# The manager is never locked out. The public SSH port closes only when the
+# session running this play arrived over the tailnet; a session from a public
+# address, a tailnet that is not up, or a run with no session that finds the
+# port open keeps it open (worker:exposure then reports
+# WORKER_PUBLIC_SSH_UNDECLARED). Closing it is verified with new connections
+# over the tailnet, and a failed verification restores the previous rules.
+- name: Read the exposure policy of this worker
+  ansible.builtin.set_fact:
+    firewall_policy: "{{ {'publicSsh': false, 'publicPorts': []} | combine(worker_exposure | default({})) }}"
+    firewall_session_client: "{{ (lookup('ansible.builtin.env', 'SSH_CONNECTION') | default('', true)).split(' ') | first }}"
+- name: Inspect the managed firewall rules
+  ansible.builtin.stat:
+    path: /etc/personal-fleet/firewall.nft
+  register: firewall_owned_file
+- name: Read the previous rules for rollback
+  ansible.builtin.slurp:
+    src: /etc/personal-fleet/firewall.nft
+  when: firewall_owned_file.stat.exists
+  register: firewall_previous
+- name: Refuse to overwrite unmanaged firewall rules
+  ansible.builtin.assert:
+    that:
+      - not firewall_owned_file.stat.exists or (firewall_previous.content | b64decode).startswith('# Managed by personal Fleet')
+    fail_msg: FIREWALL_UNMANAGED_CONFLICT; review the existing rules file before adoption.
+- name: Read the ports sshd listens on
+  ansible.builtin.command: /usr/sbin/sshd -T
+  changed_when: false
+  check_mode: false
+  register: firewall_sshd
+- name: Read this worker's tailnet address
+  ansible.builtin.command:
+    argv: [tailscale, ip, '-4']
+  changed_when: false
+  check_mode: false
+  failed_when: false
+  register: firewall_tailnet_address
+- name: Inspect the tailnet interface
+  ansible.builtin.stat:
+    path: '/sys/class/net/{{ exposure.tailnetInterface }}'
+  register: firewall_tailnet_interface
+- name: Look for Docker, whose published ports the rules close
+  ansible.builtin.stat:
+    path: /usr/lib/systemd/system/docker.service
+  register: firewall_docker_unit
+- name: Decide whether the public SSH path may close
+  vars:
+    tailnet_up: '{{ firewall_tailnet_address.rc == 0 and firewall_tailnet_address.stdout | trim | length > 0 and firewall_tailnet_interface.stat.exists }}'
+    session_over_tailnet: "{{ firewall_session_client is match('^100\\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\\.') or firewall_session_client is match('(?i)^fd7a:115c:a1e0:') }}"
+    previously_public: '{{ not firewall_owned_file.stat.exists or ''comment "public-ssh"'' in (firewall_previous.content | b64decode) }}'
+  ansible.builtin.set_fact:
+    firewall_docker: '{{ firewall_docker_unit.stat.exists }}'
+    firewall_ssh_ports: "{{ firewall_sshd.stdout_lines | select('match', '^port [0-9]+$') | map('regex_replace', '^port ', '') | list }}"
+    firewall_tailnet_ip: '{{ firewall_tailnet_address.stdout | trim }}'
+    firewall_verify_tailnet: '{{ tailnet_up and session_over_tailnet }}'
+    firewall_public_ssh: >-
+      {{ firewall_policy.publicSsh or not tailnet_up
+      or (firewall_session_client | length > 0 and not session_over_tailnet)
+      or (firewall_session_client | length == 0 and previously_public) }}
+- name: Create the managed configuration directory
+  ansible.builtin.file:
+    path: /etc/personal-fleet
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+- name: Declare the unit that loads the rules at boot
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/personal-fleet-firewall.service
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      # Managed by personal fleet-sync: ansible/ubuntu/tasks/firewall.yml
+      [Unit]
+      Description=Personal Fleet firewall (inbound only over loopback and the tailnet)
+      DefaultDependencies=no
+      Wants=network-pre.target
+      Before=network-pre.target shutdown.target
+      Conflicts=shutdown.target
+      [Service]
+      Type=oneshot
+      RemainAfterExit=yes
+      ExecStart=/usr/sbin/nft -f /etc/personal-fleet/firewall.nft
+      ExecReload=/usr/sbin/nft -f /etc/personal-fleet/firewall.nft
+      [Install]
+      WantedBy=sysinit.target
+  register: firewall_unit
+- name: Read the rules the kernel holds now
+  ansible.builtin.command:
+    argv: [nft, list, table, inet, personal_fleet]
+  changed_when: false
+  check_mode: false
+  failed_when: false
+  register: firewall_loaded
+- name: Apply the rules and verify the tailnet path, or restore the previous ones
+  block:
+    - name: Write the rules, validated by nft (FIREWALL_RULES_REJECTED)
+      ansible.builtin.template:
+        src: '{{ playbook_dir }}/firewall.nft.j2'
+        dest: /etc/personal-fleet/firewall.nft
+        owner: root
+        group: root
+        mode: '0644'
+        validate: /usr/sbin/nft --check --file %s
+      register: firewall_rules
+    - name: Load the rules
+      ansible.builtin.systemd_service:
+        name: personal-fleet-firewall.service
+        daemon_reload: '{{ firewall_unit.changed }}'
+        enabled: true
+        state: "{{ 'restarted' if firewall_rules.changed or firewall_unit.changed or firewall_loaded.rc != 0 else 'started' }}"
+    - name: Verify the manager's tailnet path with a new probe (FIREWALL_TAILNET_UNVERIFIED)
+      ansible.builtin.command:
+        argv:
+          [
+            tailscale,
+            ping,
+            '--c=1',
+            '--timeout=5s',
+            '{{ firewall_session_client }}',
+          ]
+      changed_when: false
+      when: firewall_verify_tailnet | bool and not firewall_public_ssh | bool and not ansible_check_mode
+    - name: Verify sshd accepts a new connection on the tailnet address (FIREWALL_TAILNET_UNVERIFIED)
+      ansible.builtin.wait_for:
+        host: '{{ firewall_tailnet_ip }}'
+        port: '{{ firewall_ssh_ports | first | default(22) | int }}'
+        search_regex: SSH-
+        timeout: 10
+      when: firewall_verify_tailnet | bool and not firewall_public_ssh | bool and not ansible_check_mode
+  rescue:
+    - name: Restore the previous rules
+      ansible.builtin.copy:
+        content: '{{ firewall_previous.content | b64decode }}'
+        dest: /etc/personal-fleet/firewall.nft
+        owner: root
+        group: root
+        mode: '0644'
+      when: firewall_owned_file.stat.exists
+    - name: Reload the previous rules
+      ansible.builtin.systemd_service:
+        name: personal-fleet-firewall.service
+        state: restarted
+      when: firewall_owned_file.stat.exists
+    - name: Remove the rejected first rules
+      ansible.builtin.file:
+        path: /etc/personal-fleet/firewall.nft
+        state: absent
+      when: not firewall_owned_file.stat.exists
+    - name: Stop applying rules that were never verified
+      ansible.builtin.systemd_service:
+        name: personal-fleet-firewall.service
+        enabled: false
+        state: stopped
+      when: not firewall_owned_file.stat.exists
+    - name: Drop the unverified table from the kernel
+      ansible.builtin.command:
+        argv: [nft, delete, table, inet, personal_fleet]
+      changed_when: true
+      failed_when: false
+      when: not firewall_owned_file.stat.exists
+    - name: Report the failure with the previous rules in place
+      ansible.builtin.fail:
+        msg: >-
+          {{ 'FIREWALL_RULES_REJECTED' if firewall_rules is defined and firewall_rules is failed else 'FIREWALL_TAILNET_UNVERIFIED' }};
+          the previous rules are back in place. Check tailscale status on the worker, then rerun fleet-sync.

package/ansible/ubuntu/tasks/install.yml

@@ -4,7 +4,8 @@
 # package Ubuntu's security updates moved past its pin is left as it is and
 # reported as a warning (docs/worker-contract.md). `install_pins` maps each
 # package to its pinned version.
-- ansible.builtin.import_tasks: snapshot.yml
+- name: Point APT at the pinned snapshot
+  ansible.builtin.import_tasks: snapshot.yml
 - name: Read the installed package versions
   ansible.builtin.package_facts:
     manager: apt

package/ansible/ubuntu/tasks/packages.yml

@@ -1,5 +1,7 @@
 ---
-- ansible.builtin.include_tasks: install.yml
+- name: Install the pinned packages
+  ansible.builtin.include_tasks: install.yml
   vars:
     install_pins: '{{ packages }}'
-- ansible.builtin.import_tasks: unattended-upgrades.yml
+- name: Configure unattended upgrades
+  ansible.builtin.import_tasks: unattended-upgrades.yml

package/ansible/ubuntu/tasks/release.yml

@@ -12,9 +12,15 @@
       - ansible_facts.distribution_release == ubuntu_release.codename
       - "(ansible_facts.architecture | replace('x86_64', 'amd64') | replace('aarch64', 'arm64')) in ubuntu_release.architectures"
     fail_msg: UBUNTU_BASELINE_MISMATCH; workers run a release docs/support-matrix.md lists. No distribution upgrade is permitted.
+# What differs between accepted releases is data of the release's entry in
+# policy.json, selected above by the release the facts report: its package
+# pins, its browser library pins and, where Tailscale signs its suite with
+# another key, that key's digest. Everything not named there is common.
 - name: Pin the packages of this release, its own pins over the common ones
   ansible.builtin.set_fact:
     packages: '{{ packages | combine(ubuntu_release.packages | default({})) }}'
+    browser: "{{ browser | combine({'packages': browser.packages | combine(ubuntu_release.browserPackages | default({}))}) }}"
+    tailscale: "{{ tailscale | combine({'keySha256': ubuntu_release.tailscaleKeySha256 | default(tailscale.keySha256)}) }}"
 - name: Read the kernel release to tell WSL2 apart from a machine of its own
   ansible.builtin.slurp:
     src: /proc/sys/kernel/osrelease

package/ansible/ubuntu/tasks/resources.yml

@@ -20,12 +20,12 @@
   when: active_swap.stdout | trim == ''
 - name: Refuse to create swap on a nearly full disk
   ansible.builtin.assert:
-    that: (swap_capacity.stdout_lines | last | trim | regex_replace('M$', '') | int) >= resourceSafety.swapFileMiB + minimumFreeDiskMiB
+    that: (swap_capacity.stdout_lines | last | trim | regex_replace('M$', '') | int) >= worker_swap_file_mib | int + worker_minimum_free_disk_mib | int
     fail_msg: SWAP_CAPACITY_REQUIRED; free disk space so a swap file can be created. No swap is active.
   when: active_swap.stdout | trim == ''
 - name: Create a swap file when the node has no swap
   ansible.builtin.command:
-    argv: [fallocate, -l, '{{ resourceSafety.swapFileMiB }}M', /swap.fleet]
+    argv: [fallocate, -l, '{{ worker_swap_file_mib }}M', /swap.fleet]
     creates: /swap.fleet
   when: active_swap.stdout | trim == ''
 - name: Restrict the fleet swap file
@@ -39,10 +39,12 @@
   ansible.builtin.command:
     argv: [mkswap, /swap.fleet]
   when: active_swap.stdout | trim == ''
+  changed_when: true
 - name: Activate the fleet swap file
   ansible.builtin.command:
     argv: [swapon, /swap.fleet]
   when: active_swap.stdout | trim == ''
+  changed_when: true
 - name: Activate the fleet swap file at boot
   ansible.builtin.lineinfile:
     path: /etc/fstab
@@ -225,7 +227,7 @@
       StartLimitIntervalSec=0
       [Service]
       Type=simple
-      ExecStart=/usr/bin/python3 -I -B {{ disk_guard_source.stat.path }} --path / --path {{ development_home }} --floor-mib {{ resourceSafety.diskGuardFloorMiB }} --inode-floor-percent {{ resourceSafety.inodeFailFreePercent }} --write-mib {{ resourceSafety.diskGuardWriteMiB }} --interval {{ resourceSafety.diskGuardIntervalSeconds }}
+      ExecStart=/usr/bin/python3 -I -B {{ disk_guard_source.stat.path }} --path / --path {{ development_home }} --floor-mib {{ worker_disk_guard_floor_mib }} --inode-floor-percent {{ resourceSafety.inodeFailFreePercent }} --write-mib {{ resourceSafety.diskGuardWriteMiB }} --interval {{ resourceSafety.diskGuardIntervalSeconds }}
       Restart=always
       RestartSec=5
       OOMScoreAdjust=-1000
@@ -277,7 +279,7 @@
         After=docker.service
         [Service]
         Type=oneshot
-        ExecStart=/usr/bin/python3 -I -B {{ disk_gc_source.stat.path }} --home {{ development_home }} --path / --path {{ development_home }} --idle-days {{ resourceSafety.diskGcIdleDays }} --pressure-mib {{ resourceSafety.diskGcPressureMiB }} --pressure-inode-percent {{ resourceSafety.inodeWarnFreePercent }} --pressure-idle-hours {{ resourceSafety.diskGcPressureIdleHours }} --docker-age-hours {{ resourceSafety.diskGcDockerAgeHours }} --pressure-docker-age-hours {{ resourceSafety.diskGcPressureDockerAgeHours }}{% for cache in resourceSafety.diskGcPressureCaches %} --pressure-cache {{ cache }}{% endfor %}{% for root in resourceSafety.diskGcWorktreeRoots %} --worktree-root {{ root }}{% endfor %} --worktree-idle-days {{ resourceSafety.diskGcWorktreeIdleDays }}{% for cache, mib in resourceSafety.diskGcCacheCapsMiB.items() %} --cache-cap {{ cache }}={{ mib }}{% endfor %} --keep-newest /var/cache/personal-fleet={{ resourceSafety.diskGcPackagesKept }} --mise {{ development_home }}/.local/bin/mise --user {{ development_user }}
+        ExecStart=/usr/bin/python3 -I -B {{ disk_gc_source.stat.path }} --home {{ development_home }} --path / --path {{ development_home }} --idle-days {{ resourceSafety.diskGcIdleDays }} --pressure-mib {{ worker_disk_gc_pressure_mib }} --pressure-inode-percent {{ resourceSafety.inodeWarnFreePercent }} --pressure-idle-hours {{ resourceSafety.diskGcPressureIdleHours }} --docker-age-hours {{ resourceSafety.diskGcDockerAgeHours }} --pressure-docker-age-hours {{ resourceSafety.diskGcPressureDockerAgeHours }}{% for cache in resourceSafety.diskGcPressureCaches %} --pressure-cache {{ cache }}{% endfor %}{% for root in resourceSafety.diskGcWorktreeRoots %} --worktree-root {{ root }}{% endfor %} --worktree-idle-days {{ resourceSafety.diskGcWorktreeIdleDays }}{% for cache, mib in resourceSafety.diskGcCacheCapsMiB.items() %} --cache-cap {{ cache }}={{ mib }}{% endfor %} --keep-newest /var/cache/personal-fleet={{ resourceSafety.diskGcPackagesKept }} --mise {{ development_home }}/.local/bin/mise --user {{ development_user }}{{ '' if worker_containers_on | default(true) | bool else ' --no-docker' }}
 
         TimeoutStartSec=2h
         Nice=19

package/ansible/ubuntu/tasks/services.yml

@@ -8,7 +8,7 @@
     owner: root
     group: root
     mode: '0755'
-  loop: '{{ alwaysOnServices }}'
+  loop: '{{ worker_always_on_services | default(alwaysOnServices) }}'
 - name: Declare unlimited automatic restart for required system services
   ansible.builtin.copy:
     dest: '/etc/systemd/system/{{ item }}.service.d/60-personal-fleet.conf'
@@ -23,7 +23,7 @@
       [Service]
       Restart=always
       RestartSec=5
-  loop: '{{ alwaysOnServices }}'
+  loop: '{{ worker_always_on_services | default(alwaysOnServices) }}'
   register: recovery_dropins
 - name: Reload unit definitions without restarting running services
   ansible.builtin.systemd_service:

package/ansible/ubuntu/tasks/sizing.yml

@@ -0,0 +1,49 @@
+---
+# The size of this machine against the stated minimum, and the disk and memory
+# lines of the worker policy: each a share of the root filesystem or of memory
+# between a lower and an upper bound (policy.json `sizing`, the same numbers
+# src/worker-sizing.ts computes). Runs before anything is installed.
+- name: Measure the root filesystem
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/python3
+      - '-c'
+      - |
+        import os
+        v = os.statvfs('/')
+        print((v.f_blocks * v.f_frsize) // (1024 * 1024))
+  changed_when: false
+  check_mode: false
+  register: worker_root_size
+  tags: [always]
+- name: Record the size of this machine
+  ansible.builtin.set_fact:
+    worker_size:
+      memoryMiB: '{{ ansible_facts.memtotal_mb | int }}'
+      diskMiB: '{{ worker_root_size.stdout | trim | int }}'
+      cpus: '{{ ansible_facts.processor_vcpus | int }}'
+  tags: [always]
+- name: Refuse a machine below the stated minimum worker size before installing anything
+  ansible.builtin.assert:
+    that:
+      - worker_size.memoryMiB | int >= sizing.minimumWorker.memoryMiB
+      - worker_size.diskMiB | int >= sizing.minimumWorker.diskMiB
+      - worker_size.cpus | int >= sizing.minimumWorker.cpus
+    fail_msg: WORKER_SIZE_BELOW_MINIMUM; a worker needs {{ sizing.minimumWorker.memoryMiB }} MiB of memory, a {{ sizing.minimumWorker.diskMiB }} MiB root filesystem and {{ sizing.minimumWorker.cpus }} CPUs (docs/worker-contract.md). Resize the machine; nothing was installed.
+  tags: [always]
+- name: Compute the disk and memory lines for this machine
+  ansible.builtin.set_fact:
+    worker_thresholds: "{{ worker_thresholds | default({}) | combine({item.key: [[((item.value.share * ((worker_size.memoryMiB if item.value.of == 'memory' else worker_size.diskMiB) | int)) | int), item.value.minMiB] | max, item.value.maxMiB] | min}) }}"
+  loop: '{{ sizing.thresholds | dict2items }}'
+  loop_control:
+    label: '{{ item.key }}'
+  tags: [always]
+# Each line may be given as an extra variable instead (the VM test injects a
+# capacity gate this way); an extra variable always wins over a fact.
+- name: Name the lines the tasks use
+  ansible.builtin.set_fact:
+    worker_swap_file_mib: '{{ worker_thresholds.swapFile }}'
+    worker_minimum_free_disk_mib: '{{ worker_thresholds.minimumFreeDisk }}'
+    worker_disk_guard_floor_mib: '{{ worker_thresholds.diskGuardFloor }}'
+    worker_disk_gc_pressure_mib: '{{ worker_thresholds.diskGcPressure }}'
+  tags: [always]

package/ansible/ubuntu/tasks/snapshot.yml

@@ -23,8 +23,18 @@
       Components: main universe restricted multiverse
       Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
   register: snapshot_sources
-# Fetching the snapshot indexes must leave the indexes of the system's own
-# sources in place: the system's APT and unattended upgrades still use them.
+# The snapshot's indexes live in a directory of their own. An apt update
+# of the system's own sources (unattended upgrades, the Tailscale play)
+# removes the index files of every source it does not know, so kept beside
+# them the snapshot was fetched again on every sync; and fetching the
+# snapshot leaves the system's indexes alone.
+- name: Create the snapshot's own index directory
+  ansible.builtin.file:
+    path: /var/lib/personal-fleet/apt-lists/partial
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
 - name: Isolate snapshot selection from unrelated APT operations
   ansible.builtin.copy:
     dest: /etc/personal-fleet/apt.conf
@@ -34,11 +44,12 @@
     content: |
       Dir::Etc::sourcelist "/etc/personal-fleet/ubuntu.sources";
       Dir::Etc::sourceparts "-";
+      Dir::State::Lists "/var/lib/personal-fleet/apt-lists/";
       APT::Get::List-Cleanup "false";
       DPkg::Lock::Timeout "{{ aptLockTimeoutSeconds }}";
 - name: Inspect immutable snapshot package index
   ansible.builtin.stat:
-    path: '/var/lib/apt/lists/snapshot.ubuntu.com_ubuntu_{{ snapshot }}_dists_{{ ubuntu_release.codename }}_InRelease'
+    path: '/var/lib/personal-fleet/apt-lists/snapshot.ubuntu.com_ubuntu_{{ snapshot }}_dists_{{ ubuntu_release.codename }}_InRelease'
   register: snapshot_index
 - name: Fetch signed snapshot indexes after source change or interrupted setup
   ansible.builtin.apt: