fix(vhosts): make macOS defaults and vault tasks platform aware

roles/vhosts/common/tasks/main.yml

@@ -4,6 +4,7 @@
   ansible.builtin.command: "timedatectl set-timezone Asia/Shanghai"
   changed_when: false
   become: true
+  when: ansible_os_family != 'Darwin'
 
 - name: Base | render /etc/hostname
   ansible.builtin.template:
@@ -13,11 +14,13 @@
     group: root
     mode: "0644"
   become: true
+  when: ansible_os_family != 'Darwin'
 
 - name: Base | set hostname
   ansible.builtin.hostname:
     name: "{{ inventory_hostname }}"
   become: true
+  when: ansible_os_family != 'Darwin'
 
 - name: Base | update /etc/hosts
   ansible.builtin.template:
@@ -27,29 +30,35 @@
     group: root
     mode: "0644"
   become: true
+  when: ansible_os_family != 'Darwin'
 
 - name: Base | harden ssh
   ansible.builtin.script: files/secure_ssh.sh
   become: true
+  when: ansible_os_family != 'Darwin'
 
 - name: Base | harden ssh config
   ansible.builtin.import_tasks: harden_ssh.yml
   tags: [ssh, security]
+  when: ansible_os_family != 'Darwin'
 
 - name: Base | configure fail2ban
   ansible.builtin.import_tasks: fail2ban.yml
   tags: [fail2ban, security]
+  when: ansible_os_family != 'Darwin'
 
 - name: Base | file limits
   ansible.builtin.import_tasks: limits.yml
   when:
     - common_security_limits.enabled | default(true) | bool
+    - ansible_os_family != 'Darwin'
   tags: [limits, baseline]
 
 - name: Base | allow HTTP/HTTPS ports
   ansible.builtin.import_tasks: firewall_ports.yml
   when:
     - common_firewall.enabled | default(true) | bool
+    - ansible_os_family != 'Darwin'
   tags: [firewall, baseline]
 
 # ===== Common baseline (OS split) =====

roles/vhosts/vault/tasks/macos.yml

@@ -1,4 +1,14 @@
 ---
+- name: Ensure macOS Vault directories exist
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - "{{ vault_config_dir }}"
+    - "{{ vault_data_dir }}"
+    - "{{ ansible_env.HOME }}/.local/state/xworkspace"
+
 - name: Install HashiCorp Tap
   ansible.builtin.command: brew tap hashicorp/tap
   changed_when: false
@@ -9,6 +19,12 @@
     creates: /opt/homebrew/bin/vault
   changed_when: true
 
+- name: Install jq via Homebrew (required by Vault admin bootstrap)
+  ansible.builtin.command: brew install jq
+  args:
+    creates: /opt/homebrew/bin/jq
+  changed_when: true
+
 - name: Create symlink for Vault binary to match Linux path
   ansible.builtin.file:
     src: /opt/homebrew/bin/vault

roles/vhosts/vault/tasks/main.yml

@@ -57,6 +57,7 @@
     - "{{ vault_data_dir }}"
   when:
     - vault_deploy_mode == "standalone"
+    - ansible_os_family != 'Darwin'
 
 - name: Deploy standalone Vault systemd service
   ansible.builtin.copy:
@@ -128,6 +129,8 @@
     --root-token {{ vault_server_root_access_token | quote }}
     --output-dir {{ vault_admin_output_dir | quote }}
     --ui-url {{ vault_admin_ui_url | quote }}
+  environment:
+    PATH: "/opt/homebrew/bin:/usr/local/bin:{{ ansible_env.PATH }}"
   no_log: true
   when:
     - not ansible_check_mode

roles/vhosts/vault/vars/main.yml

@@ -6,9 +6,9 @@ vault_deploy_mode: "{{ lookup('ansible.builtin.env', 'VAULT_DEPLOY_MODE') | defa
 vault_version: "{{ lookup('ansible.builtin.env', 'VAULT_VERSION') | default('1.21.4', true) }}"
 vault_listen_addr: 127.0.0.1:8200
 vault_service_name: vault
-vault_binary_path: /usr/local/bin/vault
-vault_config_dir: /etc/vault.d
-vault_data_dir: /opt/vault/data
+vault_binary_path: "{{ '/opt/homebrew/bin/vault' if ansible_os_family == 'Darwin' else '/usr/local/bin/vault' }}"
+vault_config_dir: "{{ (ansible_env.HOME ~ '/Library/Application Support/vault') if ansible_os_family == 'Darwin' else '/etc/vault.d' }}"
+vault_data_dir: "{{ (ansible_env.HOME ~ '/Library/Application Support/vault/data') if ansible_os_family == 'Darwin' else '/opt/vault/data' }}"
 ai_workspace_auth_token: "{{ lookup('ansible.builtin.env', 'AI_WORKSPACE_AUTH_TOKEN') | default('', true) }}"
 vault_server_root_access_token: "{{ lookup('ansible.builtin.env', 'VAULT_SERVER_ROOT_ACCESS_TOKEN') | default(lookup('ansible.builtin.env', 'VAULT_TOKEN') | default(ai_workspace_auth_token, true), true) }}"
 vault_admin_init_enabled: "{{ (vault_server_root_access_token | trim | length > 0) and (vault_admin_password | trim | length > 0) }}"

roles/vhosts/xworkmate_bridge/defaults/main.yml

@@ -9,7 +9,7 @@ xworkmate_bridge_review_auth_token: "{{ lookup('ansible.builtin.env', 'BRIDGE_RE
 xworkmate_bridge_listen_host: 127.0.0.1
 xworkmate_bridge_listen_port: 8787
 xworkmate_bridge_listen_addr: "{{ xworkmate_bridge_listen_host }}:{{ xworkmate_bridge_listen_port }}"
-xworkmate_bridge_base_dir: /opt/cloud-neutral/xworkmate-bridge
+xworkmate_bridge_base_dir: "{{ (ansible_env.HOME ~ '/Library/Application Support/cloud-neutral/xworkmate-bridge') if ansible_os_family == 'Darwin' else '/opt/cloud-neutral/xworkmate-bridge' }}"
 xworkmate_bridge_config_file: "{{ xworkmate_bridge_base_dir }}/config.yaml"
 xworkmate_bridge_binary_path: /usr/local/bin/xworkmate-go-core
 xworkmate_bridge_systemd_unit_path: "/etc/systemd/system/{{ xworkmate_bridge_service_name }}.service"