From 65e45a48349e4af29755b46a3bb65740779e81db Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Sun, 21 Jun 2026 20:41:32 +0800 Subject: [PATCH] fix(vhosts): make macOS defaults and vault tasks platform aware --- roles/vhosts/common/tasks/main.yml | 9 +++++++++ roles/vhosts/vault/tasks/macos.yml | 16 ++++++++++++++++ roles/vhosts/vault/tasks/main.yml | 3 +++ roles/vhosts/vault/vars/main.yml | 6 +++--- roles/vhosts/xworkmate_bridge/defaults/main.yml | 2 +- 5 files changed, 32 insertions(+), 4 deletions(-) diff --git a/roles/vhosts/common/tasks/main.yml b/roles/vhosts/common/tasks/main.yml index bd54941..b4aab4a 100644 --- a/roles/vhosts/common/tasks/main.yml +++ b/roles/vhosts/common/tasks/main.yml @@ -4,6 +4,7 @@ ansible.builtin.command: "timedatectl set-timezone Asia/Shanghai" changed_when: false become: true + when: ansible_os_family != 'Darwin' - name: Base | render /etc/hostname ansible.builtin.template: @@ -13,11 +14,13 @@ group: root mode: "0644" become: true + when: ansible_os_family != 'Darwin' - name: Base | set hostname ansible.builtin.hostname: name: "{{ inventory_hostname }}" become: true + when: ansible_os_family != 'Darwin' - name: Base | update /etc/hosts ansible.builtin.template: @@ -27,29 +30,35 @@ group: root mode: "0644" become: true + when: ansible_os_family != 'Darwin' - name: Base | harden ssh ansible.builtin.script: files/secure_ssh.sh become: true + when: ansible_os_family != 'Darwin' - name: Base | harden ssh config ansible.builtin.import_tasks: harden_ssh.yml tags: [ssh, security] + when: ansible_os_family != 'Darwin' - name: Base | configure fail2ban ansible.builtin.import_tasks: fail2ban.yml tags: [fail2ban, security] + when: ansible_os_family != 'Darwin' - name: Base | file limits ansible.builtin.import_tasks: limits.yml when: - common_security_limits.enabled | default(true) | bool + - ansible_os_family != 'Darwin' tags: [limits, baseline] - name: Base | allow HTTP/HTTPS ports ansible.builtin.import_tasks: firewall_ports.yml when: - common_firewall.enabled | default(true) | bool + - ansible_os_family != 'Darwin' tags: [firewall, baseline] # ===== Common baseline (OS split) ===== diff --git a/roles/vhosts/vault/tasks/macos.yml b/roles/vhosts/vault/tasks/macos.yml index 2c339b9..1146362 100644 --- a/roles/vhosts/vault/tasks/macos.yml +++ b/roles/vhosts/vault/tasks/macos.yml @@ -1,4 +1,14 @@ --- +- name: Ensure macOS Vault directories exist + ansible.builtin.file: + path: "{{ item }}" + state: directory + mode: "0755" + loop: + - "{{ vault_config_dir }}" + - "{{ vault_data_dir }}" + - "{{ ansible_env.HOME }}/.local/state/xworkspace" + - name: Install HashiCorp Tap ansible.builtin.command: brew tap hashicorp/tap changed_when: false @@ -9,6 +19,12 @@ creates: /opt/homebrew/bin/vault changed_when: true +- name: Install jq via Homebrew (required by Vault admin bootstrap) + ansible.builtin.command: brew install jq + args: + creates: /opt/homebrew/bin/jq + changed_when: true + - name: Create symlink for Vault binary to match Linux path ansible.builtin.file: src: /opt/homebrew/bin/vault diff --git a/roles/vhosts/vault/tasks/main.yml b/roles/vhosts/vault/tasks/main.yml index 083b7f6..342d7b9 100755 --- a/roles/vhosts/vault/tasks/main.yml +++ b/roles/vhosts/vault/tasks/main.yml @@ -57,6 +57,7 @@ - "{{ vault_data_dir }}" when: - vault_deploy_mode == "standalone" + - ansible_os_family != 'Darwin' - name: Deploy standalone Vault systemd service ansible.builtin.copy: @@ -128,6 +129,8 @@ --root-token {{ vault_server_root_access_token | quote }} --output-dir {{ vault_admin_output_dir | quote }} --ui-url {{ vault_admin_ui_url | quote }} + environment: + PATH: "/opt/homebrew/bin:/usr/local/bin:{{ ansible_env.PATH }}" no_log: true when: - not ansible_check_mode diff --git a/roles/vhosts/vault/vars/main.yml b/roles/vhosts/vault/vars/main.yml index 01bdf2f..a7915ef 100644 --- a/roles/vhosts/vault/vars/main.yml +++ b/roles/vhosts/vault/vars/main.yml @@ -6,9 +6,9 @@ vault_deploy_mode: "{{ lookup('ansible.builtin.env', 'VAULT_DEPLOY_MODE') | defa vault_version: "{{ lookup('ansible.builtin.env', 'VAULT_VERSION') | default('1.21.4', true) }}" vault_listen_addr: 127.0.0.1:8200 vault_service_name: vault -vault_binary_path: /usr/local/bin/vault -vault_config_dir: /etc/vault.d -vault_data_dir: /opt/vault/data +vault_binary_path: "{{ '/opt/homebrew/bin/vault' if ansible_os_family == 'Darwin' else '/usr/local/bin/vault' }}" +vault_config_dir: "{{ (ansible_env.HOME ~ '/Library/Application Support/vault') if ansible_os_family == 'Darwin' else '/etc/vault.d' }}" +vault_data_dir: "{{ (ansible_env.HOME ~ '/Library/Application Support/vault/data') if ansible_os_family == 'Darwin' else '/opt/vault/data' }}" ai_workspace_auth_token: "{{ lookup('ansible.builtin.env', 'AI_WORKSPACE_AUTH_TOKEN') | default('', true) }}" vault_server_root_access_token: "{{ lookup('ansible.builtin.env', 'VAULT_SERVER_ROOT_ACCESS_TOKEN') | default(lookup('ansible.builtin.env', 'VAULT_TOKEN') | default(ai_workspace_auth_token, true), true) }}" vault_admin_init_enabled: "{{ (vault_server_root_access_token | trim | length > 0) and (vault_admin_password | trim | length > 0) }}" diff --git a/roles/vhosts/xworkmate_bridge/defaults/main.yml b/roles/vhosts/xworkmate_bridge/defaults/main.yml index 721ab28..c327223 100644 --- a/roles/vhosts/xworkmate_bridge/defaults/main.yml +++ b/roles/vhosts/xworkmate_bridge/defaults/main.yml @@ -9,7 +9,7 @@ xworkmate_bridge_review_auth_token: "{{ lookup('ansible.builtin.env', 'BRIDGE_RE xworkmate_bridge_listen_host: 127.0.0.1 xworkmate_bridge_listen_port: 8787 xworkmate_bridge_listen_addr: "{{ xworkmate_bridge_listen_host }}:{{ xworkmate_bridge_listen_port }}" -xworkmate_bridge_base_dir: /opt/cloud-neutral/xworkmate-bridge +xworkmate_bridge_base_dir: "{{ (ansible_env.HOME ~ '/Library/Application Support/cloud-neutral/xworkmate-bridge') if ansible_os_family == 'Darwin' else '/opt/cloud-neutral/xworkmate-bridge' }}" xworkmate_bridge_config_file: "{{ xworkmate_bridge_base_dir }}/config.yaml" xworkmate_bridge_binary_path: /usr/local/bin/xworkmate-go-core xworkmate_bridge_systemd_unit_path: "/etc/systemd/system/{{ xworkmate_bridge_service_name }}.service"