fleet/playbook.yml

- name: Провижнинг приёмников пеленгации
  hosts: all
  tasks:

    - name: Обновить кэш apt (не считается изменением)
      become: true
      ansible.builtin.apt:
        update_cache: true
        cache_valid_time: 3600
      changed_when: false
      tags: [base]

    - name: apt full-upgrade
      become: true
      ansible.builtin.apt:
        upgrade: full
      tags: [base]

    - name: Зависимости сборки и утилиты HackRF
      become: true
      ansible.builtin.apt:
        name: [cmake, g++, pkg-config, git, rsync, libhackrf-dev, libusb-1.0-0-dev, libfftw3-dev, hackrf, fish]
        state: present
      tags: [base]

    - name: pi в группе plugdev, login-shell fish
      become: true
      ansible.builtin.user:
        name: pi
        groups: plugdev
        append: true
        shell: /usr/bin/fish
      tags: [base]

    - name: Права udev на уже подключённый HackRF (устройство старше правил)
      become: true
      ansible.builtin.shell: |
        bad=0
        for d in /sys/bus/usb/devices/*; do
          [ -f "$d/idVendor" ] || continue
          case "$(cat "$d/idVendor"):$(cat "$d/idProduct")" in 1d50:6089|1d50:604b) ;; *) continue;; esac
          node=/dev/bus/usb/$(printf %03d "$(cat "$d/busnum")")/$(printf %03d "$(cat "$d/devnum")")
          [ "$(stat -c %G "$node")" = plugdev ] || bad=1
        done
        if [ "$bad" = 1 ]; then
          udevadm control --reload-rules && udevadm trigger --subsystem-match=usb && echo FIXED
        else
          echo OK
        fi
      register: usb
      changed_when: "'FIXED' in usb.stdout"
      tags: [base]

    - name: Имя узла
      become: true
      ansible.builtin.hostname:
        name: "{{ inventory_hostname }}"
      tags: [hostname]

    - name: Имя узла в /etc/hosts
      become: true
      ansible.builtin.lineinfile:
        path: /etc/hosts
        regexp: '^127\.0\.1\.1'
        line: "127.0.1.1\t{{ inventory_hostname }}"
      tags: [hostname]

    - name: Deploy-ключ есть в keys/
      delegate_to: localhost
      run_once: true
      ansible.builtin.stat:
        path: "{{ playbook_dir }}/keys/gitea_deploy"
      register: deploy_key
      tags: [key]

    - name: Ключа нет
      run_once: true
      ansible.builtin.fail:
        msg: "[!] нет keys/gitea_deploy -- запустите scripts/gen-key.sh"
      when: not deploy_key.stat.exists
      tags: [key]

    - name: ~/.ssh
      ansible.builtin.file:
        path: ~/.ssh
        state: directory
        mode: "0700"
      tags: [key]

    - name: Приватный deploy-ключ
      ansible.builtin.copy:
        src: "{{ playbook_dir }}/keys/gitea_deploy"
        dest: ~/.ssh/gitea_deploy
        mode: "0600"
      tags: [key]

    - name: ssh config для Gitea
      ansible.builtin.blockinfile:
        path: ~/.ssh/config
        create: true
        mode: "0600"
        marker: "# {mark} fleet gitea"
        block: |
          Host {{ gitea_host }}
            Port {{ gitea_port }}
            User git
            IdentityFile ~/.ssh/gitea_deploy
            IdentitiesOnly yes
            StrictHostKeyChecking accept-new
      tags: [key]

    - name: ~/node.env для обёртки node.sh (только засев, полевые правки не трогаем)
      ansible.builtin.copy:
        dest: ~/node.env
        mode: "0644"
        force: false
        content: |
          SDR_ID={{ sdr_id }}
          X={{ x }}
          Y={{ y }}
          SERVER={{ server_ip }}
      tags: [env]

    - name: Репозиторий уже клонирован?
      ansible.builtin.stat:
        path: ~/hackrf-scanner/.git
      register: repo_dir
      tags: [repo]

    - name: Локальные правки в репо (rsync-разработка)?
      ansible.builtin.command: git status --porcelain
      args:
        chdir: ~/hackrf-scanner
      register: dirty
      changed_when: false
      when: repo_dir.stat.exists
      tags: [repo]

    - name: Stash локальных правок перед обновлением
      ansible.builtin.command: git stash push -m fleet-provision
      args:
        chdir: ~/hackrf-scanner
      when: repo_dir.stat.exists and dirty.stdout != ""
      tags: [repo]

    - name: Репозиторий hackrf-scanner
      ansible.builtin.git:
        repo: "{{ scanner_repo }}"
        dest: ~/hackrf-scanner
        version: "{{ scanner_branch }}"
        update: true
        force: true
      register: repo
      tags: [repo]

    - name: Сборка
      ansible.builtin.shell: |
        cmake -B build -DCMAKE_BUILD_TYPE=RelWithDebInfo >/dev/null
        cmake --build build -j4
      args:
        chdir: ~/hackrf-scanner
      register: build
      changed_when: "'Building CXX' in build.stdout or 'Linking' in build.stdout"
      tags: [build]