claude-botandClaude Opus 5.5
5c416f8578
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
nas-2 (Synology DSM 7.3) joins [ssh_ca] under a new [synology_nas] group, so claude-bot reaches it with its 1h certificate like every other host. DSM differs from the fleet in ways the ssh-ca role now handles: - Python 3.8 only; plays/configure-synology-python.yml installs Synology's Python3.9 package via raw, and group_vars point the interpreter at it. - No getent: admin logins come from /etc/passwd on every host. - No useradd: the account is made with synouser and added to administrators (the only group DSM lets in over SSH). synogroup --member replaces the list, so the current members are read and passed along, and the run stops if the owner login is not among them. - No visudo: the sudo rules are rendered and checked on the controller. - sshd_config has no Include; the role puts it first. - No sftp/scp for ladmin: transfers are piped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 lines
776 B
YAML
20 lines
776 B
YAML
---
|
|
# Ansible needs Python >= 3.9 on the target; DSM ships 3.8. Synology's
|
|
# Python3.9 package installs beside it. raw, because the modules cannot run
|
|
# before it is there; raw is skipped in check mode.
|
|
- name: Install Python 3.9 on the Synology NAS
|
|
hosts: synology_nas
|
|
become: true
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Install the Python3.9 package
|
|
ansible.builtin.raw: >-
|
|
if [ -x {{ ansible_python_interpreter }} ]; then echo present;
|
|
else /usr/syno/bin/synopkg install_from_server Python3.9; fi
|
|
register: synology_python_install
|
|
changed_when: "'present' not in synology_python_install.stdout"
|
|
|
|
- name: Check the interpreter exists
|
|
ansible.builtin.raw: test -x {{ ansible_python_interpreter }}
|
|
changed_when: false
|