Add continuous deployment to mimir via buildbot

New "deploy" step in .ci.toml, master-only and after unit-tests: runs the
existing ansible playbook from a debian container. host_vars/*.yml are
committed ansible-vault encrypted (same vault as deploy/vault.sh); the
vault password file and a dedicated deploy ssh key are mounted from the
buildbot secrets store on heimdall. The playbook now also authorizes that
key for the bot user itself, so only root@mimir needed manual provisioning.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KJp2rEnVtsgbH7FLj3jubx

diff --git a/.ci.toml b/.ci.toml
index 95859b6567364df23b4bc2d70f2528335bb8f019..55b915072d4db286d4741272b1b458cba9aa3979 100644 (file)
--- a/.ci.toml
+++ b/.ci.toml
@@ -5,3 +5,24 @@ command = """
 pip install --quiet .[worker] pytest
 python -m pytest tests/test_unit/ -v
 """
+
+# continuous deployment to the production bot (mimir/aero2k.de) - master only,
+# and only reached if unit-tests passed. Credentials: host_vars/*.yml are
+# ansible-vault encrypted in the repo; the vault password and a dedicated
+# deploy ssh key live in the buildbot secrets store on heimdall.
+[[step]]
+name = "deploy"
+image = "docker.io/library/debian:trixie-slim"
+only_branches = ["refs/heads/master"]
+secrets = ["vault_password", "deploy_ssh_key", "deploy_ssh_key.pub"]
+env = { ANSIBLE_FORCE_COLOR = "0", ANSIBLE_NOCOWS = "1" }
+command = """
+set -e
+apt-get -qq update
+apt-get -qq install -y --no-install-recommends ansible-core openssh-client git >/dev/null
+cd deploy
+export ANSIBLE_SSH_COMMON_ARGS="-o UserKnownHostsFile=$PWD/known_hosts -o IdentitiesOnly=yes"
+ansible-playbook -i hosts deploy.yml -D \\
+    --private-key /run/secrets/deploy_ssh_key \\
+    --vault-password-file /run/secrets/vault_password
+"""

diff --git a/deploy/deploy.yml b/deploy/deploy.yml
index 0047589bce96b98b48650f476a0ff746900f0638..455055375e97fa086de101b3c95a0f88d8972ca2 100644 (file)
--- a/deploy/deploy.yml
+++ b/deploy/deploy.yml
@@ -14,6 +14,8 @@
     authorized_key: user="{{ botuser }}" key="{{ lookup('file', item) }}"
     with_fileglob:
     - "~/.ssh/*.pub"
+    # the CI deploy key, mounted into the buildbot container (see .ci.toml)
+    - "/run/secrets/*.pub"
     when: manage_botuser | default(true)
 
   - name: ensure venv module is installed

diff --git a/deploy/group_vars/bots.yml b/deploy/group_vars/bots.yml
new file mode 100644 (file)
index 0000000..a5aeb0d
--- /dev/null
+++ b/deploy/group_vars/bots.yml
@@ -0,0 +1,5 @@
+---
+# default bot account name; override per-host to reuse an existing user
+botuser: jabberbot
+# set to false in host_vars to skip creating/managing the user account
+manage_botuser: true

diff --git a/deploy/host_vars/aero2k.de.yml b/deploy/host_vars/aero2k.de.yml
new file mode 100644 (file)
index 0000000..8b85794
--- /dev/null
+++ b/deploy/host_vars/aero2k.de.yml
@@ -0,0 +1,50 @@
+$ANSIBLE_VAULT;1.1;AES256
+61326566323866383863313434613263383930376535613139326339336262393535316464303764
+3036303732353434303833316632366532643338636138380a383031643837383864303832623431
+32613236626330623139653934616263383434353163643437323764663366356633313630363938
+3536363338663236380a643533323363316663663735323230326464353365393034656637643631
+66383833393765313162316564366332653161633766343933306361653532326362386539376335
+32386336396333333038626537353164333439616462303035626334366339376336323962646130
+64366434373165326531616637613861396439376230373038373534663038626564356261363835
+30386664396236326632633462336333306334396135653431376661623335623866613034303762
+66326363366138323638353437363834626563383331366561613061616134393763316562376432
+63343962303761336538363763633734643463353233633162366366346334336562393365616132
+39656639393936376138373363386636356235363331656334326363653363646432626436643161
+35613435636361613435323033306434396565396563306234316562333762646337653762316235
+38376262323339646261353961396537386462616661373462653535366663363239613862313731
+64366533613133303237333562666230663038323533633362333564386464386364333939663034
+64306363663938376534373939363861353931386566383439633962313139383037626436333637
+61353963643434623164346131653461313139323333613131333465643031396330343961363536
+64393066383861343762353065663163303936313165636631616362646435666633366135373038
+39333166383436303064633664323638373537623863636632363032633764643837366232643430
+33626530343431336530323538306262646464386633656231343531656436346136666661623338
+63643362313261333036636466373265353061396564336333373335396636323435326166323331
+39313335333032616136303564663331663030666439336362383161366433623364393434663130
+33393766316237623562663633333732363430323237663437376532356164356361616237363365
+39666439633239343038383736303630663763656138323137333934376236643331373935633162
+61653532666463653332343832636132343339313439303036373232633461653838616139343834
+65623431666265626365333937366238663266653932646132363761653538633862323864303261
+66373566636437313332383762313965666431313334666530326536643037623733643562376330
+34663763643432313633656465646433626330656132386537616331633064303130643563366265
+35366666363262343838346433633634616265646561316666616135363337343433313738393436
+63396630376137356430646533363032333538623539326638396165643733356336383161303835
+36366666613463346632663462356564316532643665616166366534633461323933666533386136
+36623636326265646136616537623363343265363166316632636464306564323234636361356639
+64333736333632626533393365353633313761663539323165383662323366333331646130613534
+65326531393364333934633332663533613035396130663634303763346566646266306334616638
+66653764613963306336346466616466633737656237333436336565356235643333616535663837
+61396539366231373166376235303838316136346536323437373632363934333637646362656638
+65363963653131653038613265616666393835363031346262613532386632333030313032633361
+39663462363131336537356433633463643432333465323863303061346133303761373765303133
+37643939623334626133323865306637396164613265666433623365363938626636383233323464
+66376630366439366137313161643265663235633164366539626234363566613337333132356335
+31313263353530663362393361663837636531306236623764353130353161336165346230373630
+37656632336235353330643564313630656564356333626235626430646434633461306662323432
+64366266646632336437356164663064393235316462353665303739323963356439333932373764
+39383131356635633031333261343861363461313262313362373136326635356533343839303761
+65386432636363633330653064623838326135353461313462353565363833376535373964636465
+37653932623061646561616166313866333364363438323838353363613961613131313535646366
+61396136353964313466623130363434663633333764306265363837346630393666343739303365
+66373134353737313762323639616131373464633432666563643637633865383634616334633636
+36383430656230313132303666336536316632383339653934346239373533656435313634643866
+3861

diff --git a/deploy/host_vars/munin.yml b/deploy/host_vars/munin.yml
new file mode 100644 (file)
index 0000000..4c9baca
--- /dev/null
+++ b/deploy/host_vars/munin.yml
@@ -0,0 +1,66 @@
+$ANSIBLE_VAULT;1.1;AES256
+34366664356161636234306530663331643436656164303965663564643039393834316231656630
+6633653061623362393630383635333037303363666465350a306261346361376534383333326430
+33633663306239323466656135366330656632303439353162333732646236623364623265653563
+3135373161323637340a366661326436623739356531386161343531303864616439623137333639
+30373866663635333064396131633164363465383631353266643662373964653966343338636138
+66643437653162313439363033613730376634643635326131376434323361653632383666656163
+64666536313664313265336633336238653832396132366163666239343661393138623430373433
+63386632626433376563333037363966386237626230306436353634623233303364643739656437
+34323165363062386266346265393635613835353835626437633762653234333362343364653039
+61346637303536356262643266653633626232663963653433386631373437663931616132383231
+64303838333236303830393538393230643034383234656263373836396365663666353830333461
+30643463643931373335616464633537663136656464386564363636353763363465656431366563
+31333561343437623134303561363033623134393766643233326662303831653366636634306233
+35636234623538326263643939313839386136623532653763386233366236383766306331383464
+38396631303565393237333231326333656630343833633766626535623336376539316537653466
+35373366613461336163373964306534366234613539383336613335326234393766303737396332
+64653164646134306535373337383734323331383533653730313063383838633864346134666437
+62663564376139663735643536646631376533373133353238613138616361346634633864303432
+63343466356633333736373563346564326564313438383330643037333463626664633939383366
+31336636636264306262386663613235333831646630653364336539623961613066653736646433
+39663332373061643032393031653862646534656562326664336461623365646162343964383134
+37356535326238323132316562323961303766633237323934386466346532386531653735376236
+62643363643530623835313064306437366663636533646566376533393530353833656536663463
+63333038643265353134663464623835383533316662363364356436646539636233663166343034
+36613333643336353638663733623536666165643738613330396662363330613739346335323739
+38663534376539336432303466373233613233353866663435643438343232356633636466663830
+61373135666538386163653362393865313331666336633364376131626531363436323765336166
+36343339336563636464636239333332383139393831626265363839623561326365303735336630
+64366265356439303630363463353633346361323037356535646534356336633135366137373832
+39666462316633316363653135343332633435383037613430376163623839666366336137363638
+37333332313831383037623235363562363333396362346539313563626562653634656234396362
+64336464646664663237326363373834613661383832653336653365336336333630353461643863
+62333831343965646337613366373731643233396264376463306131373163393066313563656435
+37666133653839656166346161643263373361363563656130653534393830656136346362393066
+64366339626634306632626231366465393636346366353664383262306364616538643630376535
+35396266393834313664383864376537636530383738613432626266383731353331633539666331
+61376237373862636637323665343864393738653437366539373530326634353563383230636330
+65353764346535643539313835663739363765373733346435333135666439363666346635383432
+33343135643034333066326334663732633831663938383136646333653732363739616264383663
+61383237356132626362343535333934613030653036303532366663613334396565353837316534
+63623235356239323430346163356366643862356131313864393536333064643131656331313832
+61656334313231383161646330316639623234333762613066643039366638396339373632633337
+66656163623739353539363466653332393733643239633261666633343431376263383366376333
+39366164376233316331633234656636363062366431386434376563333065396561333539313135
+34663331346131616239386465343833613331306235643463623133616239396633346463623534
+61353336623763376631633365636664356130373236353338663364356634373865343230366462
+63316637626131363862353938316537376231653865356132663534643734653135633139306163
+32326139393337623763386466383236303263616131343564313534346639623437373232343932
+38646664633536646333323164396638313632663061313330303066636339656538303339663133
+39336364396430663431616535306131363363383332646364663230636331616437303939633061
+33383633633861613739626432613538383433306236373437386333303530386137333765346437
+35363035356230653034353934626562306238393033336531386237376164323766633836353865
+33366337386535613765363762663561326530363935353437336235363437333365646263363032
+61636139303466323234313430326231363165353933313961666661316536313166653339653134
+37383935363964343733643039663462666233326663313131343436333035643237646432306361
+62363535663164303438383734326130376131363238366136656137366533363238313536363333
+38663962373531633161336230336662346563633665376562666265363130626564646538336436
+35356564653562363338323165626263376237636662666461383062663937366164373033646363
+30643464666666386137363662393362366463336464373735343364303665363565323031353734
+66373663376436613661396136336230636664363264383932396239366534336363323030616632
+64336563313364663736323963346465343936363464343936633465313965306430303966326431
+65333665666565633463613634306639613132326434616461346536366336393431633937386262
+63376362623363613534393333623961363765383039656437393539353334666665653264653038
+65646361333065383238353265353738653937396232336333656632323739363536626533386330
+3335

diff --git a/deploy/host_vars/schrotti.yml b/deploy/host_vars/schrotti.yml
new file mode 100644 (file)
index 0000000..909edd5
--- /dev/null
+++ b/deploy/host_vars/schrotti.yml
@@ -0,0 +1,25 @@
+$ANSIBLE_VAULT;1.1;AES256
+61383139326533373935633762383835393663643065646662376334646139363434396662633634
+3936316466376531623562623161313730346238663664620a313231376462623662393933653864
+38643163616336316339363164636236303663376466383230663434326335626163616366653164
+3439346463623033660a393436306639363663643633376535303532626336306661616433303636
+30383634656162316533376165393064393838323631343538303466316534663232383139333139
+34643764366636626532306137653463653236343064353536616435653032333863326337663332
+31303230626163393034346537393434363137353930383034316137363535313666653563336238
+64363334386536383763383834323331613032346630386533656234336538333530363065663434
+37363530323831646531363932653138356561366562316535656432663064303661666661313766
+64323233623863656239363763616163656438333934616338643839386132393832333064666333
+33316262303736376565646661336431343734396335616465613164616333616662633733616237
+37303933663333663161653263396161636361363632623934383331626261373862316661363262
+66376533613035363433366430353335386537303166346131396335373366613831613361373266
+63653961343563316663386663363537366530326564373136373830346138613537613332396465
+31656362383632323035656238373333663933663161346234343062393139356439616537653934
+30383763353766303536303063323138643032333334396138636630373239343261656164626530
+31333639646232306638353732623438306436373532376566623834383862353639366163353866
+34333863623638333866626461303839353537616134343962303833376234396131313863323939
+31623632376436303133303137666162366134346634383566613064343765656465653138646366
+61653537313735636163373435316531666261643836336636353330623339326335613365343332
+37383031366338343932383165353333643835613339333933343836393761376536313539346363
+63393061363134326363663264646466613966393365393164383965666337633638626464346633
+37646331383165346666396436623466626336386137363639326465633533326135666432323332
+39663137636266623830

diff --git a/deploy/hosts b/deploy/hosts
new file mode 100644 (file)
index 0000000..4c0a88c
--- /dev/null
+++ b/deploy/hosts
@@ -0,0 +1,5 @@
+[bots]
+# aero2k.de ansible_host=2a01:4f8:d16:130c::2 ansible_become_method=su
+aero2k.de ansible_host=aero2k.de ansible_become_method=su
+# schrotti ansible_host=srv28081.blue.kundencontroller.de ansible_become_method=su
+# munin

diff --git a/deploy/known_hosts b/deploy/known_hosts
new file mode 100644 (file)
index 0000000..a7c5404
--- /dev/null
+++ b/deploy/known_hosts
@@ -0,0 +1 @@
+aero2k.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTteMwYQ5+SEi6FnsS5T0kLmFbm6SMygxE6Es9b9cQR