Morphit Team
9cb6cfb77b
Some checks failed
morphit-release / Build + publish release tarball (push) Has been cancelled
111 lines
5.2 KiB
YAML
111 lines
5.2 KiB
YAML
# Role: vendor
|
|
#
|
|
# Offline-appliance preflight. When the self-contained bundle ships a local apt
|
|
# repo under {{ morphit_local_source_path }}/vendor/apt, redirect apt to install ONLY
|
|
# from it — so every apt step in every later role works with no internet.
|
|
#
|
|
# HOW (and why it is safe): a reversible /etc/apt/apt.conf.d override points apt
|
|
# at the bundled repo and ignores the online sources for the duration of the
|
|
# install. It does NOT edit or move the operator's /etc/apt/sources.list* — so
|
|
# nothing is lost — and morphit-first-online removes the override (and refreshes
|
|
# apt) the moment the box is online, restoring normal package updates.
|
|
#
|
|
# Every task is gated on the bundle actually being present, so on an ordinary
|
|
# online install this whole role is a no-op.
|
|
---
|
|
- name: Detect the bundled apt repo
|
|
ansible.builtin.stat:
|
|
path: "{{ morphit_local_source_path }}/vendor/apt/Packages.gz"
|
|
register: morphit_vendor_apt
|
|
|
|
# cp679 — the offline redirect below points apt at ONLY the bundled local repo,
|
|
# which makes Linux Mint's Update Manager report "Please switch to another Linux
|
|
# Mint mirror / Your APT configuration is corrupt" for the duration of the
|
|
# install. That is fine for a genuinely air-gapped box (there are no mirrors to
|
|
# reach anyway, and morphit-first-online restores apt once online), but an
|
|
# ONLINE operator installing from the bundle got the scary warning for no reason.
|
|
# So we only redirect when the box actually cannot reach its apt mirrors. Online,
|
|
# apt keeps its normal mirrors (Update Manager stays happy) and the bundle is
|
|
# still used for its node_modules (npm ci is skipped) and .deb closure fallback.
|
|
- name: Probe whether the OS apt mirrors are reachable (online vs air-gapped)
|
|
ansible.builtin.uri:
|
|
url: "http://archive.ubuntu.com/ubuntu/dists/{{ morphit_ubuntu_codename | default('noble') }}/Release"
|
|
method: HEAD
|
|
timeout: 8
|
|
status_code: [200, 301, 302, 304]
|
|
register: morphit_apt_mirror_probe
|
|
failed_when: false
|
|
changed_when: false
|
|
when: morphit_vendor_apt.stat.exists
|
|
|
|
- name: Decide whether to use the bundled apt repo (bundle present AND mirrors unreachable)
|
|
ansible.builtin.set_fact:
|
|
morphit_use_bundled_apt: >-
|
|
{{ morphit_vendor_apt.stat.exists
|
|
and (morphit_apt_mirror_probe.status | default(0) | int) not in [200, 301, 302, 304] }}
|
|
|
|
- name: Online box with a bundle — keep normal apt mirrors (no redirect)
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
A bundle is present but this box can reach its apt mirrors, so apt keeps using
|
|
them — no redirect, and your Update Manager stays normal. The bundled
|
|
node_modules are still used, so npm ci is skipped.
|
|
when:
|
|
- morphit_vendor_apt.stat.exists
|
|
- not (morphit_use_bundled_apt | bool)
|
|
|
|
- name: Offline apt — redirect to the bundled local repo (only when genuinely air-gapped)
|
|
when: morphit_use_bundled_apt | bool
|
|
block:
|
|
- name: Mark this run as an offline (bundled) install
|
|
# Later roles gate third-party apt-repo setup (e.g. bunkerweb's Docker repo,
|
|
# which downloads a GPG key from download.docker.com) on this fact. Offline
|
|
# those packages come from the bundled closure, so reaching the internet for
|
|
# a repo key must be skipped. Set only when a bundle exists; the default
|
|
# (false, in group_vars/all.yml) covers the ordinary online path.
|
|
ansible.builtin.set_fact:
|
|
morphit_offline_install: true
|
|
|
|
- name: Ensure an empty sources.list.d dir for the offline override
|
|
ansible.builtin.file:
|
|
path: "{{ morphit_local_source_path }}/vendor/apt/empty-parts"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Write the local-repo one-line apt source
|
|
ansible.builtin.copy:
|
|
dest: "{{ morphit_local_source_path }}/vendor/apt/morphit-offline.list"
|
|
content: "deb [trusted=yes] file://{{ morphit_local_source_path }}/vendor/apt ./\n"
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Redirect apt to ONLY the local repo (reversible; /etc/apt/sources.list* untouched)
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/99-morphit-offline.conf
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
content: |
|
|
// Managed by Morphit's offline-appliance install. Redirects apt to the
|
|
// bundled local repo so apt works with no internet. morphit-first-online
|
|
// deletes this file and refreshes apt once the box is online, restoring
|
|
// normal package updates. Removing this file by hand also restores normal apt.
|
|
Dir::Etc::SourceList "{{ morphit_local_source_path }}/vendor/apt/morphit-offline.list";
|
|
Dir::Etc::SourceParts "{{ morphit_local_source_path }}/vendor/apt/empty-parts";
|
|
APT::Sandbox::User "root";
|
|
Acquire::Languages "none";
|
|
|
|
- name: Refresh apt from the local repo
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
changed_when: false
|
|
|
|
- name: Note that offline apt is active
|
|
ansible.builtin.debug:
|
|
msg: >-
|
|
Offline install: apt is using the bundled local repo at
|
|
{{ morphit_local_source_path }}/vendor/apt. Nothing reaches the network for packages.
|
|
morphit-first-online restores normal apt when this box is online.
|