Initial commit

enroll/manifest.py

@@ -0,0 +1,392 @@
+from __future__ import annotations
+
+import json
+import os
+import shutil
+from typing import Any, Dict, List
+
+
+def _yaml_list(items: List[str], indent: int = 2) -> str:
+    pad = " " * indent
+    if not items:
+        return f"{pad}[]"
+    return "\n".join(f"{pad}- {x}" for x in items)
+
+
+def _copy_artifacts(bundle_dir: str, role: str, role_dir: str) -> None:
+    artifacts_dir = os.path.join(bundle_dir, "artifacts", role)
+    if not os.path.isdir(artifacts_dir):
+        return
+    for root, _, files in os.walk(artifacts_dir):
+        for fn in files:
+            src = os.path.join(root, fn)
+            rel = os.path.relpath(src, artifacts_dir)
+            dst = os.path.join(role_dir, "files", rel)
+            os.makedirs(os.path.dirname(dst), exist_ok=True)
+            shutil.copy2(src, dst)
+
+
+def _write_role_scaffold(role_dir: str) -> None:
+    os.makedirs(os.path.join(role_dir, "tasks"), exist_ok=True)
+    os.makedirs(os.path.join(role_dir, "handlers"), exist_ok=True)
+    os.makedirs(os.path.join(role_dir, "defaults"), exist_ok=True)
+    os.makedirs(os.path.join(role_dir, "meta"), exist_ok=True)
+    os.makedirs(os.path.join(role_dir, "files"), exist_ok=True)
+
+
+def _write_playbook(path: str, roles: List[str]) -> None:
+    pb_lines = ["---", "- hosts: all", "  become: true", "  roles:"]
+    for r in roles:
+        pb_lines.append(f"    - {r}")
+    with open(path, "w", encoding="utf-8") as f:
+        f.write("\n".join(pb_lines) + "\n")
+
+
+def manifest(bundle_dir: str, out_dir: str) -> None:
+    state_path = os.path.join(bundle_dir, "state.json")
+    with open(state_path, "r", encoding="utf-8") as f:
+        state = json.load(f)
+
+    services: List[Dict[str, Any]] = state.get("services", [])
+    package_roles: List[Dict[str, Any]] = state.get("package_roles", [])
+    users_snapshot: Dict[str, Any] = state.get("users", {})
+
+    os.makedirs(out_dir, exist_ok=True)
+    roles_root = os.path.join(out_dir, "roles")
+    os.makedirs(roles_root, exist_ok=True)
+
+    manifested_users_roles: List[str] = []
+    manifested_service_roles: List[str] = []
+    manifested_pkg_roles: List[str] = []
+
+    # -------------------------
+    # Users role (non-system users)
+    # -------------------------
+    if users_snapshot and users_snapshot.get("users"):
+        role = users_snapshot.get("role_name", "users")
+        role_dir = os.path.join(roles_root, role)
+        _write_role_scaffold(role_dir)
+        _copy_artifacts(bundle_dir, role, role_dir)
+
+        users = users_snapshot.get("users", [])
+        managed_files = users_snapshot.get("managed_files", [])
+        excluded = users_snapshot.get("excluded", [])
+        notes = users_snapshot.get("notes", [])
+
+        # Build group set from users
+        group_names = set()
+        for u in users:
+            pg = u.get("primary_group")
+            if pg:
+                group_names.add(pg)
+            for g in u.get("supplementary_groups", []) or []:
+                group_names.add(g)
+        group_names = sorted(group_names)
+
+        # defaults: store users list (handy for later), but tasks are explicit for readability
+        defaults = """---
+users_accounts:
+""" + ("\n".join([f"  - name: {u.get('name')}" for u in users]) + "\n")
+        with open(os.path.join(role_dir, "defaults", "main.yml"), "w", encoding="utf-8") as f:
+            f.write(defaults)
+
+        with open(os.path.join(role_dir, "meta", "main.yml"), "w", encoding="utf-8") as f:
+            f.write("---\ndependencies: []\n")
+
+        # tasks
+        lines: List[str] = ["---"]
+        # groups first (idempotent; safe even if already present)
+        for g in group_names:
+            lines.append(f"- name: Ensure group {g} exists")
+            lines.append("  ansible.builtin.group:")
+            lines.append(f"    name: {g}")
+            lines.append("    state: present")
+
+        # users
+        for u in users:
+            name = u["name"]
+            lines.append(f"- name: Ensure user {name} exists")
+            lines.append("  ansible.builtin.user:")
+            lines.append(f"    name: {name}")
+            lines.append(f"    uid: {u.get('uid')}")
+            lines.append(f"    group: {u.get('primary_group')}")
+            supp = u.get("supplementary_groups") or []
+            if supp:
+                lines.append("    groups: " + ",".join(supp))
+                lines.append("    append: true")
+            lines.append(f"    home: {u.get('home')}")
+            lines.append("    create_home: true")
+            if u.get("shell"):
+                lines.append(f"    shell: {u.get('shell')}")
+            if u.get("gecos"):
+                # quote to avoid YAML surprises
+                gec = u.get("gecos").replace('"', '\"')
+                lines.append(f'    comment: "{gec}"')
+            lines.append("    password_lock: true")
+            lines.append("    state: present")
+
+            # Ensure ~/.ssh
+            home = u.get("home") or f"/home/{name}"
+            sshdir = home.rstrip("/") + "/.ssh"
+            lines.append(f"- name: Ensure {name} .ssh directory exists")
+            lines.append("  ansible.builtin.file:")
+            lines.append(f"    path: {sshdir}")
+            lines.append("    state: directory")
+            lines.append(f"    owner: {name}")
+            lines.append(f"    group: {u.get('primary_group')}")
+            lines.append("    mode: '0700'")
+
+        # Copy harvested SSH public material (authorized_keys + *.pub)
+        for mf in managed_files:
+            dest = mf["path"]
+            src = mf["src_rel"]
+            # Determine file owner from dest path: /home/<user>/...
+            owner = None
+            for u in users:
+                if dest.startswith((u.get("home") or "").rstrip("/") + "/"):
+                    owner = u["name"]
+                    group = u.get("primary_group")
+                    break
+            if owner is None:
+                # fallback: try /home/<user>/
+                parts = dest.split("/")
+                owner = parts[2] if len(parts) > 2 and parts[1] == "home" else "root"
+                group = owner
+
+            mode = "0600" if mf.get("reason") == "authorized_keys" else "0644"
+            lines.append(f"- name: Deploy {dest}")
+            lines.append("  ansible.builtin.copy:")
+            lines.append(f"    src: {src}")
+            lines.append(f"    dest: {dest}")
+            lines.append(f"    owner: {owner}")
+            lines.append(f"    group: {group}")
+            lines.append(f"    mode: '{mode}'")
+
+        tasks = "\n".join(lines).rstrip() + "\n"
+        with open(os.path.join(role_dir, "tasks", "main.yml"), "w", encoding="utf-8") as f:
+            f.write(tasks)
+
+        # handlers (none needed)
+        with open(os.path.join(role_dir, "handlers", "main.yml"), "w", encoding="utf-8") as f:
+            f.write("---\n")
+
+        readme = """# users
+
+Generated non-system user accounts and SSH public material.
+
+## Users
+""" + ("\n".join([f"- {u.get('name')} (uid {u.get('uid')})" for u in users]) or "- (none)") + """\n
+## Included SSH files
+""" + ("\n".join([f"- {mf.get('path')} ({mf.get('reason')})" for mf in managed_files]) or "- (none)") + """\n
+## Excluded
+""" + ("\n".join([f"- {e.get('path')} ({e.get('reason')})" for e in excluded]) or "- (none)") + """\n
+## Notes
+""" + ("\n".join([f"- {n}" for n in notes]) or "- (none)") + """\n"""
+        with open(os.path.join(role_dir, "README.md"), "w", encoding="utf-8") as f:
+            f.write(readme)
+
+        manifested_users_roles.append(role)
+
+    # -------------------------
+    # Service roles
+    # -------------------------
+    for svc in services:
+        role = svc["role_name"]
+        unit = svc["unit"]
+        pkgs = svc["packages"]
+        managed_files = svc["managed_files"]
+
+        role_dir = os.path.join(roles_root, role)
+        _write_role_scaffold(role_dir)
+        _copy_artifacts(bundle_dir, role, role_dir)
+
+        var_prefix = role
+
+        defaults = f"""---
+{var_prefix}_packages:
+{_yaml_list(pkgs, indent=2)}
+"""
+        with open(os.path.join(role_dir, "defaults", "main.yml"), "w", encoding="utf-8") as f:
+            f.write(defaults)
+
+        handlers = """---
+- name: systemd daemon-reload
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Restart service
+  ansible.builtin.service:
+    name: "{{ unit_name }}"
+    state: restarted
+"""
+        with open(os.path.join(role_dir, "handlers", "main.yml"), "w", encoding="utf-8") as f:
+            f.write(handlers)
+
+        systemd_files = [mf for mf in managed_files if mf["path"].startswith("/etc/systemd/system/")]
+        other_files = [mf for mf in managed_files if mf not in systemd_files]
+
+        def copy_task(mf: Dict[str, Any], notify: str | None) -> str:
+            notify_line = f"  notify: {notify}\n" if notify else ""
+            return f"""- name: Deploy {mf["path"]}
+  ansible.builtin.copy:
+    src: "{mf["src_rel"]}"
+    dest: "{mf["path"]}"
+    owner: "{mf["owner"]}"
+    group: "{mf["group"]}"
+    mode: "{mf["mode"]}"
+{notify_line}"""
+
+        task_parts: List[str] = []
+        task_parts.append(f"""---
+- name: Set unit name
+  ansible.builtin.set_fact:
+    unit_name: "{unit}"
+
+- name: Install packages for {role}
+  ansible.builtin.apt:
+    name: "{{{{ {var_prefix}_packages }}}}"
+    state: present
+    update_cache: true
+  when: {var_prefix}_packages | length > 0
+""")
+
+        if systemd_files:
+            for mf in systemd_files:
+                task_parts.append(copy_task(mf, "[systemd daemon-reload]"))
+            task_parts.append("""- name: Reload systemd to pick up unit changes
+  ansible.builtin.meta: flush_handlers
+""")
+
+        for mf in other_files:
+            task_parts.append(copy_task(mf, "[Restart service]"))
+
+        task_parts.append(f"""- name: Ensure {unit} is enabled and running
+  ansible.builtin.service:
+    name: "{{{{ unit_name }}}}"
+    enabled: true
+    state: started
+""")
+
+        tasks = "\n".join(task_parts).rstrip() + "\n"
+        with open(os.path.join(role_dir, "tasks", "main.yml"), "w", encoding="utf-8") as f:
+            f.write(tasks)
+
+        with open(os.path.join(role_dir, "meta", "main.yml"), "w", encoding="utf-8") as f:
+            f.write("---\ndependencies: []\n")
+
+        excluded = svc.get("excluded", [])
+        notes = svc.get("notes", [])
+        readme = f"""# {role}
+
+Generated from `{unit}`.
+
+## Packages
+{os.linesep.join("- " + p for p in pkgs) or "- (none detected)"}
+
+## Managed files
+{os.linesep.join("- " + mf["path"] + " (" + mf["reason"] + ")" for mf in managed_files) or "- (none)"}
+
+## Excluded (possible secrets / unsafe)
+{os.linesep.join("- " + e["path"] + " (" + e["reason"] + ")" for e in excluded) or "- (none)"}
+
+## Notes
+{os.linesep.join("- " + n for n in notes) or "- (none)"}
+"""
+        with open(os.path.join(role_dir, "README.md"), "w", encoding="utf-8") as f:
+            f.write(readme)
+
+        manifested_service_roles.append(role)
+
+    # -------------------------
+    # Manual package roles
+    # -------------------------
+    for pr in package_roles:
+        role = pr["role_name"]
+        pkg = pr["package"]
+        managed_files = pr["managed_files"]
+
+        role_dir = os.path.join(roles_root, role)
+        _write_role_scaffold(role_dir)
+        _copy_artifacts(bundle_dir, role, role_dir)
+
+        var_prefix = role
+
+        defaults = f"""---
+{var_prefix}_packages:
+  - {pkg}
+"""
+        with open(os.path.join(role_dir, "defaults", "main.yml"), "w", encoding="utf-8") as f:
+            f.write(defaults)
+
+        handlers = """---
+- name: systemd daemon-reload
+  ansible.builtin.systemd:
+    daemon_reload: true
+"""
+        with open(os.path.join(role_dir, "handlers", "main.yml"), "w", encoding="utf-8") as f:
+            f.write(handlers)
+
+        systemd_files = [mf for mf in managed_files if mf["path"].startswith("/etc/systemd/system/")]
+        other_files = [mf for mf in managed_files if mf not in systemd_files]
+
+        def copy_task(mf: Dict[str, Any], notify: str | None) -> str:
+            notify_line = f"  notify: {notify}\n" if notify else ""
+            return f"""- name: Deploy {mf["path"]}
+  ansible.builtin.copy:
+    src: "{mf["src_rel"]}"
+    dest: "{mf["path"]}"
+    owner: "{mf["owner"]}"
+    group: "{mf["group"]}"
+    mode: "{mf["mode"]}"
+{notify_line}"""
+
+        task_parts: List[str] = []
+        task_parts.append(f"""---
+- name: Install manual package {pkg}
+  ansible.builtin.apt:
+    name: "{{{{ {var_prefix}_packages }}}}"
+    state: present
+    update_cache: true
+""")
+
+        if systemd_files:
+            for mf in systemd_files:
+                task_parts.append(copy_task(mf, "[systemd daemon-reload]"))
+            task_parts.append("""- name: Reload systemd to pick up unit changes
+  ansible.builtin.meta: flush_handlers
+""")
+
+        for mf in other_files:
+            task_parts.append(copy_task(mf, None))
+
+        tasks = "\n".join(task_parts).rstrip() + "\n"
+        with open(os.path.join(role_dir, "tasks", "main.yml"), "w", encoding="utf-8") as f:
+            f.write(tasks)
+
+        with open(os.path.join(role_dir, "meta", "main.yml"), "w", encoding="utf-8") as f:
+            f.write("---\ndependencies: []\n")
+
+        excluded = pr.get("excluded", [])
+        notes = pr.get("notes", [])
+        readme = f"""# {role}
+
+Generated for manual package `{pkg}`.
+
+## Managed files
+{os.linesep.join("- " + mf["path"] + " (" + mf["reason"] + ")" for mf in managed_files) or "- (none)"}
+
+## Excluded (possible secrets / unsafe)
+{os.linesep.join("- " + e["path"] + " (" + e["reason"] + ")" for e in excluded) or "- (none)"}
+
+## Notes
+{os.linesep.join("- " + n for n in notes) or "- (none)"}
+
+> Note: package roles do not attempt to restart or enable services automatically.
+"""
+        with open(os.path.join(role_dir, "README.md"), "w", encoding="utf-8") as f:
+            f.write(readme)
+
+        manifested_pkg_roles.append(role)
+
+    # Playbooks
+    _write_playbook(os.path.join(out_dir, "playbook.yml"), manifested_users_roles + manifested_pkg_roles + manifested_service_roles)