On Gentoo, the shebang of `ansible-playbook` is the python-exec
dispatcher (`#!/usr/bin/python-exec2c`), which bin/ansible-python.sh
took for an interpreter, because its name starts with `python`.
python-exec only runs the programs it wraps, so every `just run…`
recipe failed with "no python-exec wrapped executable found".
Now only names like `python`, `python3` or `python3.14` are trusted.
For anything else (python-exec, wrapper scripts as on Nix), Ansible is
asked which interpreter it runs on (`ansible-playbook --version`),
before falling back to `python3`, which may lack PyYAML (e.g. in an
active virtualenv).
Same as https://github.com/mother-of-all-self-hosting/mash-playbook/commit/a685940a
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
agru replaces an installed role whenever its version differs from the
pinned one, and also when the role has no install information. It
replaces a symlinked role with a fresh copy. ansible-galaxy was run on
an emptied roles/galaxy every time. Roles being worked on in
roles/galaxy could thus silently lose their changes.
bin/install-roles.py (run through bin/ansible-python.sh, so PyYAML
needs no separate installation) now decides which roles need to be
(re)installed and only passes those to agru or ansible-galaxy:
- missing roles are installed, and outdated roles are replaced
- outdated roles which were changed since they were installed are kept,
with a warning. Changes are detected by comparing the role's contents
with a checksum recorded at installation, in run/installed-roles.yml.
Roles installed before (without a checksum) are considered unchanged.
- outdated roles which were not installed by agru or ansible-galaxy
are kept, with a warning
- symlinked roles and roles containing a `.git` directory are never
touched
`just roles --force` replaces changed roles too. `just update -u` now
only updates the pinned versions with agru and leaves installing the
roles to the script, so that it keeps changed roles as well.
The same script in mash-playbook (where its tests live, and where it
also deletes the roles of services no longer in use):
https://github.com/mother-of-all-self-hosting/mash-playbook/commit/d5c5e0cehttps://github.com/mother-of-all-self-hosting/mash-playbook/commit/608a7943
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
bin/ansible-python.sh runs Python with the interpreter named in the
first line of `ansible-playbook`. That interpreter has PyYAML, since
Ansible depends on it, even when Ansible is installed in an environment
of its own (e.g. with pipx), where the system's `python3` may lack it.
If it is not a Python interpreter (e.g. `ansible-playbook` is a wrapper
script), or Ansible is missing, `python3` is used.
Role installation, which needs PyYAML, is the first to use it in the
next commit, so that it works without installing PyYAML separately.
The same script in mash-playbook (where its tests live):
https://github.com/mother-of-all-self-hosting/mash-playbook/commit/1fe0f90f
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
docs/ansible.md pins a ghcr.io/devture/ansible tag in its `docker run`
examples, which used to be bumped by hand. devture/docker-ansible now tags
releases automatically, so Renovate can propose them. The devcontainer's
Dockerfile, already seen by the dockerfile manager, gets updated in the same
pull request.
The image's tags (`<Alpine ansible package version>-<release>`) need regex
versioning: Docker versioning would treat `-r0-3` as a compatibility suffix
and never offer `-r0-4`.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A component bump touches that role's defaults/main.yml, which is on the Molecule
workflow's path filter, so the change-detection job runs that role's scenario.
The bump therefore only merges once the new version has actually been started on
the configuration the role renders. That is a real gate, and a stronger one than
a human reading a version number in a diff.
Patch only. A minor carries behaviour changes that no static rule can judge - the
MASH fleet tried a minor-automerge preset across 21 stateless roles and reverted
all of them, because reading a given release's notes is what decides it, and that
is a job for a human or an agent rather than a config file.
Branch push rather than a PR, as with the other automerge rules here.
The list has to stay in step with the roles that actually have a scenario, so
bin/check-molecule-automerge-list.py enforces it from prek. The direction that
matters is a role keeping automerge after losing its scenario: bumps would then
merge with nothing exercising them. It reports the harmless direction too, since
a role gaining a scenario without being listed is usually an oversight.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SEH3vxYSQ5SV4N5z61eyGT
`just molecule` leaves a shared virtualenv of over 500 MB under var/, plus a
~7 MB Ansible home per role that has a scenario. Neither is reclaimed by
anything today.
`--idle-days N` limits it to what has not been touched recently, so it can be
run unattended without taking the cache out from under a scenario being worked
on right now.
The two directories are named explicitly rather than globbed: var/ holds other
things and must never be removed wholesale.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SEH3vxYSQ5SV4N5z61eyGT
Scenarios install their Galaxy dependencies with `force: true`, so two roles
running at once re-extract the same collections and roles into ~/.ansible and
pull them out from under each other mid-play. It surfaces as a collection that
was working moments earlier going missing:
the connection plugin 'community.docker.docker' was not found
Found while running five scenarios in parallel, where it cost a run.
ANSIBLE_HOME relocates both `collections/` and `roles/`, so one variable covers
both halves; the scenarios' ANSIBLE_ROLES_PATH workaround now follows it rather
than hardcoding ~/.ansible/roles. Left alone if already set, and unset in CI,
where each role runs in its own job and has nothing to collide with.
Verified by removing var/molecule-ansible-home entirely and running
matrix-alertmanager-receiver from cold: green through idempotence, with the
collections and roles landing under the per-role directory - which also shows
nothing was quietly relying on the shared ~/.ansible being populated.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SEH3vxYSQ5SV4N5z61eyGT
Three things that would not have scaled to 70 roles:
- The Python and Ansible dependency pins were about to be copied into every
role. They now live once in molecule-shared/, which scenarios reference
relatively, so they cannot drift apart.
- The helper container images used for probing were hardcoded inline. They
are pinned once in molecule-shared/vars.yml, carry `# renovate:`
annotations, and a custom manager in .github/renovate.json keeps them
current - verified with a local Renovate dry run, which offers
curl 8.11.1 -> 8.21.0 and python 3.13 -> 3.14-alpine. Seventy invisible
hardcodes is the blindness class we have been removing elsewhere.
- Running a scenario meant knowing the venv and cd incantation. `just
molecule <role>` does it, and with no argument lists the roles that have
a scenario.
Molecule is deliberately not wired into prek: a run takes minutes, pulls
images and needs Docker, which is fine on request and not fine per commit.
docs/molecule-testing.md covers how to run and write these, including the
four things a role here needs that a standalone role does not. AGENTS.md
points at it rather than carrying the detail.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Since mautrix-meta v26.07, Instagram is a separate bridge upstream (its own binary, container image and configuration schema). As of v0.2608.0, the bridge no longer has a `mode` configuration option at all, so the premise of auto-generating the Instagram role from the Messenger one (one binary, one schema, a mode switch) is gone.
- Drop the role generator (`bin/rebuild-mautrix-meta-instagram.sh` and the `just rebuild-mautrix-meta-instagram` recipe). The two roles are now maintained independently.
- Drop `matrix_bridge_mautrix_meta_instagram_meta_mode` and all mode-derived lookups from the Instagram role. Computed values are unchanged.
- Sync both config templates with the v0.2608.0 example configs: the Instagram template loses `mode` and gains the Instagram-only options; the Messenger template replaces `mode` with the new `tor` option (still derived from `matrix_bridge_mautrix_meta_messenger_meta_mode: facebook-tor`) and loses the Instagram-only `disable_xma_*` options.
- Fix self-building for the Instagram role: build via `Dockerfile.ig` (producing the actual Instagram binary at `/usr/bin/mautrix-instagram`) instead of the Messenger `Dockerfile`. A new `matrix_bridge_mautrix_meta_instagram_container_binary_path` variable points the systemd service at the right binary for self-built and prebuilt images.
- Rename the systemd service templates to role-specific file names.
Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5510
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Part of adopting a uniform naming policy for bridge variables,
where the variable prefix matches the role directory name.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Running `just add-inventory-host example.com 1.2.3.4` (or
`make add-inventory-host domain=example.com ip=1.2.3.4`) adds a new
host to the inventory, creating inventory/hosts and
inventory/host_vars/matrix.DOMAIN/vars.yml from the example files,
with strong secrets generated automatically.
Existing configuration is never overwritten. The command refuses to
run if the host is already in the inventory, so it can also be used
for adding more hosts later.
Based on the idea proposed in
https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4682 by @Ser5
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
