From c5d55e1f33c7f5ca3d84fc2a2de5e60b4f4995b7 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Wed, 24 Jan 2024 15:42:31 +0100
Subject: whawty/auth/store: sync make use of ssh master connections

---
 roles/whawty/auth/store/tasks/sync-client.yml      | 34 +++++++++++++++++-----
 .../whawty/auth/store/templates/systemd.service.j2 | 14 ++-------
 roles/whawty/auth/store/templates/systemd.timer.j2 | 11 -------
 3 files changed, 29 insertions(+), 30 deletions(-)
 delete mode 100644 roles/whawty/auth/store/templates/systemd.timer.j2

(limited to 'roles')

diff --git a/roles/whawty/auth/store/tasks/sync-client.yml b/roles/whawty/auth/store/tasks/sync-client.yml
index 92657312..15b6f1ac 100644
--- a/roles/whawty/auth/store/tasks/sync-client.yml
+++ b/roles/whawty/auth/store/tasks/sync-client.yml
@@ -16,6 +16,9 @@
       IdentityFile /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/id_ed25519
       IdentitiesOnly yes
       UserKnownHostsFile /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts
+      ControlMaster auto
+      ControlPath /run/ssh-master.whawty-auth-store-sync-{{ whawty_auth_store.name }}
+      ControlPersist 300
     dest: "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config"
 
 - name: generate ssh keypair for sync client
@@ -24,22 +27,39 @@
     type: ed25519
     comment: "whawty-auth-sync-{{ whawty_auth_store.name }}@{{ inventory_hostname }}"
 
+- name: generate sync script
+  copy:
+    content: |
+      #!/bin/bash
+      {% set rsync_args = [] %}
+      {% if 'permissions' in whawty_auth_store %}
+      {%   if 'file-mode' in whawty_auth_store.permissions %}
+      {%     set _dummy = rsync_args.append(" --chmod=F"~whawty_auth_store.permissions['file-mode']) %}
+      {%   endif %}
+      {%   if 'owner' in whawty_auth_store.permissions %}
+      {%     set _dummy = rsync_args.append(" --chown="~whawty_auth_store.permissions.owner~":"~whawty_auth_store.permissions.group) %}
+      {%   endif %}
+      {% endif %}
+      while true; do
+        /usr/bin/rsync -rtW --delete --delete-delay --delay-updates --partial-dir=.tmp{{ rsync_args | join('') }} -e 'ssh -F "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config"' 'rsync://whawty-auth-server/store' '{{ whawty_auth_store.config.basedir }}'
+        sleep 60
+      done
+    dest: /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/run.sh
+    mode: 0755
+
 - name: generate known_hosts file
   shell: "ssh-keyscan{% if 'port' in whawty_auth_store.sync %} -p {{ whawty_auth_store.sync.port }}{% endif %} {{ whawty_auth_store.sync.hostname }} > /etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts"
   args:
     creates: "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/known_hosts"
 
 - name: install systemd units for whawty-auth store sync client
-  loop:
-  - service
-  - timer
   template:
-    src: "systemd.{{ item }}.j2"
-    dest: "/etc/systemd/system/whawty-auth-store-sync-{{ whawty_auth_store.name }}.{{ item }}"
+    src: "systemd.service.j2"
+    dest: "/etc/systemd/system/whawty-auth-store-sync-{{ whawty_auth_store.name }}.service"
 
-- name: make sure whawty-auth store sync client timer is enabled and started
+- name: make sure whawty-auth store sync client is enabled and started
   systemd:
     daemon_reload: yes
-    name: "whawty-auth-store-sync-{{ whawty_auth_store.name }}.timer"
+    name: "whawty-auth-store-sync-{{ whawty_auth_store.name }}.service"
     state: started
     enabled: yes
diff --git a/roles/whawty/auth/store/templates/systemd.service.j2 b/roles/whawty/auth/store/templates/systemd.service.j2
index 5b1db6b2..2fe45642 100644
--- a/roles/whawty/auth/store/templates/systemd.service.j2
+++ b/roles/whawty/auth/store/templates/systemd.service.j2
@@ -1,19 +1,9 @@
-{% set rsync_args = [] %}
-{% if 'permissions' in whawty_auth_store %}
-{%   if 'file-mode' in whawty_auth_store.permissions %}
-{%     set _dummy = rsync_args.append(" --chmod=F"~whawty_auth_store.permissions['file-mode']) %}
-{%   endif %}
-{%   if 'owner' in whawty_auth_store.permissions %}
-{%     set _dummy = rsync_args.append(" --chown="~whawty_auth_store.permissions.owner~":"~whawty_auth_store.permissions.group) %}
-{%   endif %}
-{% endif %}
 [Unit]
 Description=sync for whawty-auth store {{ whawty_auth_store.name }}
 
 [Service]
-Type=oneshot
-ExecStart=/usr/bin/rsync -rtW --delete --delete-delay --delay-updates --partial-dir=.tmp{{ rsync_args | join('') }} -e 'ssh -F "/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/ssh_config"' 'rsync://whawty-auth-server/store' '{{ whawty_auth_store.config.basedir }}'
-TimeoutStartSec=40s
+Type=simple
+ExecStart=/etc/whawty/auth/.store-{{ whawty_auth_store.name }}-sync/run.sh
 
 # systemd hardening-options
 AmbientCapabilities=CAP_CHOWN CAP_FOWNER
diff --git a/roles/whawty/auth/store/templates/systemd.timer.j2 b/roles/whawty/auth/store/templates/systemd.timer.j2
deleted file mode 100644
index 603295a5..00000000
--- a/roles/whawty/auth/store/templates/systemd.timer.j2
+++ /dev/null
@@ -1,11 +0,0 @@
-[Unit]
-Description=sync for whawty-auth store {{ whawty_auth_store.name }}
-
-[Timer]
-OnBootSec=30s
-OnActiveSec=5s
-OnUnitActiveSec=1m
-AccuracySec=5s
-
-[Install]
-WantedBy=timers.target
-- 
cgit v1.2.3