insgtall, fix lint warning.

root, set the mode directly to avoid lint issues.
header, name most the include_tasks and reorder based on subgroups, refactoring a few file locations in some instances.
2026-10-17 17:19:33 -07:00 · 2026-10-17 17:18:51 -07:00 · 2026-10-17 17:17:49 -07:00 · 2026-10-17 17:13:49 -07:00 · 2026-10-17 17:12:36 -07:00 · 2026-10-17 17:01:59 -07:00
8 changed files with 203 additions and 50 deletions
@@ -164,7 +164,18 @@
      ;               Example: jim, bob, jeff, anne
      ;               Default: user
      ;
-      ; For pushing MASTER directories to an SFTP server with `send-master`.
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+
+- name: General | Account Management | Provisioning Configuration | General | Create | Sync Shortcuts
+  ansible.builtin.blockinfile:
+    path: "{{ gen_file }}"
+    marker: '; {mark} MANAGED BY ANSIBLE | Generic Config | Sync Shortcuts'
+    block: |
+      ;;;;;;;;;;;;;;;;;;;;;         Sync Shortcuts         ;;;;;;;;;;;;;;;;;;;;;
      ;
      ; Imagine the command:
      ;   `rsync -auPhz --delete -e 'ssh -p prod_data_port' ./mydata-MASTER/ \
@@ -193,19 +204,57 @@
    backup: true
    mode: "0644"

+- name: General | Account Management | Provisioning Configuration | General | Create | Tunnel
+  ansible.builtin.blockinfile:
+    path: "{{ gen_file }}"
+    marker: '; {mark} MANAGED BY ANSIBLE | Generic Config | Tunnel'
+    block: |
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Tunnel ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+      ;
+      ; Create a runit script which maintains an SSH tunnel to a remote server.
+      ;
+      ;        ssh -v -H -R tunnel_remote_port:localhost:tunnel_local_port \
+      ;             [-p tunnel_ssh_port] tunnel_remote_host
+      ;
+      ; tunnel_local_port (default=8080)
+      ;   Local HTTP port which need forwarded to a remote server.
+      ;     Example: http://localhost:8080
+      ;
+      ; tunnel_remote_host (default=false)
+      ;   Remote server including username (such as user@example.com) which will
+      ;   serve the port. Server should preferably have a reverse proxy in order
+      ;   to encrypt the traffic, otherwise the local server should use HTTPS.
+      ;
+      ; tunnel_remote_port (default=8080)
+      ;   Port which should host the service on the remote server. This is what
+      ;   will get typed into web browsers or used by the reverse proxy. Should
+      ;   be > 1024. Also, /etc/ssh/sshd_config will need AllowTcpForwarding and
+      ;   GatewayPorts set to yes, then sshd will need to be reloaded.
+      ;     Example: http://example.com:8080
+      ;
+      ; tunnel_ssh_port (default=22)
+      ;   Port which the remote server exposes ssh.
+      ;     Example: ssh -p 2222 user@example.com
+      ;
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+
 - name: General | Account Management | Provisioning Configuration | General | Load
  ansible.builtin.set_fact:
    provision:  "{{ lookup('ini', 'enable     file={{gen_file}} default=false') | bool }}"
-    user:       "{{ lookup('ini', 'user       file={{gen_file}} default=ling') }}"
-    user_desc:  "{{ lookup('ini', 'user_desc  file={{gen_file}} default=Hyperling') }}"
-    branch:     "{{ lookup('ini', 'branch     file={{gen_file}} default=main') }}"
+    user:       "{{ lookup('ini', 'user       file={{gen_file}} default=user' )        }}"
+    user_desc:  "{{ lookup('ini', 'user_desc  file={{gen_file}} default=User' )        }}"
+    branch:     "{{ lookup('ini', 'branch     file={{gen_file}} default=main' )        }}"
    pentesting: "{{ lookup('ini', 'pentesting file={{gen_file}} default=false') | bool }}"
    no_telem:   "{{ lookup('ini', 'no_telem   file={{gen_file}} default=false') | bool }}"
    battery:    "{{ lookup('ini', 'battery    file={{gen_file}} default=false') | bool }}"
-    swap_block: "{{ lookup('ini', 'swap_block file={{gen_file}} default=false') }}"
-    swap_count: "{{ lookup('ini', 'swap_count file={{gen_file}} default=1') | int }}"
-    swap_file:  "{{ lookup('ini', 'swap_file  file={{gen_file}} default=/swapfile') }}"
-    sshd_port:  "{{ lookup('ini', 'sshd_port  file={{gen_file}} default=22') | int }}"
+    swap_block: "{{ lookup('ini', 'swap_block file={{gen_file}} default=false')        }}"
+    swap_count: "{{ lookup('ini', 'swap_count file={{gen_file}} default=1'    ) | int  }}"
+    swap_file:  "{{ lookup('ini', 'swap_file  file={{gen_file}} default=/swapfile')    }}"
+    sshd_port:  "{{ lookup('ini', 'sshd_port  file={{gen_file}} default=22'   ) | int  }}"
    git_host:     "{{ lookup('ini', 'git_host     file={{gen_file}} default=git.hyperling.com') }}"
    git_user:     "{{ lookup('ini', 'git_user     file={{gen_file}} default=me') }}"
    git_project:  "{{ lookup('ini', 'git_project  file={{gen_file}} default=env-ansible') }}"
@@ -216,12 +265,16 @@
    prod_data_host: "{{ lookup('ini', 'prod_data_host   file={{gen_file}} default=hyperling.com') }}"
    prod_data_port: "{{ lookup('ini', 'prod_data_port   file={{gen_file}} default=22') | int }}"
    prod_data_user: "{{ lookup('ini', 'prod_data_user   file={{gen_file}} default=user') }}"
-    prod_data_dir: "{{ lookup('ini', 'prod_data_dir   file={{gen_file}} default=/srv/sftp') }}"
+    prod_data_dir:  "{{ lookup('ini', 'prod_data_dir    file={{gen_file}} default=/srv/sftp') }}"
+    tunnel_local_port:  "{{ lookup('ini', 'tunnel_local_port  file={{gen_file}} default=8080' ) | int }}"
+    tunnel_remote_host: "{{ lookup('ini', 'tunnel_remote_host file={{gen_file}} default=false')       }}"
+    tunnel_remote_port: "{{ lookup('ini', 'tunnel_remote_port file={{gen_file}} default=8080' ) | int }}"
+    tunnel_ssh_port:    "{{ lookup('ini', 'tunnel_ssh_port    file={{gen_file}} default=22'   ) | int }}"

- name: General | Account Management | Provisioning Configuration | General | Boolean Check | Swap Block
+- name: General | Account Management | Provisioning Configuration | General | Boolean Check | swap_block
  ansible.builtin.set_fact:
    swap_block: "{{ swap_block | bool }}"
-  when: swap_block in ("true", "false")
+  when: swap_block in ("false")

 - name: General | Account Management | Provisioning Configuration | General | List
  ansible.builtin.set_fact:
@@ -249,6 +302,10 @@
    - { 'prod_data_port': "{{ prod_data_port }}" }
    - { 'prod_data_user': "{{ prod_data_user }}" }
    - { 'prod_data_dir': "{{ prod_data_dir }}" }
+    - { 'tunnel_local_port': "{{ tunnel_local_port }}" }
+    - { 'tunnel_remote_host': "{{ tunnel_remote_host }}" }
+    - { 'tunnel_remote_port': "{{ tunnel_remote_port }}" }
+    - { 'tunnel_ssh_port': "{{ tunnel_ssh_port }}" }


 ## Workstation ##
@@ -435,11 +492,21 @@
    open_terminal_port:    "{{ lookup('ini', 'open_terminal_port file={{wrk_file}} default=8000' ) | int  }}"
    open_terminal_key:     "{{ lookup('ini', 'open_terminal_key  file={{wrk_file}} default=false')        }}"

- name: General | Account Management | Provisioning Configuration | Workstation | Boolean Check | Editing
+- name: General | Account Management | Provisioning Configuration | Workstation | Boolean Check | editing
  ansible.builtin.set_fact:
    editing: "{{ editing | bool }}"
  when: editing in ("true", "false")

+- name: General | Account Management | Provisioning Configuration | Workstation | Boolean Check | qwen_code_key
+  ansible.builtin.set_fact:
+    qwen_code_key: "{{ qwen_code_key | bool }}"
+  when: qwen_code_key in ("false")
+
+- name: General | Account Management | Provisioning Configuration | Workstation | Boolean Check | open_terminal_key
+  ansible.builtin.set_fact:
+    open_terminal_key: "{{ open_terminal_key | bool }}"
+  when: open_terminal_key in ("false")
+
 - name: General | Account Management | Provisioning Configuration | Workstation | List
  ansible.builtin.set_fact:
    provision_variables: "{{ provision_variables | combine(item) }}"
@@ -8,7 +8,7 @@
    mode: '0755'

 - name: General | Scripts | Install | Copy Files
-  copy:
+  ansible.builtin.copy:
    src: 'scripts/'
    dest: "{{ global_bin }}/"
    owner: root
@@ -20,6 +20,8 @@
    if [[ -e {{ global_bin }}/{{ item }} ]]; then
      rm -v {{ global_bin }}/{{ item }}
    fi
+  register: shell_check
+  changed_when: shell_check.rc == 0
  loop:
    - compress-video.sh
    - compress-images.sh
@@ -12,13 +12,8 @@
    marker_end: "exit 0"
    state: present
    create: true
-
- name: General | Scripts | Root | scm.sh Permissions
-  ansible.builtin.file:
-    path: "{{ user_root.home }}/bin/scm.sh"
    mode: '0755'

-
 - name: General | Scripts | Root | scm-dev.sh
  ansible.builtin.blockinfile:
    path: "{{ user_root.home }}/bin/scm-dev.sh"
@@ -42,8 +37,4 @@
    marker_end: "exit 0"
    state: present
    create: true
-
- name: General | Scripts | Root | scm-dev.sh Permissions
-  ansible.builtin.file:
-    path: "{{ user_root.home }}/bin/scm-dev.sh"
    mode: '0755'
@@ -35,6 +35,7 @@
    state: present
    create: true
    backup: true
+    mode: "0644"
  loop:
    - { "key": '^[\#]?AllowUsers',           "value": 'AllowUsers {{ user }}'}
    - { "key": '^[\#]?PermitRootLogin',      "value": 'PermitRootLogin no'}
@@ -60,6 +61,7 @@
    state: present
    create: true
    backup: true
+    mode: "0644"
  loop:
    - { "key": '^[\#]?AllowUsers',      "value": 'AllowUsers root {{ user }}'}
    - { "key": '^[\#]?PermitRootLogin', "value": 'PermitRootLogin yes'}
@@ -0,0 +1,74 @@
+---
+# 2026-10-17 Hyperling
+# Allow pushing a local port to a remote server automagically in a runit script.
+
+# ssh -N -p SSH_PORT -R REMOTE_PORT:localhost:LOCAL_PORT USER@REMOTE_HOST -v
+
+- name: General | Tunnel | Provisioned Variables
+  ansible.builtin.debug:
+    var: "{{ item }}"
+  loop:
+    - tunnel_local_port
+    - tunnel_remote_host
+    - tunnel_remote_port
+    - tunnel_ssh_port
+
+- name: General | Tunnel | Block
+  block:
+
+    - name: General | Tunnel | Facts
+      ansible.builtin.set_fact:
+        tunnel_service_name: tunnel
+
+    - name: General | Tunnel | mkdir | /etc/sv
+      ansible.builtin.file:
+        path: /etc/sv/{{ tunnel_service_name }}/log
+        state: directory
+        mode: "0755"
+
+    - name: General | Tunnel | mkdir | /var/log
+      ansible.builtin.file:
+        path: /var/log/{{ tunnel_service_name }}
+        state: directory
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Run
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ tunnel_service_name }}/run
+        content: |
+          #!/bin/sh -e
+          exec 2>&1
+          exec chpst -u {{ user }} ssh -v -N \
+            -R {{ tunnel_remote_port }}:localhost:{{ tunnel_local_port }} \
+            -p {{ tunnel_ssh_port }} {{ tunnel_remote_host }}
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Finish
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ tunnel_service_name }}/finish
+        content: |
+          {{ runit_finish_sleep }}
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Log
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ tunnel_service_name }}/log/run
+        content: |
+          #!/bin/sh -e
+          exec svlogd -tt /var/log/{{ tunnel_service_name }}
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Log Config
+      ansible.builtin.copy:
+        dest: /var/log/{{ tunnel_service_name }}/config
+        content: |
+          {{ runit_log_config_10mb }}
+        mode: "0755"
+
+  when: tunnel_remote_host != "false"
+
+- name: General | Tunnel | Service | Enable
+  ansible.builtin.service:
+    name: "{{ tunnel_service_name }}"
+    state: "{{ 'started' if tunnel_remote_host else 'stopped' }}"
+    enabled: "{{ true if tunnel_remote_host else false }}"
@@ -106,57 +106,74 @@
 - name: Main | General
  block:

-    - name: Main | General | Swap
-      ansible.builtin.include_tasks: tasks/general/software/swap.yml
-
-    - name: Main | General | runit
+    - name: Main | General | Software | runit
      ansible.builtin.include_tasks: tasks/general/software/runit.yml

-    - name: Main | General | Packages
+    - name: Main | General | Software | Packages
      ansible.builtin.include_tasks: tasks/general/software/packages.yml
      when: internet

-    - name: Main | General | Services
-      ansible.builtin.include_tasks: tasks/general/software/services.yml
+    - name: Main | General | Software | AUR
+      ansible.builtin.include_tasks: tasks/general/software/aur.yml
+      when: internet and ansible_pkg_mgr == "pacman"

-    - name: Main | General | Sendmail
+    - name: Main | General | Software | Sendmail
      ansible.builtin.include_tasks: tasks/general/software/sendmail.yml
      when: ansible_system == "FreeBSD"
        and internet

-    - ansible.builtin.include_tasks: tasks/general/software/aur.yml
-      when: internet and ansible_pkg_mgr == "pacman"
+    - name: Main | General | Software | Metasploit
+      ansible.builtin.include_tasks: tasks/general/software/metasploit.yml
+      when: internet

    # Gather again in case missing programs have now been installed.
-    - ansible.builtin.include_tasks: facts/general/gather.yml
+    - name: Main | General | Facts [Again]
+      ansible.builtin.include_tasks: facts/general/gather.yml

-    - ansible.builtin.include_tasks: tasks/general/settings/keyboard.yml
+    - name: Main | General | Settings | Swap
+      ansible.builtin.include_tasks: tasks/general/settings/swap.yml

-    - ansible.builtin.include_tasks: tasks/general/acct_mgmt/groups.yml
+    - name: Main | General | Settings | Services
+      ansible.builtin.include_tasks: tasks/general/settings/services.yml

-    - ansible.builtin.include_tasks: tasks/general/acct_mgmt/users.yml
+    - name: Main | General | Settings | Tunnel
+      ansible.builtin.include_tasks: tasks/general/settings/tunnel.yml

-    - ansible.builtin.include_tasks: tasks/general/acct_mgmt/sudo.yml
+    - name: Main | General | Settings | Keyboard
+      ansible.builtin.include_tasks: tasks/general/settings/keyboard.yml

-    - ansible.builtin.include_tasks: tasks/general/acct_mgmt/doas.yml
+    - name: Main | General | Accounts | Groups
+      ansible.builtin.include_tasks: tasks/general/acct_mgmt/groups.yml
+
+    - name: Main | General | Accounts | Users
+      ansible.builtin.include_tasks: tasks/general/acct_mgmt/users.yml
+
+    - name: Main | General | Accounts | sudo
+      ansible.builtin.include_tasks: tasks/general/acct_mgmt/sudo.yml
+
+    - name: Main | General | Accounts | doas
+      ansible.builtin.include_tasks: tasks/general/acct_mgmt/doas.yml
      when: internet

-    - ansible.builtin.include_tasks: tasks/general/software/env-shared.yml
+    - name: Main | General | Scripts | Root
+      ansible.builtin.include_tasks: tasks/general/scripts/root.yml
+
+    - name: Main | General | Scripts | User
+      ansible.builtin.include_tasks: tasks/general/scripts/user.yml
+
+    - name: Main | General | Scripts | Local
+      ansible.builtin.include_tasks: tasks/general/scripts/install.yml
+
+    - name: Main | General | Scripts | env-shared
+      ansible.builtin.include_tasks: tasks/general/scripts/env-shared.yml
      when: internet

-    - ansible.builtin.include_tasks: tasks/general/scripts/root.yml
-
-    - ansible.builtin.include_tasks: tasks/general/scripts/user.yml
-
-    - ansible.builtin.include_tasks: tasks/general/scripts/install.yml
-
-    - ansible.builtin.include_tasks: tasks/general/cron/ansible.yml
+    - name: Main | General | Cron | Ansible
+      ansible.builtin.include_tasks: tasks/general/cron/ansible.yml

    # TODO Need to refactor. Maybe tasks/general/cron/freebsd.yml
-    - ansible.builtin.include_tasks: tasks/workstation/freebsd/cron/ansible.yml
+    - name: Main | General | Cron | Ansible [FreeBSD]
+      ansible.builtin.include_tasks: tasks/workstation/freebsd/cron/ansible.yml
      when: ansible_system == "FreeBSD"

-    - ansible.builtin.include_tasks: tasks/general/software/metasploit.yml
-      when: internet
-
  when: provision
Author	SHA1	Message	Date
me	4ae411584e	insgtall, fix lint warning.	2026-10-17 17:19:33 -07:00
me	2dccea21ae	root, set the mode directly to avoid lint issues.	2026-10-17 17:18:51 -07:00
me	32916ad470	header, name most the include_tasks and reorder based on subgroups, refactoring a few file locations in some instances.	2026-10-17 17:17:49 -07:00
me	8b4329d129	header, add tunnel.	2026-10-17 17:13:49 -07:00
me	ec60e9f5f7	test, remove tunnel.	2026-10-17 17:12:36 -07:00
me	edffe124fd	services, set modes of edited files.	2026-10-17 17:01:59 -07:00
me	1de11bc2d9	tunnel, fix the ssh command.	2026-10-17 16:57:25 -07:00
me	44a0463ab8	tunnel, enable the service and fix folder permissions.	2026-10-17 16:52:04 -07:00
me	9a1004dfb9	provision, refactor and ensure false keys are actually False.	2026-10-17 16:47:02 -07:00
me	607129e1c2	tunnel, fix outer if statement.	2026-10-17 16:46:37 -07:00
me	48c6f54903	test, add tunnel to the list.	2026-10-17 16:24:18 -07:00
me	1278c5020f	tunnel, implement the playbook.	2026-10-17 16:24:10 -07:00
me	11cac42df8	provision, add section for tunnel.	2026-10-17 16:21:21 -07:00
me	feb1985755	Add a tunnel file for forwarding ports as a runit service.	2026-10-17 15:35:03 -07:00