insgtall, fix lint warning.

tasks/general/acct_mgmt/provision_config.yml

@@ -164,7 +164,18 @@
       ;               Example: jim, bob, jeff, anne
       ;               Default: user
       ;
-      ; For pushing MASTER directories to an SFTP server with `send-master`.
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+
+- name: General | Account Management | Provisioning Configuration | General | Create | Sync Shortcuts
+  ansible.builtin.blockinfile:
+    path: "{{ gen_file }}"
+    marker: '; {mark} MANAGED BY ANSIBLE | Generic Config | Sync Shortcuts'
+    block: |
+      ;;;;;;;;;;;;;;;;;;;;;         Sync Shortcuts         ;;;;;;;;;;;;;;;;;;;;;
       ;
       ; Imagine the command:
       ;   `rsync -auPhz --delete -e 'ssh -p prod_data_port' ./mydata-MASTER/ \
@@ -193,11 +204,49 @@
     backup: true
     mode: "0644"
 
+- name: General | Account Management | Provisioning Configuration | General | Create | Tunnel
+  ansible.builtin.blockinfile:
+    path: "{{ gen_file }}"
+    marker: '; {mark} MANAGED BY ANSIBLE | Generic Config | Tunnel'
+    block: |
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Tunnel ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+      ;
+      ; Create a runit script which maintains an SSH tunnel to a remote server.
+      ;
+      ;        ssh -v -H -R tunnel_remote_port:localhost:tunnel_local_port \
+      ;             [-p tunnel_ssh_port] tunnel_remote_host
+      ;
+      ; tunnel_local_port (default=8080)
+      ;   Local HTTP port which need forwarded to a remote server.
+      ;     Example: http://localhost:8080
+      ;
+      ; tunnel_remote_host (default=false)
+      ;   Remote server including username (such as user@example.com) which will
+      ;   serve the port. Server should preferably have a reverse proxy in order
+      ;   to encrypt the traffic, otherwise the local server should use HTTPS.
+      ;
+      ; tunnel_remote_port (default=8080)
+      ;   Port which should host the service on the remote server. This is what
+      ;   will get typed into web browsers or used by the reverse proxy. Should
+      ;   be > 1024. Also, /etc/ssh/sshd_config will need AllowTcpForwarding and
+      ;   GatewayPorts set to yes, then sshd will need to be reloaded.
+      ;     Example: http://example.com:8080
+      ;
+      ; tunnel_ssh_port (default=22)
+      ;   Port which the remote server exposes ssh.
+      ;     Example: ssh -p 2222 user@example.com
+      ;
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+
 - name: General | Account Management | Provisioning Configuration | General | Load
   ansible.builtin.set_fact:
     provision:  "{{ lookup('ini', 'enable     file={{gen_file}} default=false') | bool }}"
-    user:       "{{ lookup('ini', 'user       file={{gen_file}} default=ling') }}"
+    user:       "{{ lookup('ini', 'user       file={{gen_file}} default=user' )        }}"
-    user_desc:  "{{ lookup('ini', 'user_desc  file={{gen_file}} default=Hyperling') }}"
+    user_desc:  "{{ lookup('ini', 'user_desc  file={{gen_file}} default=User' )        }}"
     branch:     "{{ lookup('ini', 'branch     file={{gen_file}} default=main' )        }}"
     pentesting: "{{ lookup('ini', 'pentesting file={{gen_file}} default=false') | bool }}"
     no_telem:   "{{ lookup('ini', 'no_telem   file={{gen_file}} default=false') | bool }}"
@@ -217,11 +266,15 @@
     prod_data_port: "{{ lookup('ini', 'prod_data_port   file={{gen_file}} default=22') | int }}"
     prod_data_user: "{{ lookup('ini', 'prod_data_user   file={{gen_file}} default=user') }}"
     prod_data_dir:  "{{ lookup('ini', 'prod_data_dir    file={{gen_file}} default=/srv/sftp') }}"
+    tunnel_local_port:  "{{ lookup('ini', 'tunnel_local_port  file={{gen_file}} default=8080' ) | int }}"
+    tunnel_remote_host: "{{ lookup('ini', 'tunnel_remote_host file={{gen_file}} default=false')       }}"
+    tunnel_remote_port: "{{ lookup('ini', 'tunnel_remote_port file={{gen_file}} default=8080' ) | int }}"
+    tunnel_ssh_port:    "{{ lookup('ini', 'tunnel_ssh_port    file={{gen_file}} default=22'   ) | int }}"
 
-- name: General | Account Management | Provisioning Configuration | General | Boolean Check | Swap Block
+- name: General | Account Management | Provisioning Configuration | General | Boolean Check | swap_block
   ansible.builtin.set_fact:
     swap_block: "{{ swap_block | bool }}"
-  when: swap_block in ("true", "false")
+  when: swap_block in ("false")
 
 - name: General | Account Management | Provisioning Configuration | General | List
   ansible.builtin.set_fact:
@@ -249,6 +302,10 @@
     - { 'prod_data_port': "{{ prod_data_port }}" }
     - { 'prod_data_user': "{{ prod_data_user }}" }
     - { 'prod_data_dir': "{{ prod_data_dir }}" }
+    - { 'tunnel_local_port': "{{ tunnel_local_port }}" }
+    - { 'tunnel_remote_host': "{{ tunnel_remote_host }}" }
+    - { 'tunnel_remote_port': "{{ tunnel_remote_port }}" }
+    - { 'tunnel_ssh_port': "{{ tunnel_ssh_port }}" }
 
 
 ## Workstation ##
@@ -435,11 +492,21 @@
     open_terminal_port:    "{{ lookup('ini', 'open_terminal_port file={{wrk_file}} default=8000' ) | int  }}"
     open_terminal_key:     "{{ lookup('ini', 'open_terminal_key  file={{wrk_file}} default=false')        }}"
 
-- name: General | Account Management | Provisioning Configuration | Workstation | Boolean Check | Editing
+- name: General | Account Management | Provisioning Configuration | Workstation | Boolean Check | editing
   ansible.builtin.set_fact:
     editing: "{{ editing | bool }}"
   when: editing in ("true", "false")
 
+- name: General | Account Management | Provisioning Configuration | Workstation | Boolean Check | qwen_code_key
+  ansible.builtin.set_fact:
+    qwen_code_key: "{{ qwen_code_key | bool }}"
+  when: qwen_code_key in ("false")
+
+- name: General | Account Management | Provisioning Configuration | Workstation | Boolean Check | open_terminal_key
+  ansible.builtin.set_fact:
+    open_terminal_key: "{{ open_terminal_key | bool }}"
+  when: open_terminal_key in ("false")
+
 - name: General | Account Management | Provisioning Configuration | Workstation | List
   ansible.builtin.set_fact:
     provision_variables: "{{ provision_variables | combine(item) }}"

tasks/general/scripts/install.yml

@@ -8,7 +8,7 @@
     mode: '0755'
 
 - name: General | Scripts | Install | Copy Files
-  copy:
+  ansible.builtin.copy:
     src: 'scripts/'
     dest: "{{ global_bin }}/"
     owner: root
@@ -20,6 +20,8 @@
     if [[ -e {{ global_bin }}/{{ item }} ]]; then
       rm -v {{ global_bin }}/{{ item }}
     fi
+  register: shell_check
+  changed_when: shell_check.rc == 0
   loop:
     - compress-video.sh
     - compress-images.sh

tasks/general/scripts/root.yml

@@ -12,13 +12,8 @@
     marker_end: "exit 0"
     state: present
     create: true
-
-- name: General | Scripts | Root | scm.sh Permissions
-  ansible.builtin.file:
-    path: "{{ user_root.home }}/bin/scm.sh"
     mode: '0755'
 
-
 - name: General | Scripts | Root | scm-dev.sh
   ansible.builtin.blockinfile:
     path: "{{ user_root.home }}/bin/scm-dev.sh"
@@ -42,8 +37,4 @@
     marker_end: "exit 0"
     state: present
     create: true
-
-- name: General | Scripts | Root | scm-dev.sh Permissions
-  ansible.builtin.file:
-    path: "{{ user_root.home }}/bin/scm-dev.sh"
     mode: '0755'

tasks/general/settings/services.yml

@@ -35,6 +35,7 @@
     state: present
     create: true
     backup: true
+    mode: "0644"
   loop:
     - { "key": '^[\#]?AllowUsers',           "value": 'AllowUsers {{ user }}'}
     - { "key": '^[\#]?PermitRootLogin',      "value": 'PermitRootLogin no'}
@@ -60,6 +61,7 @@
     state: present
     create: true
     backup: true
+    mode: "0644"
   loop:
     - { "key": '^[\#]?AllowUsers',      "value": 'AllowUsers root {{ user }}'}
     - { "key": '^[\#]?PermitRootLogin', "value": 'PermitRootLogin yes'}

tasks/general/settings/tunnel.yml

@@ -0,0 +1,74 @@
+---
+# 2026-10-17 Hyperling
+# Allow pushing a local port to a remote server automagically in a runit script.
+
+# ssh -N -p SSH_PORT -R REMOTE_PORT:localhost:LOCAL_PORT USER@REMOTE_HOST -v
+
+- name: General | Tunnel | Provisioned Variables
+  ansible.builtin.debug:
+    var: "{{ item }}"
+  loop:
+    - tunnel_local_port
+    - tunnel_remote_host
+    - tunnel_remote_port
+    - tunnel_ssh_port
+
+- name: General | Tunnel | Block
+  block:
+
+    - name: General | Tunnel | Facts
+      ansible.builtin.set_fact:
+        tunnel_service_name: tunnel
+
+    - name: General | Tunnel | mkdir | /etc/sv
+      ansible.builtin.file:
+        path: /etc/sv/{{ tunnel_service_name }}/log
+        state: directory
+        mode: "0755"
+
+    - name: General | Tunnel | mkdir | /var/log
+      ansible.builtin.file:
+        path: /var/log/{{ tunnel_service_name }}
+        state: directory
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Run
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ tunnel_service_name }}/run
+        content: |
+          #!/bin/sh -e
+          exec 2>&1
+          exec chpst -u {{ user }} ssh -v -N \
+            -R {{ tunnel_remote_port }}:localhost:{{ tunnel_local_port }} \
+            -p {{ tunnel_ssh_port }} {{ tunnel_remote_host }}
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Finish
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ tunnel_service_name }}/finish
+        content: |
+          {{ runit_finish_sleep }}
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Log
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ tunnel_service_name }}/log/run
+        content: |
+          #!/bin/sh -e
+          exec svlogd -tt /var/log/{{ tunnel_service_name }}
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Log Config
+      ansible.builtin.copy:
+        dest: /var/log/{{ tunnel_service_name }}/config
+        content: |
+          {{ runit_log_config_10mb }}
+        mode: "0755"
+
+  when: tunnel_remote_host != "false"
+
+- name: General | Tunnel | Service | Enable
+  ansible.builtin.service:
+    name: "{{ tunnel_service_name }}"
+    state: "{{ 'started' if tunnel_remote_host else 'stopped' }}"
+    enabled: "{{ true if tunnel_remote_host else false }}"

tasks/header.yml

@@ -106,57 +106,74 @@
 - name: Main | General
   block:
 
-    - name: Main | General | Swap
+    - name: Main | General | Software | runit
-      ansible.builtin.include_tasks: tasks/general/software/swap.yml
-
-    - name: Main | General | runit
       ansible.builtin.include_tasks: tasks/general/software/runit.yml
 
-    - name: Main | General | Packages
+    - name: Main | General | Software | Packages
       ansible.builtin.include_tasks: tasks/general/software/packages.yml
       when: internet
 
-    - name: Main | General | Services
+    - name: Main | General | Software | AUR
-      ansible.builtin.include_tasks: tasks/general/software/services.yml
+      ansible.builtin.include_tasks: tasks/general/software/aur.yml
+      when: internet and ansible_pkg_mgr == "pacman"
 
-    - name: Main | General | Sendmail
+    - name: Main | General | Software | Sendmail
       ansible.builtin.include_tasks: tasks/general/software/sendmail.yml
       when: ansible_system == "FreeBSD"
         and internet
 
-    - ansible.builtin.include_tasks: tasks/general/software/aur.yml
+    - name: Main | General | Software | Metasploit
-      when: internet and ansible_pkg_mgr == "pacman"
+      ansible.builtin.include_tasks: tasks/general/software/metasploit.yml
+      when: internet
 
     # Gather again in case missing programs have now been installed.
-    - ansible.builtin.include_tasks: facts/general/gather.yml
+    - name: Main | General | Facts [Again]
+      ansible.builtin.include_tasks: facts/general/gather.yml
 
-    - ansible.builtin.include_tasks: tasks/general/settings/keyboard.yml
+    - name: Main | General | Settings | Swap
+      ansible.builtin.include_tasks: tasks/general/settings/swap.yml
 
-    - ansible.builtin.include_tasks: tasks/general/acct_mgmt/groups.yml
+    - name: Main | General | Settings | Services
+      ansible.builtin.include_tasks: tasks/general/settings/services.yml
 
-    - ansible.builtin.include_tasks: tasks/general/acct_mgmt/users.yml
+    - name: Main | General | Settings | Tunnel
+      ansible.builtin.include_tasks: tasks/general/settings/tunnel.yml
 
-    - ansible.builtin.include_tasks: tasks/general/acct_mgmt/sudo.yml
+    - name: Main | General | Settings | Keyboard
+      ansible.builtin.include_tasks: tasks/general/settings/keyboard.yml
 
-    - ansible.builtin.include_tasks: tasks/general/acct_mgmt/doas.yml
+    - name: Main | General | Accounts | Groups
+      ansible.builtin.include_tasks: tasks/general/acct_mgmt/groups.yml
+
+    - name: Main | General | Accounts | Users
+      ansible.builtin.include_tasks: tasks/general/acct_mgmt/users.yml
+
+    - name: Main | General | Accounts | sudo
+      ansible.builtin.include_tasks: tasks/general/acct_mgmt/sudo.yml
+
+    - name: Main | General | Accounts | doas
+      ansible.builtin.include_tasks: tasks/general/acct_mgmt/doas.yml
       when: internet
 
-    - ansible.builtin.include_tasks: tasks/general/software/env-shared.yml
+    - name: Main | General | Scripts | Root
+      ansible.builtin.include_tasks: tasks/general/scripts/root.yml
+
+    - name: Main | General | Scripts | User
+      ansible.builtin.include_tasks: tasks/general/scripts/user.yml
+
+    - name: Main | General | Scripts | Local
+      ansible.builtin.include_tasks: tasks/general/scripts/install.yml
+
+    - name: Main | General | Scripts | env-shared
+      ansible.builtin.include_tasks: tasks/general/scripts/env-shared.yml
       when: internet
 
-    - ansible.builtin.include_tasks: tasks/general/scripts/root.yml
+    - name: Main | General | Cron | Ansible
-
+      ansible.builtin.include_tasks: tasks/general/cron/ansible.yml
-    - ansible.builtin.include_tasks: tasks/general/scripts/user.yml
-
-    - ansible.builtin.include_tasks: tasks/general/scripts/install.yml
-
-    - ansible.builtin.include_tasks: tasks/general/cron/ansible.yml
 
     # TODO Need to refactor. Maybe tasks/general/cron/freebsd.yml
-    - ansible.builtin.include_tasks: tasks/workstation/freebsd/cron/ansible.yml
+    - name: Main | General | Cron | Ansible [FreeBSD]
+      ansible.builtin.include_tasks: tasks/workstation/freebsd/cron/ansible.yml
       when: ansible_system == "FreeBSD"
 
-    - ansible.builtin.include_tasks: tasks/general/software/metasploit.yml
-      when: internet
-
   when: provision