infra/ansible
23
8
Fork 59
Code Pull requests 15 Activity Actions 3

Draupnir: add manual playbook for room creation #3596

Open
gwmngilfen wants to merge 1 commit from gwmngilfen/ansible:draupnir into main
pull from: gwmngilfen/ansible:draupnir
merge into: infra:main
Conversation 5 Commits 1 Files changed 1 +71
gwmngilfen commented 2026-08-13 15:04:43 +00:00
Member
Copy link

This is a possible solution for matrix/tickets#13 - it allows an Ansible user to create a room using the Draupnir bot's account, and invite themselves to the new room.

The playbook works as root - I'm not sure how we grant permissions to use it via rbac-playbook though?

# ansible-playbook ./draupnir-playbook-test.yml -e "name='Gwmngilfen Test 2'" -e "alias=gwmgilfen2" -e "invite=@gwmngilfen:fedora.im"
PLAY [Matrix Room Creation Playbook] **********************************************************************************************************

TASK [Ensure mandatory invited user parameter is provided] ************************************************************************************
Thursday 13 August 2026  14:53:49 +0000 (0:00:00.433)       0:00:00.433 *******
Thursday 13 August 2026  14:53:49 +0000 (0:00:00.432)       0:00:00.432 *******
ok: [localhost] => {
    "changed": false,
    "msg": "Inviting user: @gwmngilfen:fedora.im"
}

TASK [Create Matrix room via API] *************************************************************************************************************
Thursday 13 August 2026  14:53:49 +0000 (0:00:00.050)       0:00:00.483 *******
Thursday 13 August 2026  14:53:49 +0000 (0:00:00.050)       0:00:00.482 *******
ok: [localhost]

TASK [Display created room ID] ****************************************************************************************************************
Thursday 13 August 2026  14:53:51 +0000 (0:00:01.709)       0:00:02.193 *******
Thursday 13 August 2026  14:53:51 +0000 (0:00:01.709)       0:00:02.192 *******
ok: [localhost] => {
    "msg": "Room 'Gwmngilfen Test 2' created! ID: !zxztsQydxNlKF4HZqNvt4TOeVBtgeykIqDuSoRyAxpQ"
}

PLAY RECAP ************************************************************************************************************************************
localhost                  : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

logs written to: /var/log/ansible/draupnir-playbook-test/2026/08/13/14.53.49

Signed-off-by: Greg Sutcliffe fedora@emeraldreverie.org

This is a possible solution for https://forge.fedoraproject.org/matrix/tickets/issues/13 - it allows an Ansible user to create a room using the Draupnir bot's account, and invite themselves to the new room. The playbook works as root - I'm not sure how we grant permissions to use it via rbac-playbook though? ``` # ansible-playbook ./draupnir-playbook-test.yml -e "name='Gwmngilfen Test 2'" -e "alias=gwmgilfen2" -e "invite=@gwmngilfen:fedora.im" PLAY [Matrix Room Creation Playbook] ********************************************************************************************************** TASK [Ensure mandatory invited user parameter is provided] ************************************************************************************ Thursday 13 August 2026 14:53:49 +0000 (0:00:00.433) 0:00:00.433 ******* Thursday 13 August 2026 14:53:49 +0000 (0:00:00.432) 0:00:00.432 ******* ok: [localhost] => { "changed": false, "msg": "Inviting user: @gwmngilfen:fedora.im" } TASK [Create Matrix room via API] ************************************************************************************************************* Thursday 13 August 2026 14:53:49 +0000 (0:00:00.050) 0:00:00.483 ******* Thursday 13 August 2026 14:53:49 +0000 (0:00:00.050) 0:00:00.482 ******* ok: [localhost] TASK [Display created room ID] **************************************************************************************************************** Thursday 13 August 2026 14:53:51 +0000 (0:00:01.709) 0:00:02.193 ******* Thursday 13 August 2026 14:53:51 +0000 (0:00:01.709) 0:00:02.192 ******* ok: [localhost] => { "msg": "Room 'Gwmngilfen Test 2' created! ID: !zxztsQydxNlKF4HZqNvt4TOeVBtgeykIqDuSoRyAxpQ" } PLAY RECAP ************************************************************************************************************************************ localhost : ok=3 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 logs written to: /var/log/ansible/draupnir-playbook-test/2026/08/13/14.53.49 ``` Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
Draupnir: add manual playbook for room creation
All checks were successful
yamllint / yamllint (pull_request) Successful in 32s
Details
Differential yamllint / yamllint-job (pull_request) Successful in 42s
Details
Linter / ansible-lint (pull_request) Successful in 2m15s
Details
64f6e02e15
 
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
smoliicek commented 2026-08-13 16:34:50 +00:00
Member
Copy link

if i recall correctly, there should be an rbac.yaml file in ansible-private where you should add it to

if i recall correctly, there should be an rbac.yaml file in ansible-private where you should add it to
smoliicek approved these changes 2026-08-13 16:36:04 +00:00
smoliicek left a comment
Copy link

and i think it looks good!

and i think it looks good!
kevin commented 2026-08-13 17:35:47 +00:00
Owner
Copy link

Looks ok to me. We might make room mandatory too? You likely don't want to just make a test room with the default name..

the typical pattern here is:

  • create a sysadmin-whatever group in fas and add folks who need to run the thing to it.
  • add it to rbac config in ansible-private to allow that group to run that playbook.
  • users then ssh into batcave01 and use rbac-playbook to run the playbook there.
  • profit.
Looks ok to me. We might make room mandatory too? You likely don't want to just make a test room with the default name.. the typical pattern here is: * create a sysadmin-whatever group in fas and add folks who need to run the thing to it. * add it to rbac config in ansible-private to allow that group to run that playbook. * users then ssh into batcave01 and use rbac-playbook to run the playbook there. * profit.
👍 1
gwmngilfen commented 2026-08-17 16:12:32 +00:00
Author
Member
Copy link

OK, I had a look in rbac.yml, seems simple enough. Do we want to re-use the commops-wg-matrix FAS group, or make a new one? I see @kevin suggesting a sysadmin-matrix group but does that add anything over the existing one? The members are the ones in the moderation room anyway...

If we're making room mandatory, I guess all the parameters might as well all be (well, except visibility). The alias will not like being reused anyway.

OK, I had a look in rbac.yml, seems simple enough. Do we want to re-use the `commops-wg-matrix` FAS group, or make a new one? I see @kevin suggesting a `sysadmin-matrix` group but does that add anything over the existing one? The members are the ones in the moderation room anyway... If we're making room mandatory, I guess all the parameters might as well all be (well, except visibility). The alias will not like being reused anyway.
kevin commented 2026-08-18 22:20:27 +00:00
Owner
Copy link

So, the typical convention is that 'sysadmin-whatever' groups are ones where members can get an interactive shell.

So, I think i would prefer we make a sysadmin-matrix group for this. we could just add interested matrix/commops folks to it, or we could inherit from the commops-wg-matrix group, but having it be sysadmin-matrix would at least indicate it provides shell access.

So, the typical convention is that 'sysadmin-whatever' groups are ones where members can get an interactive shell. So, I think i would prefer we make a sysadmin-matrix group for this. we could just add interested matrix/commops folks to it, or we could inherit from the commops-wg-matrix group, but having it be sysadmin-matrix would at least indicate it provides shell access.
All checks were successful
yamllint / yamllint (pull_request) Successful in 32s
Details
Differential yamllint / yamllint-job (pull_request) Successful in 42s
Details
Linter / ansible-lint (pull_request) Successful in 2m15s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u draupnir:gwmngilfen-draupnir
git switch gwmngilfen-draupnir

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff gwmngilfen-draupnir
git switch gwmngilfen-draupnir
git rebase main
git switch main
git merge --ff-only gwmngilfen-draupnir
git switch gwmngilfen-draupnir
git rebase main
git switch main
git merge --no-ff gwmngilfen-draupnir
git switch main
git merge --squash gwmngilfen-draupnir
git switch main
git merge --ff-only gwmngilfen-draupnir
git switch main
git merge gwmngilfen-draupnir
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
smoliicek
Labels
Clear labels   
ai-review-please
label for requesting AI code review

  
freeze-break-request

   
post-freeze
  
Backlog Status
Needs Review
 Work items that have been created or updated but need review, refinement, or approval before they can be considered ready for sprint planning.

  
Backlog Status
Ready
 Work items that have been reviewed, refined, and are ready to be committed to a sprint. These items have clear requirements and can be worked on immediately when capacity is available.

  
chore
Work that needs to be done but doesn't add new functionality or fix bugs. Maintenance tasks that keep the system running smoothly and the codebase clean.

  
documentation
Work focused on creating, updating, or improving documentation for users, developers, or system administrators.

  
points
01
 A task that is simple, small, and has very little uncertainty. It should be easy enough for any team member to pick up and complete quickly, without a lot of discussion or research.

  
points
02
 This is a task that is slightly more complex or larger than a "1." It might involve two or three simple steps, but the outcome is still very clear and there's little uncertainty.

  
points
03
 Medium-sized task with some noticeable complexity. It might require a bit more thought or collaboration. The steps are well-defined, but it's not a trivial change.

  
points
05
 A significant piece of work. It has more complexity and a higher degree of uncertainty than smaller tasks. It might require some research, a design discussion, or collaboration across multiple teams.

  
points
08
 Complex task with a lot of uncertainty. It's often the largest size that a team will consider for a single sprint. It likely requires a detailed breakdown and multiple team members to complete.

  
points
13
 Any task that feels like it's a "13" or more is considered an Epic. These are too large and uncertain to be worked on in a single sprint and should be broken down.

  
Priority
High
 This is for work that is critical and needs to be addressed in the next sprint. It's often for urgent bugs, important features, or a major piece of technical debt that is blocking other work.

  
Priority
Low
 This is for work that is good to do but not urgent. It's a candidate for being worked on when there's extra time or when it rises in importance. It can stay in the backlog for a longer period.

  
Priority
Medium
 This is for important work that should be done soon, but isn't as urgent as a high-priority item. It will likely be considered for the next 1-2 sprints.

  
Sprint Status
Blocked
 Work items that cannot progress due to external dependencies, blockers, or issues that need resolution.

  
Sprint Status
Done
 Work items that have been completed, reviewed, and integrated. No further work is needed within the current sprint.

  
Sprint Status
In Progress
 Work items currently being worked on by a team member. Active development, research, or implementation is happening.

  
Sprint Status
Review
 Work items that are complete but need review, testing, or approval before being marked as done.

  
Sprint Status
To Do
 Work items that are committed to the sprint but haven't been started yet. These items are ready to be picked up by team members.

  
Technical Debt
Work that addresses shortcuts, workarounds, or suboptimal implementations that were done previously to meet deadlines. These items improve code quality, maintainability, or performance without adding new features.

  
Work Item
Bug
 Issues where the system is not working as intended or designed. Bugs represent deviations from expected behavior.

  
Work Item
Epic
 Large initiatives that are broken down into multiple smaller work items (user stories, tasks, bugs). Epics represent significant features or projects that span multiple sprints.

  
Work Item
Spike
 Time-boxed research, investigation, or proof-of-concept work to reduce uncertainty or explore solutions. Spikes help inform future development decisions.

  
Work Item
Task
 Used to break down larger user stories into smaller, manageable implementation pieces. They focus on the specific technical steps needed to deliver the user story's value.

  
Work Item
User Story
 User-facing features or functionality that can be framed from a user perspective, describing what someone wants to accomplish and why.

No labels
ai-review-please
freeze-break-request
post-freeze
Backlog Status
Needs Review
Backlog Status
Ready
chore
documentation
points
01
points
02
points
03
points
05
points
08
points
13
Priority
High
Priority
Low
Priority
Medium
Sprint Status
Blocked
Sprint Status
Done
Sprint Status
In Progress
Sprint Status
Review
Sprint Status
To Do
Technical Debt
Work Item
Bug
Work Item
Epic
Work Item
Spike
Work Item
Task
Work Item
User Story
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
infra/ansible!3596
No description provided.