[refactor] moving cubes into own package"

[fix] default parameter run records parameters in session for replay[fix] remove default parameters for several cubes
2026-07-28 12:18:10 +02:00
parent ac050c4459
commit 6ecb2c366f
130 changed files with 3386 additions and 520 deletions
@@ -0,0 +1,33 @@
+# Tailscale Cube
+
+Installs and authenticates the Tailscale client on a Linux host.
+
+## Features
+
+- **Automated Installation**: Adds the official Tailscale repository and installs the package.
+- **Headless Authentication**: Uses a Tailscale Auth Key for zero-interaction setup.
+- **Headscale Support**: Can be configured to connect to a custom login server.
+- **Startup persistence**: Ensures the `tailscaled` daemon is enabled and running.
+
+## Configuration
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `AUTH_KEY` | `""` | **Secret.** Tailscale Auth Key (recommended to use a 'reusable' or 'ephemeral' key). |
+| `LOGIN_SERVER` | `https://controlplane.tailscale.com` | The coordination server URL. Set this to your Headscale instance URL if applicable. |
+| `EXTRA_ARGS` | `""` | Additional flags to pass to `tailscale up` (e.g., `--advertise-exit-node`). |
+| `FORCE_REAUTH` | `false` | If true, forces the client to re-authenticate. |
+
+## Usage
+
+```bash
+nopy install tailscale
+```
+
+When prompted, provide your `AUTH_KEY`. If you are using Headscale, also provide the `LOGIN_SERVER` URL.
+
+`AUTH_KEY` is declared in the manifest's `secrets`, so nopy keeps it out of session
+and history files and masks it in any command it prints. It is asked for again on
+replay, and a `--use-defaults` replay refuses rather than joining the tailnet with
+an empty key. Prefer an ephemeral key regardless — the value is still on pyinfra's
+command line while the deployment runs.
@@ -0,0 +1,45 @@
+from pyinfra import host
+from pyinfra.operations import server, apt
+
+# Variables from manifest
+AUTH_KEY = host.data.AUTH_KEY
+LOGIN_SERVER = host.data.LOGIN_SERVER
+EXTRA_ARGS = host.data.EXTRA_ARGS
+FORCE_REAUTH = host.data.FORCE_REAUTH
+
+# 1. Install Tailscale using the official one-liner script
+server.shell(
+    name="Install Tailscale",
+    commands=["curl -fsSL https://tailscale.com/install.sh | sh"],
+    _sudo=True
+)
+
+# 2. Ensure Tailscale is enabled and running
+# Manually (Linux): sudo systemctl enable --now tailscaled
+server.service(
+    name="Ensure tailscaled is running and enabled on boot",
+    service="tailscaled",
+    running=True,
+    enabled=True,
+    _sudo=True
+)
+
+# 3. Authenticate and bring Tailscale up
+# We use --authkey for headless mode
+# We use --login-server if it's different from the default
+up_command = f"tailscale up --authkey {AUTH_KEY}"
+
+if LOGIN_SERVER and LOGIN_SERVER != "https://controlplane.tailscale.com":
+    up_command += f" --login-server {LOGIN_SERVER}"
+
+if FORCE_REAUTH:
+    up_command += " --force-reauth"
+
+if EXTRA_ARGS:
+    up_command += f" {EXTRA_ARGS}"
+
+server.shell(
+    name="Authenticate Tailscale (Headless)",
+    commands=[up_command],
+    _sudo=True
+)
@@ -0,0 +1,18 @@
+import { Manifest } from '@bitsquare/nopy-cube';
+import { z } from 'zod';
+
+export default Manifest({
+  id: 'net:tailscale',
+  name: 'Install and authenticate Tailscale',
+  dependencies: () => ['apt:essentials'],
+  secrets: ['AUTH_KEY'],
+  schema: z.object({
+    AUTH_KEY: z.string().describe('Tailscale Auth Key for headless authentication').default(''),
+    LOGIN_SERVER: z
+      .string()
+      .describe('Custom login server (e.g., for Headscale)')
+      .default('https://controlplane.tailscale.com'),
+    EXTRA_ARGS: z.string().describe('Additional arguments for tailscale up').default(''),
+    FORCE_REAUTH: z.boolean().describe('Force re-authentication').default(false),
+  }),
+});