feat: pds operator

playbook.yml

@@ -137,11 +137,60 @@
       changed_when: false
       failed_when: pds_backup_exit_code.stdout != "0"
 
-    # ── Monitoring stack (telemetry) ──────────────────────────────
-    # Deploys Prometheus + Grafana + node_exporter when pds_telemetry_enabled is true.
-    # All services bind to 127.0.0.1 — access via SSH tunnel:
-    #   ssh -L 3001:localhost:3001 sysadmin@<server>
-    # Then open http://localhost:3001 (admin/admin, change on first login)
+    - name: Clone pds-operator repo
+      git:
+        repo: "{{ pds_operator_repo }}"
+        dest: "{{ pds_data_dir }}/operator"
+        version: "{{ pds_operator_version | default('main') }}"
+        update: yes
+        force: no
+      when: pds_operator_enabled is defined and pds_operator_enabled | bool
+      register: operator_repo
+      notify: restart operator
+
+    - name: Read operator session secret (if exists)
+      shell: grep -E '^SESSION_SECRET=' {{ pds_data_dir }}/operator/.env 2>/dev/null | cut -d= -f2
+      register: operator_existing_secret
+      changed_when: false
+      failed_when: false
+      when: pds_operator_enabled is defined and pds_operator_enabled | bool
+
+    - name: Generate operator session secret (first run)
+      shell: openssl rand -hex 32
+      register: operator_new_secret
+      when:
+        - pds_operator_enabled is defined and pds_operator_enabled | bool
+        - operator_existing_secret.stdout | default('') | length == 0
+
+    - name: Set operator session secret fact
+      set_fact:
+        pds_operator_session_secret: "{{ operator_existing_secret.stdout if (operator_existing_secret.stdout | default('') | length > 0) else operator_new_secret.stdout }}"
+      when: pds_operator_enabled is defined and pds_operator_enabled | bool
+
+    - name: Create operator data directory
+      file:
+        path: "{{ pds_data_dir }}/operator/data"
+        state: directory
+        owner: "1000"
+        group: "1000"
+        mode: "0755"
+      when: pds_operator_enabled is defined and pds_operator_enabled | bool
+
+    - name: Deploy operator .env
+      template:
+        src: templates/pds-operator.env.j2
+        dest: "{{ pds_data_dir }}/operator/.env"
+        mode: "0600"
+      when: pds_operator_enabled is defined and pds_operator_enabled | bool
+      notify: restart operator
+
+    - name: Deploy operator compose
+      template:
+        src: templates/pds-operator-compose.yaml.j2
+        dest: "{{ pds_data_dir }}/operator/compose.yaml"
+        mode: "0644"
+      when: pds_operator_enabled is defined and pds_operator_enabled | bool
+      notify: restart operator
 
     - name: Create monitoring directories
       file:
@@ -199,9 +248,24 @@
       shell: cd {{ pds_data_dir }}/monitoring && docker compose up -d
       when: pds_telemetry_enabled is defined and pds_telemetry_enabled | bool
 
+    - name: Flush handlers (operator + monitoring)
+      meta: flush_handlers
+
+    - name: Operator health check
+      uri:
+        url: "https://operator.{{ pds_hostname }}/oauth/client-metadata.json"
+        method: GET
+        status_code: 200
+      retries: 5
+      delay: 10
+      when: pds_operator_enabled is defined and pds_operator_enabled | bool
+
   handlers:
     - name: apply changes
       shell: cd {{ pds_data_dir }} && docker compose up -d && docker restart caddy
 
     - name: restart monitoring
       shell: cd {{ pds_data_dir }}/monitoring && docker compose up -d --force-recreate
+
+    - name: restart operator
+      shell: cd {{ pds_data_dir }}/operator && docker compose up -d --build