josh/foundry
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire removed users declaratively and manage global gitignore #6

Closed
josh wants to merge 1 commit from feat/gitignore-disappearance-413521 into main
pull from: feat/gitignore-disappearance-413521
merge into: josh:main
Conversation 0 Commits 1 Files changed 7 +236 -4
josh commented 2026-07-08 21:05:16 -05:00
Owner
Copy link

Why

Manual git config --global edits on foundry live at most one hour: the users role re-renders ~/.gitconfig on every pull-timer converge. A hand-made core.excludesFile setting kept vanishing. Separately, the josh-nbm account is no longer wanted, and the roles only ever create things — dropping a name from foundry_users would orphan the account, its home, and its code-server instance forever.

What

Global gitignore, managed: each user in foundry_users now gets an Ansible-rendered ~/.gitignore (patterns from users_git_global_ignores, default .claude) wired via core.excludesfile in the managed .gitconfig.

Declarative account retirement: accounts listed in foundry_removed_users (private vars) are retired on converge:

  1. expire the account (blocks OpenSSH reconnects from remote editors)
  2. stop/disable code-server@<user> and remove its systemd overrides
  3. disable lingering, terminate sessions, kill processes, wait for quiesce
  4. archive the home dir to /var/lib/foundry/removed-users/<user>-home.tar.gz (tolerating tar's warning-level exit 1)
  5. delete the account + primary group + per-user sudoers grant
  6. final pkill by numeric UID — Tailscale SSH ignores account expiry, so remote editors can re-admit processes right up until the account row is deleted

An assert fails the play if a name appears in both foundry_users and foundry_removed_users, so a stale user list on another controller can't silently recreate a retired account.

Applied

Already converged on foundry from this branch: josh-nbm is removed (home archived, 1.1 GB), and josh/josh-pc have the managed gitignore. /etc/foundry/private.yml was updated in place; group_vars/all/99-private.yml on the Mac still needs the same edit (move josh-nbm from foundry_users to foundry_removed_users, drop its email).

## Why Manual `git config --global` edits on foundry live at most one hour: the `users` role re-renders `~/.gitconfig` on every pull-timer converge. A hand-made `core.excludesFile` setting kept vanishing. Separately, the `josh-nbm` account is no longer wanted, and the roles only ever create things — dropping a name from `foundry_users` would orphan the account, its home, and its code-server instance forever. ## What **Global gitignore, managed:** each user in `foundry_users` now gets an Ansible-rendered `~/.gitignore` (patterns from `users_git_global_ignores`, default `.claude`) wired via `core.excludesfile` in the managed `.gitconfig`. **Declarative account retirement:** accounts listed in `foundry_removed_users` (private vars) are retired on converge: 1. expire the account (blocks OpenSSH reconnects from remote editors) 2. stop/disable `code-server@<user>` and remove its systemd overrides 3. disable lingering, terminate sessions, kill processes, wait for quiesce 4. archive the home dir to `/var/lib/foundry/removed-users/<user>-home.tar.gz` (tolerating tar's warning-level exit 1) 5. delete the account + primary group + per-user sudoers grant 6. final `pkill` by numeric UID — Tailscale SSH ignores account expiry, so remote editors can re-admit processes right up until the account row is deleted An assert fails the play if a name appears in both `foundry_users` and `foundry_removed_users`, so a stale user list on another controller can't silently recreate a retired account. ## Applied Already converged on foundry from this branch: `josh-nbm` is removed (home archived, 1.1 GB), and `josh`/`josh-pc` have the managed gitignore. `/etc/foundry/private.yml` was updated in place; **`group_vars/all/99-private.yml` on the Mac still needs the same edit** (move `josh-nbm` from `foundry_users` to `foundry_removed_users`, drop its email).
Retire removed users declaratively and manage global gitignore
All checks were successful
CI / validate (push) Successful in 27s
Details
87e8039ba3 
The users role now retires accounts listed in foundry_removed_users:
stops their code-server instance, terminates sessions, archives the
home directory under /var/lib/foundry/removed-users, and deletes the
account and primary group. Keeping retired names listed prevents a
stale user list on another controller from recreating them.

Each managed user also gets an Ansible-rendered ~/.gitignore (default:
.claude) wired up via core.excludesfile in the managed .gitconfig, so
manual git config edits no longer fight the hourly converge.
josh closed this pull request 2026-08-05 09:04:26 -05:00
All checks were successful
CI / validate (push) Successful in 27s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
josh/foundry!6
No description provided.