{"id":26792991,"url":"https://github.com/osbuild/ansible-osbuild-worker","last_synced_at":"2026-02-06T08:06:30.302Z","repository":{"id":171992543,"uuid":"647705564","full_name":"osbuild/ansible-osbuild-worker","owner":"osbuild","description":"Ansible role for deploying osbuild-composer worker","archived":false,"fork":false,"pushed_at":"2025-06-18T11:08:56.000Z","size":33,"stargazers_count":1,"open_issues_count":0,"forks_count":2,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-07-29T04:19:22.050Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/osbuild.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-05-31T10:55:34.000Z","updated_at":"2025-06-18T11:09:01.000Z","dependencies_parsed_at":null,"dependency_job_id":"298cbb93-dcd0-4229-a6cc-578c8164fece","html_url":"https://github.com/osbuild/ansible-osbuild-worker","commit_stats":null,"previous_names":["osbuild/ansible-osbuild-worker"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/osbuild/ansible-osbuild-worker","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osbuild%2Fansible-osbuild-worker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osbuild%2Fansible-osbuild-worker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osbuild%2Fansible-osbuild-worker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osbuild%2Fansible-osbuild-worker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/osbuild","download_url":"https://codeload.github.com/osbuild/ansible-osbuild-worker/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osbuild%2Fansible-osbuild-worker/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29155107,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-06T07:18:23.844Z","status":"ssl_error","status_checked_at":"2026-02-06T07:13:32.659Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-03-29T16:18:28.917Z","updated_at":"2026-02-06T08:06:30.284Z","avatar_url":"https://github.com/osbuild.png","language":"Jinja","funding_links":[],"categories":[],"sub_categories":[],"readme":"# osbuild.osbuild_worker\n\nThis roles installs, configures and starts `osbuild-composer` remote worker on the host.\n\n## Role Variables\n\nThe role has a few required variables, which must be provided by the user in order for the role to not fail.\n\n**Required variables are:**\n\n* `osbuild_worker_server_hostname`\n* `osbuild_worker_authentication_oauth_url`\n* `osbuild_worker_authentication_client_id`\n* Any of\n  * `osbuild_worker_authentication_client_secret_file`\n  * `osbuild_worker_authentication_offline_token_file`\n\nThe rest of the variables are not required and if set, they enable optional functionality in the worker.\n\nVariables that the user can set are listed and explained below:\n\n```yaml\n#################################\n# General configuration options #\n#################################\n\n# The hostname of the osbuild-composer API server.\n# REQUIRED\nosbuild_worker_server_hostname: \"\"\n# The osbuild-composer server API base path. If empty, the default value is used.\nosbuild_worker_server_api_base_path: \"\"\n# Force the restart of the worker service even if the configuration has not changed.\nosbuild_worker_force_restart: false\n\n# Worker proxy configuration.\nosbuild_worker_proxy_server_hostname: \"\"\nosbuild_worker_proxy_server_port: 443\nosbuild_worker_no_proxy_domains: []\n\n################################################\n# Worker authentication to the composer server #\n################################################\n\n# The OAuth server URL.\n# REQUIRED\nosbuild_worker_authentication_oauth_url: \"\"\n# The OAuth client ID.\n# REQUIRED\nosbuild_worker_authentication_client_id: \"\"\n# Local path to the worker OAuth client secret file. If not empty, this file will be\n# copied to the worker to {{ osbuild_worker_authentication_client_secret_path }}.\n# REQUIRED (if osbuild_worker_authentication_offline_token_file not specified)\nosbuild_worker_authentication_client_secret_file: \"\"\n# Path to the worker OAuth client secret file on the worker. If empty,\n# defaults to {{ osbuild_worker_authentication_client_secret_path_default }}.\nosbuild_worker_authentication_client_secret_path: \"\"\n# Local path to the worker OAuth offline token file. If not empty, this file will be\n# copied to the worker to {{ osbuild_worker_authentication_offline_token_path }}.\n# REQUIRED (if osbuild_worker_authentication_client_secret_file not specified)\nosbuild_worker_authentication_offline_token_file: \"\"\n# Path to the worker OAuth offline token file on the worker. If empty,\n# defaults to {{ osbuild_worker_authentication_offline_token_path_default }}.\nosbuild_worker_authentication_offline_token_path: \"\"\n\n##########################\n# Configuration for Koji #\n##########################\n\nosbuild_worker_koji_instances: []\n# example:\n# osbuild_worker_koji_instances:\n#   - koji_host: \"koji.example.com\"\n#     krb_principal: \"osbuild-automation@EXAMPLE.COM\"\n#     # Local path to the krb keytab file. If not empty, this file will be\n#     # copied to the worker to {{ krb_keytab_path }}.\n#     krb_keytab_file: \"\"\n#     # Path to the krb keytab file on the worker. If empty, a default path\n#     # under {{ osbuild_worker_config_dir }} with filename\n#     # \"client_{{ koji_host }}.keytab\" will be used.\n#     krb_keytab_path: \"\"\n#     relax_timeout_factor: 5\n\n###########################\n# Configuration for Azure #\n###########################\n\n# Local path to the Azure credentials file. If not empty, this file will be\n# copied to the worker to {{ osbuild_worker_azure_credentials_path }}.\nosbuild_worker_azure_credentials_file: \"\"\n# Path to the Azure credentials file on the worker. If empty,\n# defaults to {{ osbuild_worker_azure_credentials_path_default }}.\nosbuild_worker_azure_credentials_path: \"\"\n# Number of threads to use when uploading image blob to Azure. If 0, no\n# explicit value is set in the configuration file and the worker will use\n# its internal default. Set to a positive integer to override the default.\nosbuild_worker_azure_upload_threads: 0\n\n#########################\n# Configuration for AWS #\n#########################\n\n# Local path to the AWS credentials file. If not empty, this file will be\n# copied to the worker to {{ osbuild_worker_aws_credentials_path }}.\nosbuild_worker_aws_credentials_file: \"\"\n# Path to the AWS credentials file on the worker. If empty,\n# defaults to {{ osbuild_worker_aws_credentials_path_default }}.\nosbuild_worker_aws_credentials_path: \"\"\nosbuild_worker_aws_bucket: \"\"\n\n#########################\n# Configuration for GCP #\n#########################\n\n# Local path to the GCP credentials file. If not empty, this file will be\n# copied to the worker to {{ osbuild_worker_gcp_credentials_path }}.\nosbuild_worker_gcp_credentials_file: \"\"\n# Path to the GCP credentials file on the worker. If empty,\n# defaults to {{ osbuild_worker_gcp_credentials_path_default }}.\nosbuild_worker_gcp_credentials_path: \"\"\nosbuild_worker_gcp_bucket: \"\"\n```\n\n### Internal variables\n\nThe role also uses some internal variables, which usually hold default values used by the role. Although the user can override them when using the role, this is discouraged. Do it only if you know what you are doing. Backward compatibility is not guaranteed when setting those.\n\n```yaml\nosbuild_worker_config_dir: /etc/osbuild-worker\nosbuild_worker_config_dir_mode: '0755'\n\nosbuild_worker_config_file: \"{{ osbuild_worker_config_dir }}/osbuild-worker.toml\"\nosbuild_worker_config_file_mode: '0644'\n\nosbuild_worker_remote_worker_service_name: osbuild-remote-worker@\nosbuild_worker_remote_worker_service_dropin_dir: /etc/systemd/system/{{ osbuild_worker_remote_worker_service_name }}.service.d\nosbuild_worker_remote_worker_service_proxy_dropin_file: \"{{ osbuild_worker_remote_worker_service_dropin_dir }}/proxy.conf\"\n\nosbuild_worker_secrets_owner: root\nosbuild_worker_secrets_group: root\nosbuild_worker_secrets_mode: '0400'\n\nosbuild_worker_authentication_client_secret_path_default: \"{{ osbuild_worker_config_dir }}/client_secret\"\nosbuild_worker_authentication_offline_token_path_default: \"{{ osbuild_worker_config_dir }}/offline_token\"\n\nosbuild_worker_azure_credentials_path_default: \"{{ osbuild_worker_config_dir }}/azure-credentials\"\nosbuild_worker_aws_credentials_path_default: \"{{ osbuild_worker_config_dir }}/aws-credentials\"\nosbuild_worker_gcp_credentials_path_default: \"{{ osbuild_worker_config_dir }}/gcp-credentials\"\n```\n\n## Dependencies\n\nThe role has no external dependencies.\n\n## Example Playbook\n\nBelow is an example minimal playbook using the role with only the requires role variables specified. This playbook will install and configure remote `osbuild-worker` on the host with authentication settings for connecting to the remote `osbuild-composer` job queue server located at `composer.example.com`. The `client_secret` is expected to be a filename of a local file that will be copied to the remote host by the role.\n\nNote that this example is not very useful, because the worker is not configured with any upload target authentication (e.g. AWS, Azure, GCP or Koji), thus it won't be able o upload the built image anywhere.\n\n```yaml\n- hosts: osbuild-worker\n  tasks:\n    - name: Include osbuild_worker role\n      ansible.builtin.include_role:\n        name: \"osbuild.osbuild_worker\"\n      vars:\n        osbuild_worker_server_hostname: \"composer.example.com\"\n        osbuild_worker_authentication_oauth_url: \"oauth-server.example.com\"\n        osbuild_worker_authentication_client_id: \"osbuild-automation\"\n        osbuild_worker_authentication_client_secret_file: \"client_secret\"\n```\n\nMore useful example could be an instance of a remote worker configured with the option to upload built images to a Koji instance as well as to AWS. The following things are assumed:\n\n* `client_secret` is a local filename with OAuth client secret\n* `aws_credentials` is a local filename with AWS credentials\n* `koji.keytab` is a local filename of Kerberos keytab file\n\n```yaml\n- hosts: osbuild-worker\n  tasks:\n    - name: Include osbuild_worker role\n      ansible.builtin.include_role:\n        name: \"osbuild.osbuild_worker\"\n      vars:\n        osbuild_worker_server_hostname: \"composer.example.com\"\n        osbuild_worker_authentication_oauth_url: \"oauth-server.example.com\"\n        osbuild_worker_authentication_client_id: \"osbuild-automation\"\n        osbuild_worker_authentication_client_secret_file: \"client_secret\"\n        osbuild_worker_aws_credentials_file: \"aws_credentials\"\n        osbuild_worker_aws_bucket: \"my-s3-bucket\"\n        osbuild_worker_koji_instances:\n          - koji_host: \"koji.example.com\"\n            krb_principal: \"osbuild-automation@EXAMPLE.COM\"\n            krb_keytab_file: \"koji.keytab\"\n```\n\n## What is NOT supported\n\n* Configuring a local osbuild-worker.\n* Configuring the \"generic S3\" upload target authentication.\n* Configuring the \"container registry\" upload target authentication.\n* Configuring the path to `dnf-json` binary.\n* Configuring the proxy server in the worker configuration.\n* Configuring the TLS client certificate authentication.\n* Configuring the osbuild-composer server TLS CA certificate.\n\n## License\n\nApache-2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fosbuild%2Fansible-osbuild-worker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fosbuild%2Fansible-osbuild-worker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fosbuild%2Fansible-osbuild-worker/lists"}