Add opt-in Railiance host time and private authority automation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

ansible/roles/railiance_clock/tasks/authority.yaml

@@ -0,0 +1,128 @@
+---
+- name: Require versioned artifact and admitted signing-key delivery
+  ansible.builtin.assert:
+    that:
+      - railiance_clock_wheelhouse | length > 0
+      - railiance_clock_wheel_sha256 is match('^[0-9a-f]{64}$')
+      - railiance_clock_private_key_source | length > 0
+      - railiance_clock_kid | length > 0
+- name: Create unprivileged authority account
+  ansible.builtin.user:
+    name: railiance-clock
+    system: true
+    shell: /usr/sbin/nologin
+    create_home: false
+- name: Create root-owned install tree
+  ansible.builtin.file:
+    path: "{{ railiance_clock_install_root }}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+- name: Create private signing-key directory
+  ansible.builtin.file:
+    path: "{{ railiance_clock_state_root }}"
+    state: directory
+    owner: railiance-clock
+    group: railiance-clock
+    mode: '0700'
+- name: Create public health runtime directory
+  ansible.builtin.file:
+    path: "{{ railiance_clock_health_root }}"
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+- name: Persist runtime directory creation across boot
+  ansible.builtin.copy:
+    dest: /etc/tmpfiles.d/railiance-clock.conf
+    content: "d {{ railiance_clock_health_root }} 0755 root root -\n"
+    owner: root
+    group: root
+    mode: '0644'
+- name: Verify selected wheel checksum on controller
+  ansible.builtin.stat:
+    path: "{{ railiance_clock_wheelhouse }}/railiance_clock-0.1.0-py3-none-any.whl"
+    checksum_algorithm: sha256
+  delegate_to: localhost
+  become: false
+  register: clock_wheel
+- name: Refuse artifact drift
+  ansible.builtin.assert:
+    that: clock_wheel.stat.checksum == railiance_clock_wheel_sha256
+- name: Copy offline wheelhouse with locked dependencies
+  ansible.builtin.copy:
+    src: "{{ railiance_clock_wheelhouse }}/"
+    dest: "{{ railiance_clock_install_root }}/wheels/"
+    owner: root
+    group: root
+    mode: '0644'
+  register: clock_artifact_copy
+- name: Install isolated authority package without network package lookup
+  ansible.builtin.pip:
+    name: railiance-clock==0.1.0
+    state: "{{ 'forcereinstall' if clock_artifact_copy.changed else 'present' }}"
+    virtualenv: "{{ railiance_clock_install_root }}/venv"
+    virtualenv_command: python3 -m venv
+    extra_args: "--no-index --find-links={{ railiance_clock_install_root }}/wheels"
+  notify: Restart admitted clock authority
+- name: Deliver admitted signing key without logging values
+  ansible.builtin.copy:
+    src: "{{ railiance_clock_private_key_source }}"
+    dest: "{{ railiance_clock_state_root }}/signing.pem"
+    owner: railiance-clock
+    group: railiance-clock
+    mode: '0600'
+  no_log: true
+  diff: false
+  notify: Restart admitted clock authority
+- name: Install prebuilt read-only kernel-health probe
+  ansible.builtin.copy:
+    src: "{{ railiance_clock_wheelhouse }}/railiance-clock-kernel-health"
+    dest: "{{ railiance_clock_install_root }}/kernel-health"
+    owner: root
+    group: root
+    mode: '0755'
+- name: Write non-secret authority and health policy configuration
+  ansible.builtin.template:
+    src: "{{ item }}.json.j2"
+    dest: "{{ railiance_clock_install_root }}/{{ item }}.json"
+    owner: root
+    group: root
+    mode: '0644'
+  loop: [authority, health-policy]
+  notify: Restart admitted clock authority
+- name: Install host service units
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: '0644'
+  loop: [railiance-clock.service, railiance-clock-health.service, railiance-clock-health.timer]
+  notify: Reload clock service units
+- name: Load changed units before starting
+  ansible.builtin.meta: flush_handlers
+- name: Export current host health
+  ansible.builtin.systemd:
+    name: railiance-clock-health.service
+    state: started
+- name: Enable bounded periodic host-health export
+  ansible.builtin.systemd:
+    name: railiance-clock-health.timer
+    enabled: true
+    state: started
+- name: Enable private authority
+  ansible.builtin.systemd:
+    name: railiance-clock.service
+    enabled: true
+    state: started
+- name: Verify usable authority independently of service liveness
+  ansible.builtin.uri:
+    url: http://127.0.0.1:8787/readyz
+    return_content: true
+    status_code: 200
+  register: clock_ready
+  retries: 3
+  delay: 2
+  until: clock_ready.status == 200

ansible/roles/railiance_clock/tasks/main.yaml

@@ -0,0 +1,50 @@
+---
+- name: Converge explicitly admitted Railiance Clock host scope
+  when: railiance_clock_enabled | bool
+  block:
+    - name: Require supported host and concrete admission
+      ansible.builtin.assert:
+        that:
+          - ansible_system == 'Linux'
+          - ansible_distribution == 'Ubuntu'
+          - ansible_distribution_major_version == '24'
+          - railiance_clock_admission_ref | length > 0
+          - railiance_clock_upstreams | length > 0
+          - railiance_clock_host_drift_ppm | int >= 500
+          - railiance_clock_max_error_ns | int > railiance_clock_measurement_margin_ns | int
+    - name: Gather service facts without changing clocks
+      ansible.builtin.service_facts:
+    - name: Refuse competing discipline daemons
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.services.get(item, {}).get('state', 'stopped') != 'running'
+      loop: [chrony.service, chronyd.service, ntp.service, ntpd.service]
+    - name: Ensure the existing time daemon is installed
+      ansible.builtin.assert:
+        that: "'systemd-timesyncd.service' in ansible_facts.services"
+    - name: Configure reviewed timesyncd baseline only when explicitly selected
+      when: railiance_clock_manage_timesyncd | bool
+      block:
+        - name: Create timesyncd configuration directory
+          ansible.builtin.file:
+            path: /etc/systemd/timesyncd.conf.d
+            state: directory
+            owner: root
+            group: root
+            mode: '0755'
+        - name: Install sole owner drop-in
+          ansible.builtin.template:
+            src: timesyncd.conf.j2
+            dest: /etc/systemd/timesyncd.conf.d/60-railiance-clock.conf
+            owner: root
+            group: root
+            mode: '0644'
+          notify: Restart reviewed timesyncd
+        - name: Keep admitted daemon enabled
+          ansible.builtin.systemd:
+            name: systemd-timesyncd
+            enabled: true
+            state: started
+    - name: Install authority and health export
+      when: railiance_clock_authority_enabled | bool
+      ansible.builtin.include_tasks: authority.yaml