mattertimesync: add build + server roles

Build role compiles the tagged source on the build host (npm ci + npm run
bundle) into a versioned mattertimesync-<ver>.tar.gz in build_srv_dir. Server
role installs the single bundled .mjs, creates the mattertimesync service user
and a 0700 storage dir for the Matter fabric keys, templates config.json, and
runs a hardened oneshot sync via a systemd timer. Both roles depend on the
nodejs role for Node >=20.

10 files changed, 198 insertions, 0 deletions

diff --git a/mattertimesync/build/defaults/main.yaml b/mattertimesync/build/defaults/main.yaml
new file mode 100644
index 0000000..96156f8
--- /dev/null
+++ b/mattertimesync/build/defaults/main.yaml
@@ -0,0 +1,9 @@
+---
+
+mattertimesync_version: "0.1.0"
+# https://github.com/lukehoersten/mattertimesync/tags
+# Pure-JS project: npm run bundle produces one self-contained mattertimesync.mjs
+# (no native modules), so the target only needs node to run it.
+mattertimesync_tar: "https://github.com/{{github_user}}/mattertimesync/archive/refs/tags/v{{mattertimesync_version}}.tar.gz"
+mattertimesync_build_dir: "/tmp/mattertimesync-{{mattertimesync_version}}"
+mattertimesync_srv_dir: "{{build_srv_dir}}"
diff --git a/mattertimesync/build/meta/main.yaml b/mattertimesync/build/meta/main.yaml
new file mode 100644
index 0000000..6116998
--- /dev/null
+++ b/mattertimesync/build/meta/main.yaml
@@ -0,0 +1,4 @@
+---
+
+dependencies:
+  - nodejs
diff --git a/mattertimesync/build/tasks/main.yaml b/mattertimesync/build/tasks/main.yaml
new file mode 100644
index 0000000..68c9da0
--- /dev/null
+++ b/mattertimesync/build/tasks/main.yaml
@@ -0,0 +1,41 @@
+---
+
+- name: unarchive mattertimesync source
+  unarchive:
+    remote_src: yes
+    src: "{{mattertimesync_tar}}"
+    dest: "/tmp/"
+    creates: "{{mattertimesync_build_dir}}"
+
+- name: check if mattertimesync build exists
+  stat:
+    path: "{{mattertimesync_srv_dir}}/mattertimesync-{{mattertimesync_version}}.tar.gz"
+  register: build_file
+
+- name: install mattertimesync build dependencies
+  command: "npm ci"
+  args:
+    chdir: "{{mattertimesync_build_dir}}"
+  when: not build_file.stat.exists
+
+- name: bundle mattertimesync
+  command: "npm run bundle"
+  args:
+    chdir: "{{mattertimesync_build_dir}}"
+    creates: "{{mattertimesync_build_dir}}/mattertimesync.mjs"
+  when: not build_file.stat.exists
+
+- name: create build server dir
+  become: yes
+  file:
+    path: "{{mattertimesync_srv_dir}}"
+    mode: "0755"
+    state: "directory"
+
+- name: create gz archive of mattertimesync bundle
+  become: yes
+  archive:
+    path: "{{mattertimesync_build_dir}}/mattertimesync.mjs"
+    dest: "{{mattertimesync_srv_dir}}/mattertimesync-{{mattertimesync_version}}.tar.gz"
+    format: "gz"
+  when: not build_file.stat.exists
diff --git a/mattertimesync/server/defaults/main.yaml b/mattertimesync/server/defaults/main.yaml
new file mode 100644
index 0000000..4c952b0
--- /dev/null
+++ b/mattertimesync/server/defaults/main.yaml
@@ -0,0 +1,24 @@
+---
+
+# https://github.com/lukehoersten/mattertimesync/tags
+mattertimesync_version: "0.1.0"
+
+mattertimesync_user: "mattertimesync"
+mattertimesync_install_dir: "/opt/mattertimesync"
+mattertimesync_config_dir: "/etc/mattertimesync"
+# Persistent Matter fabric state — holds the controller's private keys and
+# operational certs, so it stays mode 0700 and owned by the service user.
+mattertimesync_storage_path: "/var/lib/mattertimesync"
+
+# --- config.json ---
+# IANA time-zone name (never a fixed UTC offset; DST is derived from it).
+mattertimesync_timezone: "America/Chicago"
+mattertimesync_log_level: "info"   # debug, info, warn, error
+
+# --- systemd timer schedule ---
+mattertimesync_on_boot_sec: "2min"
+mattertimesync_on_active_sec: "1h"
+mattertimesync_randomized_delay_sec: "5min"
+
+# mattertimesync_bin_url: — required, set in host_vars, e.g.
+#   http://{{build_server_host}}:{{build_server_port}}/mattertimesync-{{mattertimesync_version}}.tar.gz
diff --git a/mattertimesync/server/handlers/main.yaml b/mattertimesync/server/handlers/main.yaml
new file mode 100644
index 0000000..9b124e3
--- /dev/null
+++ b/mattertimesync/server/handlers/main.yaml
@@ -0,0 +1,6 @@
+---
+
+- name: reload systemd
+  become: yes
+  systemd:
+    daemon_reload: "yes"
diff --git a/mattertimesync/server/meta/main.yaml b/mattertimesync/server/meta/main.yaml
new file mode 100644
index 0000000..6116998
--- /dev/null
+++ b/mattertimesync/server/meta/main.yaml
@@ -0,0 +1,4 @@
+---
+
+dependencies:
+  - nodejs
diff --git a/mattertimesync/server/tasks/main.yaml b/mattertimesync/server/tasks/main.yaml
new file mode 100644
index 0000000..7be2392
--- /dev/null
+++ b/mattertimesync/server/tasks/main.yaml
@@ -0,0 +1,80 @@
+---
+
+- name: add mattertimesync user
+  become: yes
+  user:
+    name: "{{mattertimesync_user}}"
+    system: "yes"
+    shell: "/usr/sbin/nologin"
+    home: "{{mattertimesync_storage_path}}"
+    create_home: "no"
+
+- name: create mattertimesync directories
+  become: yes
+  file:
+    path: "{{item.path}}"
+    state: "directory"
+    owner: "{{item.owner}}"
+    group: "{{item.owner}}"
+    mode: "{{item.mode}}"
+  loop:
+    - { path: "{{mattertimesync_install_dir}}", owner: "root", mode: "0755" }
+    - { path: "{{mattertimesync_config_dir}}", owner: "root", mode: "0755" }
+    - { path: "{{mattertimesync_storage_path}}", owner: "{{mattertimesync_user}}", mode: "0700" }
+
+- name: check installed mattertimesync version
+  become: yes
+  stat:
+    path: "{{mattertimesync_install_dir}}/.installed-{{mattertimesync_version}}"
+  register: mattertimesync_installed
+
+- name: install mattertimesync bundle
+  become: yes
+  unarchive:
+    remote_src: yes
+    src: "{{mattertimesync_bin_url}}"
+    dest: "{{mattertimesync_install_dir}}/"
+    owner: "root"
+    group: "root"
+  when: not mattertimesync_installed.stat.exists
+
+- name: stamp installed mattertimesync version
+  become: yes
+  copy:
+    dest: "{{mattertimesync_install_dir}}/.installed-{{mattertimesync_version}}"
+    content: "{{mattertimesync_version}}\n"
+    mode: "0644"
+  when: not mattertimesync_installed.stat.exists
+
+- name: configure mattertimesync
+  become: yes
+  template:
+    src: "config.json.j2"
+    dest: "{{mattertimesync_config_dir}}/config.json"
+    owner: "root"
+    group: "{{mattertimesync_user}}"
+    mode: "0640"
+
+- name: install mattertimesync systemd service
+  become: yes
+  template:
+    src: "mattertimesync.service.j2"
+    dest: "/etc/systemd/system/mattertimesync.service"
+    mode: "0644"
+  notify: reload systemd
+
+- name: install mattertimesync systemd timer
+  become: yes
+  template:
+    src: "mattertimesync.timer.j2"
+    dest: "/etc/systemd/system/mattertimesync.timer"
+    mode: "0644"
+  notify: reload systemd
+
+- name: enable mattertimesync timer
+  become: yes
+  systemd:
+    name: "mattertimesync.timer"
+    enabled: "yes"
+    state: "started"
+    daemon_reload: "yes"
diff --git a/mattertimesync/server/templates/config.json.j2 b/mattertimesync/server/templates/config.json.j2
new file mode 100644
index 0000000..0ace585
--- /dev/null
+++ b/mattertimesync/server/templates/config.json.j2
@@ -0,0 +1,5 @@
+{
+  "storagePath": "{{mattertimesync_storage_path}}",
+  "timezone": "{{mattertimesync_timezone}}",
+  "logLevel": "{{mattertimesync_log_level}}"
+}
diff --git a/mattertimesync/server/templates/mattertimesync.service.j2 b/mattertimesync/server/templates/mattertimesync.service.j2
new file mode 100644
index 0000000..e47cc35
--- /dev/null
+++ b/mattertimesync/server/templates/mattertimesync.service.j2
@@ -0,0 +1,15 @@
+[Unit]
+Description=Matter device clock synchronization
+Wants=network-online.target
+After=network-online.target time-sync.target
+
+[Service]
+Type=oneshot
+User={{mattertimesync_user}}
+Group={{mattertimesync_user}}
+ExecStart=/usr/bin/node {{mattertimesync_install_dir}}/mattertimesync.mjs --config {{mattertimesync_config_dir}}/config.json sync
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths={{mattertimesync_storage_path}}
diff --git a/mattertimesync/server/templates/mattertimesync.timer.j2 b/mattertimesync/server/templates/mattertimesync.timer.j2
new file mode 100644
index 0000000..e378dfc
--- /dev/null
+++ b/mattertimesync/server/templates/mattertimesync.timer.j2
@@ -0,0 +1,10 @@
+[Unit]
+Description=Periodic Matter device clock synchronization
+
+[Timer]
+OnBootSec={{mattertimesync_on_boot_sec}}
+OnUnitActiveSec={{mattertimesync_on_active_sec}}
+RandomizedDelaySec={{mattertimesync_randomized_delay_sec}}
+
+[Install]
+WantedBy=timers.target