feat: Add support for configuring provider URL and auto-update settings (#99)

* Mirrored the block style from debian 12 to make it easier to read
* Added support to override how the client gets its providers
* Fixed linting warnings
* Eliminate duplicate run when updating the PR branch
---------

Signed-off-by: Gary Bright <gary@mondoo.com>

Author: username-is-already-taken2

.github/workflows/ansible-ci.yaml

@@ -3,7 +3,9 @@ name: CI
 
 on:
   push:
+    branches: [main]
   pull_request:
+    branches: [main]
   workflow_dispatch:
 
 jobs:

.yamllint

@@ -4,6 +4,7 @@ extends: default
 ignore: |
   *.mql.yaml
   .github/workflows/*.yaml
+  molecule-env/
 
 rules:
   braces:
@@ -14,3 +15,9 @@ rules:
     level: error
   line-length: disable
   truthy: disable
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
+  octal-values:
+    forbid-implicit-octal: true
+    forbid-explicit-octal: true

defaults/main.yml

@@ -5,7 +5,8 @@
 # defaults file for mondoo
 
 use_become: true
-latest_version_url: https://releases.mondoo.com/mondoo/latest.json
+mondoo_releases_base_url: "https://releases.mondoo.com"
+latest_version_url: "{{ mondoo_releases_base_url }}/mondoo/latest.json"
 
 # option to force a re-registration
 force_registration: false
@@ -20,6 +21,15 @@ splay: "60"
 # annotation/ tags for the node
 annotations: ""
 
+# registration token for mondoo platform
+registration_token: ""
+
+# proxy configuration
+proxy_env: {}
+
+# ensure clients are managed in mondoo platform
+ensure_managed_client: false
+
 # Update Task for cnspec (Linux)
 update_linux_enabled: false
 update_linux_cron_day: "*/3"
@@ -35,21 +45,26 @@ update_windows_time: "12:00:00"
 mondoo_gpg_keyid: 4CE909E26AE7439C39CE7647AC69C65100E1C42B
 
 # deb repo
-mondoo_deb_repo_base_url: "https://releases.mondoo.com/debian/"
+mondoo_deb_repo_base_url: "{{ mondoo_releases_base_url }}/debian/"
 mondoo_deb_repo: "{{ mondoo_deb_repo_base_url }} stable main"
-mondoo_deb_gpgkey: "https://releases.mondoo.com/debian/pubkey.gpg"
+mondoo_deb_gpgkey: "{{ mondoo_releases_base_url }}/debian/pubkey.gpg"
 mondoo_deb_gpgkey_dest: "/usr/share/keyrings/mondoo-archive-keyring.gpg"
 
 # yum repo and keys
 # 'mondoo_subscription_manager_repo_id' explicitly excludes 'mondoo_rpm_*'
 mondoo_subscription_manager_repo_id: ""
-mondoo_rpm_repo: "https://releases.mondoo.com/rpm/$basearch/"
-mondoo_rpm_gpgkey: "https://releases.mondoo.com/rpm/pubkey.gpg"
+mondoo_rpm_repo: "{{ mondoo_releases_base_url }}/rpm/$basearch/"
+mondoo_rpm_gpgkey: "{{ mondoo_releases_base_url }}/rpm/pubkey.gpg"
 
 # zypper repo
-mondoo_zypper_repo: "https://releases.mondoo.com/rpm/{{ ansible_userspace_architecture }}/"
-mondoo_zypper_gpgkey: "https://releases.mondoo.com/rpm/pubkey.gpg"
+mondoo_zypper_repo: "{{ mondoo_releases_base_url }}/rpm/{{ ansible_userspace_architecture }}/"
+mondoo_zypper_gpgkey: "{{ mondoo_releases_base_url }}/rpm/pubkey.gpg"
 
 # download and transfer
 mondoo_download_path: /tmp/mondoo_cache/
 mondoo_tmp_windows: "{{ ansible_env.TEMP }}\\s1_install"
+
+# providers configuration
+mondoo_default_providers_url: "{{ mondoo_releases_base_url }}/providers"
+mondoo_providers_url: "{{ mondoo_default_providers_url }}"
+mondoo_providers_autoupdate: true

molecule/default/verify.yml

@@ -13,12 +13,12 @@
       ansible.builtin.file:
         path: "{{ cnspec_test_directory }}"
         state: directory
-        mode: 0644
+        mode: '0644'
     - name: Copy cnspec policies to remote
       ansible.builtin.copy:
         src: "{{ item }}"
         dest: "{{ cnspec_test_directory }}/{{ item | basename }}"
-        mode: 0644
+        mode: '0644'
       with_fileglob:
         - "{{ playbook_dir }}/tests/*mql.yaml"
     - name: Register test files

tasks/linux.yml

@@ -27,3 +27,6 @@
 - name: Login to Mondoo Platform
   ansible.builtin.include_tasks: linux_login.yml
   when: registration_token != ""
+
+- name: Configure Mondoo providers
+  ansible.builtin.include_tasks: linux_providers.yml

tasks/linux_login.yml

@@ -107,4 +107,4 @@
 - name: Ensure cnquery and cnspec are managed
   ansible.builtin.command: cnspec login
   become: "{{ use_become }}"
-  when: (ensure_managed_client is not undefined and ensure_managed_client) and not ansible_check_mode
+  when: ensure_managed_client and not ansible_check_mode

tasks/linux_providers.yml

@@ -0,0 +1,49 @@
+# Copyright (c) Mondoo, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+
+- name: Ensure mondoo config directory exists
+  ansible.builtin.file:
+    dest: /etc/opt/mondoo
+    state: directory
+    mode: '0644'
+  become: "{{ use_become }}"
+  when: not ansible_check_mode
+
+- name: Check if mondoo.yml exists
+  ansible.builtin.stat:
+    path: /etc/opt/mondoo/mondoo.yml
+  register: mondoo_config_file
+
+- name: Create minimal mondoo.yml if it doesn't exist (no registration token scenario)
+  ansible.builtin.file:
+    path: /etc/opt/mondoo/mondoo.yml
+    state: touch
+    mode: '0600'
+  become: "{{ use_become }}"
+  when:
+    - not ansible_check_mode
+    - not mondoo_config_file.stat.exists
+
+- name: Configure providers_url in mondoo.yml (when different from default)
+  ansible.builtin.lineinfile:
+    path: /etc/opt/mondoo/mondoo.yml
+    regexp: '^providers_url:'
+    line: 'providers_url: {{ mondoo_providers_url }}'
+    mode: '0600'
+  become: "{{ use_become }}"
+  when:
+    - not ansible_check_mode
+    - mondoo_providers_url != mondoo_default_providers_url
+
+- name: Configure auto_update in mondoo.yml (only when disabled)
+  ansible.builtin.lineinfile:
+    path: /etc/opt/mondoo/mondoo.yml
+    regexp: '^auto_update:'
+    line: 'auto_update: false'
+    mode: '0600'
+  become: "{{ use_become }}"
+  when:
+    - not ansible_check_mode
+    - not mondoo_providers_autoupdate

tasks/pkg_debian.yml

@@ -40,30 +40,52 @@
         update_cache: yes
       become: "{{ use_become }}"
 
-- name: Install python3-debian for DEB822 repository support (Debian 13+)
-  ansible.builtin.apt:
-    name: python3-debian
-    state: present
-    update_cache: yes
-  become: true
+- name: Configure repository for Debian 13+ (DEB822 format)
   when:
     - not ansible_check_mode
     - ansible_distribution == "Debian"
     - ansible_distribution_major_version | int >= 13
+  block:
+    - name: Install python3-debian for DEB822 repository support (Debian 13+)
+      ansible.builtin.apt:
+        name: python3-debian
+        state: present
+        update_cache: yes
+      become: true
+      retries: 3
+      delay: 5
+      register: python3_debian_install
+      until: python3_debian_install is succeeded
 
-- name: Configure Mondoo deb repository (DEB822 format)
-  ansible.builtin.deb822_repository:
-    name: mondoo
-    types: deb
-    uris: "{{ mondoo_deb_repo_base_url }}"
-    suites: stable
-    components: main
-    signed_by: "{{ mondoo_deb_gpgkey }}"
-  become: "{{ use_become }}"
-  when:
-    - not ansible_check_mode
-    - ansible_distribution == "Debian"
-    - ansible_distribution_major_version | int >= 13
+    - name: Verify python3-debian installation
+      ansible.builtin.command: python3 -c "import debian.deb822; print('DEB822 support available')"
+      register: deb822_check
+      changed_when: false
+      failed_when: deb822_check.rc != 0
+
+    - name: Configure Mondoo deb repository (DEB822 format for Debian 13+)
+      ansible.builtin.deb822_repository:
+        name: mondoo
+        types: deb
+        uris: "{{ mondoo_deb_repo_base_url }}"
+        suites: stable
+        components: main
+        signed_by: "{{ mondoo_deb_gpgkey }}"
+      become: "{{ use_become }}"
+      retries: 3
+      delay: 5
+      register: deb822_repo_config
+      until: deb822_repo_config is succeeded
+
+    - name: Validate DEB822 repository configuration
+      ansible.builtin.stat:
+        path: /etc/apt/sources.list.d/mondoo.sources
+      register: deb822_repo_file
+
+    - name: Ensure DEB822 repository file exists
+      ansible.builtin.fail:
+        msg: "DEB822 repository configuration failed - mondoo.sources file not found"
+      when: not deb822_repo_file.stat.exists
 
 - name: Ensure cnquery and cnspec are installed
   ansible.builtin.apt:

tasks/windows.yml

@@ -164,7 +164,7 @@
   ansible.windows.win_command: cnspec.exe login
   args:
     chdir: "C:\\Program Files\\Mondoo"
-  when: (ensure_managed_client is not undefined and ensure_managed_client) and not ansible_check_mode
+  when: ensure_managed_client and not ansible_check_mode
 
 - name: Store update command as string (Scheduled Task)
   ansible.builtin.set_fact:
@@ -205,3 +205,6 @@
     state: present
     enabled: yes
   when: update_windows_enabled
+
+- name: Configure Mondoo providers
+  ansible.builtin.include_tasks: windows_providers.yml

tasks/windows_providers.yml

@@ -0,0 +1,28 @@
+# Copyright (c) Mondoo, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+
+- name: Ensure mondoo config directory exists
+  ansible.windows.win_file:
+    path: C:\ProgramData\Mondoo
+    state: directory
+  when: not ansible_check_mode
+
+- name: Configure providers_url in mondoo.yml (when different from default)
+  community.windows.win_lineinfile:
+    path: C:\ProgramData\Mondoo\mondoo.yml
+    regexp: '^providers_url:'
+    line: 'providers_url: {{ mondoo_providers_url }}'
+  when:
+    - not ansible_check_mode
+    - mondoo_providers_url != mondoo_default_providers_url
+
+- name: Configure auto_update in mondoo.yml (only when disabled)
+  community.windows.win_lineinfile:
+    path: C:\ProgramData\Mondoo\mondoo.yml
+    regexp: '^auto_update:'
+    line: 'auto_update: false'
+  when:
+    - not ansible_check_mode
+    - not mondoo_providers_autoupdate