From 14c61cdf6c8821976ec741d0deeb9078391883f0 Mon Sep 17 00:00:00 2001
From: Andrey Prokopyuk <andrey.prokopyuk@gmail.com>
Date: Sun, 1 Nov 2026 21:06:23 +0300
Subject: [PATCH] Pin remote Python interpreter in inventory examples and
 bootstrap

---
 bootstrap.py                  | 1 +
 inventory.example.yml         | 1 +
 inventory.mtproxy.example.yml | 1 +
 inventory.ssh.example.yml     | 1 +
 tests/test_bootstrap.py       | 2 ++
 5 files changed, 6 insertions(+)

diff --git a/bootstrap.py b/bootstrap.py
index da535fd..70e8dfc 100644
--- a/bootstrap.py
+++ b/bootstrap.py
@@ -49,6 +49,7 @@ def bootstrap(path, limit, password_file=None):
             variables = dict(host, tg_bootstrap_phase=phase,
                              ansible_user=admin['user'] if phase == 'policy' else admin['bootstrap_user'],
                              ansible_ssh_private_key_file=str(key) if phase == 'policy' else admin.get('bootstrap_private_key_file', str(key)))
+            variables.setdefault('ansible_python_interpreter', '/usr/bin/python3')
             if phase == 'account' and admin.get('bootstrap_auth') == 'password':
                 password = Path(password_file).read_text().strip() if password_file else getpass.getpass(f'Initial SSH password for {name}: ')
                 if not password:
diff --git a/inventory.example.yml b/inventory.example.yml
index ae7109d..d0b8080 100644
--- a/inventory.example.yml
+++ b/inventory.example.yml
@@ -2,6 +2,7 @@ all:
   children:
     tg_proxies:
       vars:
+        ansible_python_interpreter: /usr/bin/python3
         ansible_user: deploy
         # Listed public addresses come first; unlisted links follow in unspecified order.
         tg_links_order: [tg.example.com]
diff --git a/inventory.mtproxy.example.yml b/inventory.mtproxy.example.yml
index f1a4ce0..fe405ea 100644
--- a/inventory.mtproxy.example.yml
+++ b/inventory.mtproxy.example.yml
@@ -2,6 +2,7 @@ all:
   children:
     tg_proxies:
       vars:
+        ansible_python_interpreter: /usr/bin/python3
         ansible_user: deploy
         # Listed public addresses come first; unlisted links follow in unspecified order.
         tg_links_order: [tg.example.com]
diff --git a/inventory.ssh.example.yml b/inventory.ssh.example.yml
index 7847219..c65f984 100644
--- a/inventory.ssh.example.yml
+++ b/inventory.ssh.example.yml
@@ -2,6 +2,7 @@ all:
   children:
     tg_proxies:
       vars:
+        ansible_python_interpreter: /usr/bin/python3
         ansible_user: deploy
         # Listed public addresses come first; unlisted links follow in unspecified order.
         tg_links_order: [tg.example.com]
diff --git a/tests/test_bootstrap.py b/tests/test_bootstrap.py
index 6f579fc..1505ec8 100644
--- a/tests/test_bootstrap.py
+++ b/tests/test_bootstrap.py
@@ -1,5 +1,6 @@
 import unittest
 from unittest.mock import patch
+
 import bootstrap
 
 
@@ -36,6 +37,7 @@ def test_failed_new_access_keeps_policy_unchanged(self, run, output, probe):
         phases = []
         def phase(command, **kwargs):
             data = YAML().load(Path(command[2]))
+            self.assertEqual(data['all']['hosts']['node']['ansible_python_interpreter'], '/usr/bin/python3')
             phases.append(data['all']['hosts']['node']['tg_bootstrap_phase'])
             return type('Result', (), {'returncode': 0})()
         run.side_effect = phase