rename dmc12 inventory to cloudlorean and vault admin_password
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
This commit is contained in:
DerLinkman
@@ -0,0 +1,82 @@
|
||||
---
|
||||
id: ALERT-20260909-001
|
||||
type: alert
|
||||
status: resolved
|
||||
severity: high
|
||||
title: Plaintext admin password hash committed outside vault
|
||||
created: 2026-09-09
|
||||
updated: 2026-09-09
|
||||
resolved: 2026-09-09
|
||||
tags: [alert, security, secrets]
|
||||
related: [NFR-002, OQ-006, TECH-SECURITY]
|
||||
source_paths:
|
||||
- roles/bootstrap/defaults/main.yml
|
||||
- inventory/group_vars/external.yml
|
||||
- README.md
|
||||
confidence: confirmed
|
||||
---
|
||||
|
||||
# ALERT-20260909-001 - Plaintext admin password hash committed outside vault
|
||||
|
||||
## Summary
|
||||
|
||||
The SHA-512 hash of the admin password (`admin_password`) is committed in
|
||||
plaintext in `roles/bootstrap/defaults/main.yml` and
|
||||
`inventory/group_vars/external.yml`, while the root README states that
|
||||
`admin_password` lives encrypted in `vault.yml`. The documented secret
|
||||
policy (AGENTS.md, README "Beitragen") forbids plaintext secrets in
|
||||
`defaults/` or `group_vars/`. The same hash is reused across both locations.
|
||||
|
||||
## Why It Matters
|
||||
|
||||
- A committed password hash allows offline guessing of the shared admin
|
||||
password; reusing one hash across hosts amplifies the impact.
|
||||
- It contradicts the project's own documented vault policy and misleads
|
||||
contributors (README claims the value is vaulted).
|
||||
|
||||
## Evidence
|
||||
|
||||
- `roles/bootstrap/defaults/main.yml` lines 12-13 (`admin_password` hash)
|
||||
- `inventory/group_vars/external.yml` lines 10-11 (same hash)
|
||||
- `README.md` "Secrets & Vault" section claims `admin_password` is in
|
||||
`vault.yml`
|
||||
- AGENTS.md "Secrets": no plaintext secrets in `defaults/`/`group_vars/`
|
||||
|
||||
## Suggested Resolution
|
||||
|
||||
Move `admin_password` to `vault.yml` in both locations; keep no plaintext
|
||||
fallback in role defaults. If a default is truly needed for bootstrap,
|
||||
document it explicitly as an accepted risk and set a unique hash per site.
|
||||
Verify whether `vault.yml` already overrides it (OQ-006).
|
||||
|
||||
## Resolution
|
||||
|
||||
Resolved 2026-09-09. OQ-006 was verified first: decrypting `vault.yml`
|
||||
confirmed it did **not** define `admin_password` (no override existed), so the
|
||||
committed hash was a policy violation, not an intended fallback. Fix applied:
|
||||
|
||||
- `admin_password` (SHA-512 hash) moved into encrypted `vault.yml`.
|
||||
- Plaintext hash removed from `roles/bootstrap/defaults/main.yml` and
|
||||
`inventory/group_vars/external.yml` (comment now points to `vault.yml`).
|
||||
- `bootstrap.yml` loads `vault.yml` via `vars_files` (same pattern as
|
||||
`playbooks/monitoring.yml`), so the bootstrap role still resolves the
|
||||
variable for every inventory.
|
||||
- Documentation updated: root `README.md` "Secrets & Vault" and
|
||||
`roles/bootstrap/README.md` (variable now documented as vault-sourced).
|
||||
- NFR-002 acceptance notes and evidence updated accordingly.
|
||||
|
||||
Remaining recommendation (hardening, not blocking): the same hash is still
|
||||
shared across sites; rotating to a unique hash per site would remove the
|
||||
single shared credential.
|
||||
|
||||
## Resolution Evidence
|
||||
|
||||
- `ansible-vault view vault.yml` (decrypted during resolution) now lists
|
||||
`admin_password` among `PROXMOX_USER_NAME`, `PROXMOX_USER_PASS`,
|
||||
`monitoring_zabbix_api_password`.
|
||||
- Repository-wide search for the former hash string (salt fragment) returns
|
||||
no matches - the hash exists only inside the encrypted vault file.
|
||||
- `ansible-playbook --syntax-check bootstrap.yml` passes (with
|
||||
`--vault-password-file .vault_pass`).
|
||||
- `rg -n "admin_password"` shows the variable now only in `vault.yml`
|
||||
(encrypted) and consumed at `roles/bootstrap/tasks/create-admin-user.yml:9`.
|
||||
@@ -0,0 +1,85 @@
|
||||
---
|
||||
id: ALERT-20260909-002
|
||||
type: alert
|
||||
status: resolved
|
||||
severity: medium
|
||||
title: Uncommitted dmc12-to-cloudlorean rename and stale documentation
|
||||
created: 2026-09-09
|
||||
updated: 2026-09-09
|
||||
resolved: 2026-09-09
|
||||
tags: [alert, consistency, git]
|
||||
related: [OQ-003, SCAN-20260909, TECH-CODEBASE-MAP]
|
||||
source_paths:
|
||||
- inventory/dmc12.yml
|
||||
- inventory/cloudlorean.yml
|
||||
- inventory/group_vars/cloudlorean.yml
|
||||
- README.md
|
||||
- AGENTS.md
|
||||
confidence: confirmed
|
||||
---
|
||||
|
||||
# ALERT-20260909-002 - Uncommitted dmc12-to-cloudlorean rename and stale documentation
|
||||
|
||||
## Summary
|
||||
|
||||
The working tree carries a large uncommitted change set (23 modified files,
|
||||
203 insertions / 148 deletions) including the deletion of
|
||||
`inventory/dmc12.yml` and the addition of untracked
|
||||
`inventory/cloudlorean.yml` + `inventory/group_vars/cloudlorean.yml`
|
||||
(git log confirms no rename commit). `README.md` (inventory table, call
|
||||
examples) and `AGENTS.md` (fallstricke) still reference `inventory/dmc12.yml`
|
||||
and `group_vars/dmc12.yml`, which no longer exist.
|
||||
|
||||
## Why It Matters
|
||||
|
||||
- Documentation, examples, and agent instructions point to a non-existent
|
||||
inventory; commands copied from README fail.
|
||||
- The rename plus modifications exist only in the working tree; losing or
|
||||
partially committing them would leave the repo internally inconsistent.
|
||||
- Git history will not record a rename (delete + untracked add), which
|
||||
complicates tracing inventory history.
|
||||
|
||||
## Evidence
|
||||
|
||||
- `git status --short`: `D inventory/dmc12.yml`, `?? inventory/cloudlorean.yml`,
|
||||
`?? inventory/group_vars/cloudlorean.yml`, plus modified roles/ansible.cfg/
|
||||
execute.sh/README/AGENTS
|
||||
- `git log --follow -- inventory/dmc12.yml`: only add commit `d2e8ce4`
|
||||
- `README.md` inventory table lists `dmc12.yml` / `group_vars/dmc12.yml`
|
||||
- `logs/cloudlorean/dmc12/` and `.zabbix-psk/dmc12.psk` exist for host
|
||||
`dmc12` under the new site name
|
||||
|
||||
## Suggested Resolution
|
||||
|
||||
1. Update `README.md` and `AGENTS.md` to the `cloudlorean` inventory.
|
||||
2. Review and commit the rename together with the modified files as one
|
||||
coherent change (owner decision).
|
||||
|
||||
## Resolution
|
||||
|
||||
Resolved 2026-09-09 (owner decision confirmed during the session):
|
||||
|
||||
1. Documentation updated to the `cloudlorean` inventory:
|
||||
- `README.md` - inventory table (Cloudlorean row:
|
||||
`cloudlorean.yml` / `group_vars/cloudlorean.yml` + `debian.yml`),
|
||||
all call examples, "Secrets & Vault" example command.
|
||||
- `AGENTS.md` - "Häufige Fallstricke": `ssh_service_name` reference now
|
||||
points to `inventory/cloudlorean.yml` (`gitea`, `ipam`).
|
||||
- Role READMEs (bootstrap, monitoring, docker, os-updates, healthcheck,
|
||||
manage-ssh-keys, hawser): all `inventory/dmc12.yml` call examples
|
||||
replaced with `inventory/cloudlorean.yml`.
|
||||
2. The rename and the full working-tree change set (23 modified files,
|
||||
untracked `inventory/cloudlorean.yml` + `inventory/group_vars/
|
||||
cloudlorean.yml`, plus this resolution's documentation/vault fixes) were
|
||||
committed together as one coherent change, as suggested.
|
||||
|
||||
## Resolution Evidence
|
||||
|
||||
- `rg -n "dmc12\.yml"` across `README.md`, `AGENTS.md`, and `roles/`
|
||||
returns no matches.
|
||||
- `git status --short` shows a clean tree after the commit (no deleted
|
||||
`inventory/dmc12.yml` and no untracked `inventory/cloudlorean.yml`
|
||||
remaining); `git log` records the coherent change set including the
|
||||
inventory rename.
|
||||
- README inventory table lists Cloudlorean with `group_vars/cloudlorean.yml`
|
||||
and `debian.yml`, matching `inventory/` contents.
|
||||
@@ -0,0 +1,22 @@
|
||||
# Alerts
|
||||
|
||||
This section tracks significant warning conditions: risks, contradictions, blocking gaps, undocumented assumptions, and inconsistencies that could affect requirements, architecture, implementation, security, compliance, data handling, or project planning.
|
||||
|
||||
## Open Alerts
|
||||
|
||||
- None.
|
||||
|
||||
## Resolved, Dismissed, Or Accepted-Risk Alerts
|
||||
|
||||
- [ALERT-20260909-001](./ALERT-20260909-001.md) - **resolved (2026-09-09)**:
|
||||
plaintext `admin_password` SHA-512 hash moved to encrypted `vault.yml`
|
||||
(`bootstrap.yml` loads it via `vars_files`); plaintext copies removed.
|
||||
- [ALERT-20260909-002](./ALERT-20260909-002.md) - **resolved (2026-09-09)**:
|
||||
README/AGENTS/role READMEs updated to the `cloudlorean` inventory; the
|
||||
rename and the working-tree change set committed as one coherent change.
|
||||
|
||||
## Rules
|
||||
|
||||
- Do not create alerts for every suggested question.
|
||||
- Resolve alerts with evidence instead of deleting them.
|
||||
- Keep `STATUS.md` updated with compact active alert counts.
|
||||
Reference in New Issue
Block a user