rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
2026-09-09 14:14:18 +02:00
parent a31751af1d
commit 30f3e9a4c6
96 changed files with 3602 additions and 138 deletions
@@ -0,0 +1,15 @@
+# Non-Functional Requirements
+
+This index routes to non-functional requirement topics; atomic NFR records live only in linked topic files.
+
+## When To Read
+
+- Work with quality attributes, operations, security, resilience, performance, or service levels.
+
+## Key Files
+
+- [Operational policies](./operational-policies.md) - NFR-001..NFR-006 (platform, secrets, logging, runtime, documentation, LXC)
+
+## Placeholders Or Stale Areas
+
+- None.
@@ -0,0 +1,167 @@
+---
+id: NFR-OPERATIONAL-POLICIES
+type: requirements
+status: active
+title: Operational Policies
+created: '2026-09-09'
+updated: '2026-09-09'
+tags:
+- requirements
+- non-functional
+related:
+- PROJECT
+- CONSTRAINTS
+source_paths:
+- README.md
+- AGENTS.md
+confidence: confirmed
+---
+
+# Operational Policies
+
+Explicitly stated non-functional requirements (sources: root `README.md`,
+`AGENTS.md`; evidence linked in
+[requirement-evidence.yml](../../traceability/requirement-evidence.yml)).
+
+<a id="nfr-001"></a>
+
+## NFR-001 - Debian-only target platforms
+
+Status: active
+Tags: [platform]
+Related: [REQ-001]
+Confidence: confirmed
+
+### Statement
+
+All playbooks must target Debian only and verify
+`ansible_facts['os_family'] == "Debian"`, aborting on other systems.
+
+### Rationale
+
+README "Voraussetzungen": "Ziel-Hosts: Debian (alle Playbooks prüfen
+`os_family == "Debian"`)".
+
+### Acceptance Notes
+
+- Exception observed: `playbooks/hardening/manage-ssh-keys.yml` lacks the
+  guard (tracked in the scan report).
+
+<a id="nfr-002"></a>
+
+## NFR-002 - Secrets never committed unencrypted
+
+Status: active
+Tags: [security, vault]
+Related: [TECH-SECURITY, ALERT-20260909-001]
+Confidence: confirmed
+
+### Statement
+
+Sensitive values (passwords, API keys) belong in encrypted `vault.yml`;
+no plaintext secrets in `defaults/`, `group_vars/`, or commits.
+
+### Rationale
+
+README "Secrets & Vault" and "Beitragen" rule 3; AGENTS.md "Secrets"
+section.
+
+### Acceptance Notes
+
+- Resolved 2026-09-09: `admin_password` moved to encrypted `vault.yml`
+  (ALERT-20260909-001); no plaintext secrets remain in `defaults/` or
+  `group_vars/`.
+
+<a id="nfr-003"></a>
+
+## NFR-003 - Per-host update audit log
+
+Status: active
+Tags: [logging, audit]
+Related: [MOD-004, MOD-005]
+Confidence: confirmed
+
+### Statement
+
+The `os-updates` and `healthcheck` roles write one update log per host to
+`logs/<inventory>/<hostname>/update.log` on the controller as a local
+audit trail.
+
+### Rationale
+
+README "Logging" section.
+
+### Acceptance Notes
+
+- `logs/` is git-ignored.
+
+<a id="nfr-004"></a>
+
+## NFR-004 - Docker-based execution environment
+
+Status: active
+Tags: [runtime, docker]
+Related: [TECH-DEPLOYMENT]
+Confidence: confirmed
+
+### Statement
+
+Playbooks must be runnable from the provided Docker environment without a
+local Ansible installation (`execute.sh`, `docker/Dockerfile`).
+
+### Rationale
+
+README "Docker-Ausführungsumgebung": "Damit Playbooks nicht lokal
+installiert werden müssen, liefert das Repository ein fertiges Docker-Image."
+
+### Acceptance Notes
+
+- Collections pinned in `docker/requirements.yml`; image rebuild on
+  collection changes.
+
+<a id="nfr-005"></a>
+
+## NFR-005 - Documentation duty for every change
+
+Status: active
+Tags: [documentation, process]
+Related: [CONSTRAINTS]
+Confidence: confirmed
+
+### Statement
+
+Every new feature, parameter, and variable must be documented in the
+corresponding role README before commit; playbook changes update the root
+README.
+
+### Rationale
+
+README "Beitragen" rule 2; AGENTS.md "WICHTIG: Dokumentationspflicht bei
+Änderungen".
+
+### Acceptance Notes
+
+- None.
+
+<a id="nfr-006"></a>
+
+## NFR-006 - LXC-aware execution
+
+Status: active
+Tags: [platform, lxc]
+Related: [MOD-004]
+Confidence: confirmed
+
+### Statement
+
+Tasks affecting `sysctl` or `reboot` must be skipped on LXC containers
+(`virtualization_type != "lxc"`).
+
+### Rationale
+
+AGENTS.md "OS-Unterstützung": "LXC-Container: Tasks, die `sysctl` oder
+`reboot` betreffen, müssen ... übersprungen werden."
+
+### Acceptance Notes
+
+- Implemented in `roles/os-updates/tasks/reboot.yml`.