rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
2026-09-09 14:14:18 +02:00
parent a31751af1d
commit 30f3e9a4c6
96 changed files with 3602 additions and 138 deletions
@@ -0,0 +1,90 @@
+---
+id: TECH-CODEBASE-MAP
+type: technical
+status: active
+title: Codebase Map
+created: '2026-09-09'
+updated: '2026-09-09'
+tags:
+- technical
+- codebase
+related:
+- TECH-ARCHITECTURE
+- SCAN-20260909
+source_paths: []
+confidence: confirmed
+---
+
+# Codebase Map
+
+Ansible repository, no application source code. Structure as of 2026-09-09.
+
+## Root Files
+
+| Path | Purpose |
+| --- | --- |
+| `ansible.cfg` | Global Ansible config: no host key checking, `roles_path=./roles`, `forks=20`, smart gathering, SSH pipelining |
+| `bootstrap.yml` | Top-level playbook, binds the `bootstrap` role with Debian guard |
+| `execute.sh` | Starts the interactive Docker runtime container (`ansible:deb13`) |
+| `vault.yml` | Ansible-Vault encrypted secrets (tracked, encrypted) |
+| `setenv.sh` | Proxmox credentials (git-ignored, not in repo) |
+| `.vault_pass`, `.zabbix-psk/`, `logs/` | Vault password, per-host PSKs, update logs (git-ignored) |
+
+## Directories
+
+```
+docker/                  Dockerfile (debian:trixie-slim + ansible-core 2.20.x),
+                         requirements.yml (pinned collections), ansible-functs.sh
+                         (aliases ap/ag/av)
+inventory/               cloudlorean.yml, home.yml, external.yml + group_vars/
+playbooks/               docker.yml, monitoring.yml, os-updates-deb.yml,
+                         upgrade-hawser.yml, hardening/manage-ssh-keys.yml
+roles/bootstrap/         tasks/ (8 subtasks), templates/ (4), handlers/, README.md
+roles/docker/            tasks/ (2), templates/sources.list.j2, handlers/, README.md
+roles/hawser/            tasks/ (2), templates/docker-compose.yml.j2, handlers/, README.md
+roles/healthcheck/       tasks/main.yml, defaults/, README.md (no handlers/templates)
+roles/manage-ssh-keys/   tasks/ (4), handlers/, defaults/, README.md
+roles/monitoring/        tasks/ (8), templates/ (2: zabbix_agent2.conf.j2, docker.conf.j2),
+                         handlers/, README.md
+roles/os-updates/        tasks/ (6), templates/ (2: sources.list.j2, sources.list-deb822.j2),
+                         handlers/, README.md
+```
+
+## Entry Points
+
+| Playbook | Role(s) | Notes |
+| --- | --- | --- |
+| `bootstrap.yml` | bootstrap (+ docker, monitoring) | Full initial setup |
+| `playbooks/docker.yml` | docker | Docker Engine install |
+| `playbooks/monitoring.yml` | monitoring | Loads `../vault.yml` |
+| `playbooks/os-updates-deb.yml` | os-updates, healthcheck | Update + quality gate |
+| `playbooks/upgrade-hawser.yml` | hawser | Compose stack update |
+| `playbooks/hardening/manage-ssh-keys.yml` | manage-ssh-keys | No Debian guard, no become |
+
+## Conventions (Observed)
+
+- Roles split logic into `tasks/<name>.yml` subtasks; `tasks/main.yml` only
+  imports/includes (`bootstrap`, `os-updates`) or delegates to a single
+  subtask (`docker`, `hawser`).
+- Newer tasks use FQCN; older tasks (apt, file, blockinfile, set_fact,
+  include_role) still use short names.
+- Per-role README documents variables, templates, handlers, tags.
+- Tags observed: `motd`, `ssh`, `bashrc`, `sysctl` (bootstrap),
+  `monitoring` (monitoring role).
+
+## Tests
+
+- No automated test suite. Verification is manual: run in the Docker
+  container, optional `ansible-lint`, `--check` dry runs. See
+  [Testing](./testing.md).
+
+## Inventories
+
+| Site | File | Groups | Hosts |
+| --- | --- | --- | --- |
+| cloudlorean | `inventory/cloudlorean.yml` | debian (13), proxmox (2: dmc12, pbs) | 192.168.212.0/24 |
+| home | `inventory/home.yml` | debian (6), proxmox (1: tardis) | 10.13.37.0/24 |
+| external | `inventory/external.yml` | debian (4) | IPv6-only |
+
+Per-site `group_vars/<site>.yml` override Zabbix servers, API URL, proxy,
+host groups and templates. See [Architecture](./architecture.md).