rename dmc12 inventory to cloudlorean and vault admin_password
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
This commit is contained in:
DerLinkman
@@ -0,0 +1,18 @@
|
||||
# Traceability
|
||||
|
||||
This section connects requirements, changes, decisions, technical documentation, and source paths.
|
||||
|
||||
## When To Read
|
||||
|
||||
- Analyze implementation coverage or change impact.
|
||||
|
||||
## Key Files
|
||||
|
||||
- [Requirement map](./requirement-map.md)
|
||||
- [Requirement evidence](./requirement-evidence.yml)
|
||||
- [Change impact map](./change-impact-map.md)
|
||||
- [Code map](./code-map.md)
|
||||
|
||||
## Placeholders Or Stale Areas
|
||||
|
||||
- `change-impact-map.md` still placeholder (no change requests yet).
|
||||
@@ -0,0 +1,3 @@
|
||||
# Change Impact Map
|
||||
|
||||
No change impact traceability has been captured yet.
|
||||
@@ -0,0 +1,20 @@
|
||||
# Code Traceability Map
|
||||
|
||||
Connects wiki documents to source paths. Created during the 2026-09-09 scan.
|
||||
|
||||
| Wiki Document | Source Paths | Notes |
|
||||
| --- | --- | --- |
|
||||
| [MOD-001 Bootstrap](../technical/modules/MOD-001-bootstrap-role.md) | `bootstrap.yml`, `roles/bootstrap/` | Composes docker + monitoring roles |
|
||||
| [MOD-002 Docker](../technical/modules/MOD-002-docker-role.md) | `playbooks/docker.yml`, `roles/docker/` | Official Docker apt repo |
|
||||
| [MOD-003 Monitoring](../technical/modules/MOD-003-monitoring-role.md) | `playbooks/monitoring.yml`, `roles/monitoring/`, `vault.yml` | Zabbix Agent 2, PSK, API registration |
|
||||
| [MOD-004 OS Updates](../technical/modules/MOD-004-os-updates-role.md) | `playbooks/os-updates-deb.yml`, `roles/os-updates/` | Mirror switch, reboot, logging |
|
||||
| [MOD-005 Healthcheck](../technical/modules/MOD-005-healthcheck-role.md) | `playbooks/os-updates-deb.yml`, `roles/healthcheck/` | Container quality gate |
|
||||
| [MOD-006 Hawser](../technical/modules/MOD-006-hawser-role.md) | `playbooks/upgrade-hawser.yml`, `roles/hawser/` | Compose stack update |
|
||||
| [MOD-007 Manage SSH Keys](../technical/modules/MOD-007-manage-ssh-keys-role.md) | `playbooks/hardening/manage-ssh-keys.yml`, `roles/manage-ssh-keys/` | No Debian guard (gap) |
|
||||
| [TECH-DEPLOYMENT](../technical/deployment.md) | `execute.sh`, `docker/`, `ansible.cfg` | Runtime environment |
|
||||
| [TECH-SECURITY](../technical/security.md) | `vault.yml`, `roles/*/defaults/`, `ansible.cfg`, `roles/monitoring/tasks/configure-psk.yml` | Secrets, SSH, PSK |
|
||||
| [TECH-INTEGRATIONS-ZABBIX](../technical/integrations/zabbix.md) | `roles/monitoring/`, `inventory/group_vars/` | Zabbix + external services |
|
||||
| [NFR-003](../requirements/non-functional/operational-policies.md#nfr-003) | `roles/os-updates/tasks/logging_*.yml`, `roles/healthcheck/tasks/main.yml` | Update log audit trail |
|
||||
| [NFR-006](../requirements/non-functional/operational-policies.md#nfr-006) | `roles/os-updates/tasks/reboot.yml`, `roles/bootstrap/tasks/configure-sysctl.yml` | LXC skips |
|
||||
| [ALERT-20260909-001](../alerts/ALERT-20260909-001.md) | `roles/bootstrap/defaults/main.yml`, `inventory/group_vars/external.yml`, `bootstrap.yml`, `vault.yml` | Plaintext admin hash - resolved (vaulted) |
|
||||
| [ALERT-20260909-002](../alerts/ALERT-20260909-002.md) | `inventory/cloudlorean.yml`, `README.md`, `AGENTS.md`, `roles/*/README.md` | Rename committed, stale docs fixed |
|
||||
@@ -0,0 +1,129 @@
|
||||
version: 1
|
||||
updated: '2026-09-09'
|
||||
records:
|
||||
REQ-001:
|
||||
requirement: REQ-001
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Playbooks table: 'bootstrap.yml | bootstrap | Vollständige Ersteinrichtung eines Debian-Hosts'"
|
||||
type: doc
|
||||
- source: roles/bootstrap/tasks/main.yml
|
||||
locator: "import_tasks list + import_role docker/monitoring"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
REQ-002:
|
||||
requirement: REQ-002
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Playbooks table: 'playbooks/docker.yml | docker | Docker Engine installieren'"
|
||||
type: doc
|
||||
- source: roles/docker/defaults/main.yml
|
||||
locator: "docker_mirror, docker_packages"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
REQ-003:
|
||||
requirement: REQ-003
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Playbooks table: 'playbooks/monitoring.yml | monitoring | Zabbix Agent 2 installieren & registrieren'"
|
||||
type: doc
|
||||
- source: roles/monitoring/tasks/register-host.yml
|
||||
locator: "community.zabbix.zabbix_host registration"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
REQ-004:
|
||||
requirement: REQ-004
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Playbooks table: 'playbooks/os-updates-deb.yml | os-updates, healthcheck | Pakete aktualisieren + Healthcheck'"
|
||||
type: doc
|
||||
- source: playbooks/os-updates-deb.yml
|
||||
locator: "include_role os-updates + healthcheck"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
REQ-005:
|
||||
requirement: REQ-005
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Playbooks table: 'playbooks/upgrade-hawser.yml | hawser | Hawser-Stack aktualisieren'"
|
||||
type: doc
|
||||
- source: roles/hawser/tasks/update-stack.yml
|
||||
locator: "docker_compose_v2 pull: always"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
REQ-006:
|
||||
requirement: REQ-006
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Playbooks table: 'playbooks/hardening/manage-ssh-keys.yml | manage-ssh-keys | SSH-Schlüssel hartieren'"
|
||||
type: doc
|
||||
- source: roles/manage-ssh-keys/tasks/main.yml
|
||||
locator: "validate/add/remove key subtasks"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
NFR-001:
|
||||
requirement: NFR-001
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Voraussetzungen: 'Ziel-Hosts: Debian (alle Playbooks prüfen os_family == \"Debian\")'"
|
||||
type: doc
|
||||
- source: bootstrap.yml
|
||||
locator: "fail when os_family != Debian"
|
||||
type: code
|
||||
- source: playbooks/hardening/manage-ssh-keys.yml
|
||||
locator: "no os_family guard (deviation)"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
NFR-002:
|
||||
requirement: NFR-002
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Secrets & Vault + Beitragen rule 3"
|
||||
type: doc
|
||||
- source: roles/bootstrap/defaults/main.yml
|
||||
locator: "comment pointing to vault.yml (violation resolved, ALERT-20260909-001)"
|
||||
type: code
|
||||
- source: bootstrap.yml
|
||||
locator: "vars_files: vault.yml (vaulted admin_password)"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
NFR-003:
|
||||
requirement: NFR-003
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Logging section: logs/<inventory>/<hostname>/update.log"
|
||||
type: doc
|
||||
- source: roles/os-updates/defaults/main.yml
|
||||
locator: "os_update_log_file template"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
NFR-004:
|
||||
requirement: NFR-004
|
||||
evidence:
|
||||
- source: README.md
|
||||
locator: "Docker-Ausführungsumgebung section"
|
||||
type: doc
|
||||
- source: execute.sh
|
||||
locator: "docker run with repo mount /ansible"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
NFR-005:
|
||||
requirement: NFR-005
|
||||
evidence:
|
||||
- source: AGENTS.md
|
||||
locator: "Dokumentationspflicht mapping table"
|
||||
type: doc
|
||||
- source: README.md
|
||||
locator: "Beitragen rule 2"
|
||||
type: doc
|
||||
confidence: confirmed
|
||||
NFR-006:
|
||||
requirement: NFR-006
|
||||
evidence:
|
||||
- source: AGENTS.md
|
||||
locator: "OS-Unterstützung: LXC sysctl/reboot skip"
|
||||
type: doc
|
||||
- source: roles/os-updates/tasks/reboot.yml
|
||||
locator: "when: ansible_facts['virtualization_type'] != 'lxc'"
|
||||
type: code
|
||||
confidence: confirmed
|
||||
@@ -0,0 +1,26 @@
|
||||
# Requirement Traceability Map
|
||||
|
||||
Requirement records → implementing source paths → evidence. Created during
|
||||
the 2026-09-09 scan; detailed evidence in
|
||||
[requirement-evidence.yml](./requirement-evidence.yml).
|
||||
|
||||
| Requirement | Statement (short) | Implements / Verified By | Evidence |
|
||||
| --- | --- | --- | --- |
|
||||
| [REQ-001](../requirements/functional/host-lifecycle-operations.md#req-001) | Initial provisioning via bootstrap | `bootstrap.yml`, `roles/bootstrap/` | README playbook table |
|
||||
| [REQ-002](../requirements/functional/host-lifecycle-operations.md#req-002) | Docker Engine install | `playbooks/docker.yml`, `roles/docker/` | README playbook table |
|
||||
| [REQ-003](../requirements/functional/host-lifecycle-operations.md#req-003) | Zabbix Agent 2 install + register | `playbooks/monitoring.yml`, `roles/monitoring/` | README playbook table |
|
||||
| [REQ-004](../requirements/functional/host-lifecycle-operations.md#req-004) | Package updates + healthcheck | `playbooks/os-updates-deb.yml`, `roles/os-updates/`, `roles/healthcheck/` | README playbook table |
|
||||
| [REQ-005](../requirements/functional/host-lifecycle-operations.md#req-005) | Hawser stack update | `playbooks/upgrade-hawser.yml`, `roles/hawser/` | README playbook table |
|
||||
| [REQ-006](../requirements/functional/host-lifecycle-operations.md#req-006) | SSH key hardening | `playbooks/hardening/manage-ssh-keys.yml`, `roles/manage-ssh-keys/` | README playbook table |
|
||||
| [NFR-001](../requirements/non-functional/operational-policies.md#nfr-001) | Debian-only guard | `bootstrap.yml`, `playbooks/*.yml` (exception: manage-ssh-keys.yml) | README prerequisites |
|
||||
| [NFR-002](../requirements/non-functional/operational-policies.md#nfr-002) | Secrets only in vault | `vault.yml`, `bootstrap.yml` + `playbooks/monitoring.yml` (`vars_files`) | README secrets section |
|
||||
| [NFR-003](../requirements/non-functional/operational-policies.md#nfr-003) | Per-host update audit log | `roles/os-updates/tasks/logging_*.yml`, `roles/healthcheck/tasks/main.yml` | README logging section |
|
||||
| [NFR-004](../requirements/non-functional/operational-policies.md#nfr-004) | Docker-based execution | `execute.sh`, `docker/Dockerfile`, `docker/requirements.yml` | README docker section |
|
||||
| [NFR-005](../requirements/non-functional/operational-policies.md#nfr-005) | Documentation duty | `roles/*/README.md`, root `README.md` | README contributing, AGENTS.md |
|
||||
| [NFR-006](../requirements/non-functional/operational-policies.md#nfr-006) | LXC-aware sysctl/reboot | `roles/os-updates/tasks/reboot.yml`, `roles/bootstrap/tasks/configure-sysctl.yml` | AGENTS.md OS support |
|
||||
|
||||
Gaps and deviations:
|
||||
|
||||
- NFR-001: `playbooks/hardening/manage-ssh-keys.yml` has no Debian guard.
|
||||
- NFR-002: resolved 2026-09-09 - `admin_password` moved to vault.yml
|
||||
(was ALERT-20260909-001).
|
||||
Reference in New Issue
Block a user