updaze

2026-10-17 17:16:53 +02:00
parent ceda1ae4a6
commit 7abcd14c94
11 changed files with 93 additions and 25 deletions
@@ -2,7 +2,7 @@

 This wiki stores the project knowledge base for requirements, changes, technical documentation, implementation state, and traceability. Use this file as the routing entrypoint; open only the linked files needed for the current task.

-Last updated: 2026-09-09
+Last updated: 2026-10-11

 ## Current State

@@ -1,5 +1,5 @@
 version: 1
-updated: '2026-09-09'
+updated: '2026-10-11'
 documents:
 - id: GLOSSARY
  type: note
@@ -162,7 +162,7 @@ documents:
  confidence: confirmed
 - id: TECH-DEPLOYMENT
  type: technical
-  title: Deployment
+  title: Deployment (Runtime Environment)
  path: technical/deployment.md
  status: active
  tags:
@@ -173,7 +173,11 @@ documents:
  - TECH-ARCHITECTURE
  source_paths:
  - execute.sh
-  - docker/
+  - docker/Dockerfile
+  - docker/requirements.yml
+  - docker/ansible-functs.sh
+  - ansible.cfg
+  - README.md
  confidence: confirmed
 - id: TECH-SECURITY
  type: technical
@@ -185,11 +189,16 @@ documents:
  - security
  related:
  - ALERT-20260909-001
+  - ALERT-20260909-002
  - NFR-002
+  - MOD-003
+  - MOD-007
  source_paths:
  - vault.yml
+  - roles/monitoring/tasks/configure-psk.yml
  - roles/bootstrap/defaults/main.yml
  - ansible.cfg
+  - execute.sh
  confidence: confirmed
 - id: TECH-TESTING
  type: technical
@@ -1,6 +1,6 @@
 # Project Status

-Last updated: 2026-09-09
+Last updated: 2026-10-11

 ## Scaffold State

@@ -11,6 +11,9 @@ Last updated: 2026-09-09

 ## Current State

+- Updated 2026-10-11: Docker launcher uses the caller's local SSH directory
+  read-only (`SSH_KEY_DIR`, default `$HOME/.ssh`); runtime behavior and usage
+  are documented in [deployment](./technical/deployment.md) and `README.md`.
 - Repository fully scanned (root config, docker runtime, 3 inventories,
  6 playbooks, 7 roles). Findings and module docs confirmed against source.
 - Open alerts: 0 (2 resolved on 2026-09-09) - see
@@ -11,7 +11,7 @@ This section records implemented or observed code behavior and technical structu
 - [Architecture](./architecture.md)
 - [Codebase map](./codebase-map.md)
 - [Testing](./testing.md)
- [Deployment](./deployment.md)
+- [Deployment](./deployment.md) - image build, launcher, read-only local SSH keys
 - [Security](./security.md)

 ## Modules
@@ -4,7 +4,7 @@ type: technical
 status: active
 title: Deployment (Runtime Environment)
 created: '2026-09-09'
-updated: '2026-09-09'
+updated: '2026-10-11'
 tags:
 - technical
 - deployment
@@ -17,6 +17,7 @@ source_paths:
 - docker/requirements.yml
 - docker/ansible-functs.sh
 - ansible.cfg
+- README.md
 confidence: confirmed
 ---

@@ -38,14 +39,24 @@ confidence: confirmed

 ## Launch Flow (execute.sh)

-1. Pick next free container name `ansible-<n>`.
-2. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
+1. Resolve `SSH_KEY_DIR` (default `$HOME/.ssh`) and reject a missing or
+   unreadable directory before invoking Docker. Relative paths are resolved
+   against the current working directory.
+2. Pick next free container name `ansible-<n>`.
+3. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
   a clear message if the network exists without IPv6).
-3. Run the container detached: repo mounted at `/ansible` (workdir), SSH
-   keys from the `ansible_ssh_keys` volume into `/root/.ssh`, env
+4. Run the container detached: repo mounted at `/ansible` (workdir), local
+   SSH directory bind-mounted read-only at `/root/.ssh`, env
   `ANSIBLE_HOST_KEY_CHECKING=False`, `ANSIBLE_CONFIG=./ansible.cfg`.
-4. Write a per-container SSH client config, print name/IPv4/IPv6/OS, then
-   `docker attach` for interactive use.
+   Abort if `docker run` fails.
+5. Print name/IPv4/IPv6/OS, then `docker attach` for interactive use.
+
+The launcher preserves the local SSH configuration and permissions. Standard
+key names are discovered by OpenSSH; other filenames require `IdentityFile`
+or Ansible's `--private-key /root/.ssh/<filename>`. Host-specific absolute
+paths in SSH configuration must also exist inside the container. Encrypted
+keys can be loaded into an agent started inside the container with
+`eval "$(ssh-agent -s)"` followed by `ssh-add /root/.ssh/<filename>`.

 ## Controller-Side Artifacts

@@ -57,3 +68,5 @@ confidence: confirmed
 - Changing collections requires updating `docker/requirements.yml` and an
  image rebuild (AGENTS.md).
 - Default image tag: `ansible:deb13`.
+- Build from the repository root with `docker build -t ansible:deb13 docker/`.
+- SSH keys are supplied at runtime, not embedded in the image.
@@ -4,7 +4,7 @@ type: technical
 status: active
 title: Security
 created: '2026-09-09'
-updated: '2026-09-09'
+updated: '2026-10-11'
 tags:
 - technical
 - security
@@ -19,6 +19,7 @@ source_paths:
 - roles/monitoring/tasks/configure-psk.yml
 - roles/bootstrap/defaults/main.yml
 - ansible.cfg
+- execute.sh
 confidence: confirmed
 ---

@@ -39,6 +40,9 @@ confidence: confirmed

 ## SSH Posture

+- Runtime key access: `execute.sh` bind-mounts the caller's `$HOME/.ssh`
+  (or `SSH_KEY_DIR`) read-only at `/root/.ssh`. It does not rewrite the host
+  SSH configuration or permissions. Private keys are not baked into the image.
 - Controller/transport: `host_key_checking = False`,
  `StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null` (ansible.cfg,
  execute.sh, Dockerfile). Deliberate for first-time provisioning; README
@@ -11,8 +11,8 @@ Connects wiki documents to source paths. Created during the 2026-09-09 scan.
 | [MOD-005 Healthcheck](../technical/modules/MOD-005-healthcheck-role.md) | `playbooks/os-updates-deb.yml`, `roles/healthcheck/` | Container quality gate |
 | [MOD-006 Hawser](../technical/modules/MOD-006-hawser-role.md) | `playbooks/upgrade-hawser.yml`, `roles/hawser/` | Compose stack update |
 | [MOD-007 Manage SSH Keys](../technical/modules/MOD-007-manage-ssh-keys-role.md) | `playbooks/hardening/manage-ssh-keys.yml`, `roles/manage-ssh-keys/` | No Debian guard (gap) |
-| [TECH-DEPLOYMENT](../technical/deployment.md) | `execute.sh`, `docker/`, `ansible.cfg` | Runtime environment |
-| [TECH-SECURITY](../technical/security.md) | `vault.yml`, `roles/*/defaults/`, `ansible.cfg`, `roles/monitoring/tasks/configure-psk.yml` | Secrets, SSH, PSK |
+| [TECH-DEPLOYMENT](../technical/deployment.md) | `execute.sh`, `docker/`, `ansible.cfg`, `README.md` | Runtime environment; local SSH directory mounted read-only via `SSH_KEY_DIR` |
+| [TECH-SECURITY](../technical/security.md) | `vault.yml`, `roles/*/defaults/`, `ansible.cfg`, `execute.sh`, `roles/monitoring/tasks/configure-psk.yml` | Secrets, SSH, PSK; runtime-only local key access |
 | [TECH-INTEGRATIONS-ZABBIX](../technical/integrations/zabbix.md) | `roles/monitoring/`, `inventory/group_vars/` | Zabbix + external services |
 | [NFR-003](../requirements/non-functional/operational-policies.md#nfr-003) | `roles/os-updates/tasks/logging_*.yml`, `roles/healthcheck/tasks/main.yml` | Update log audit trail |
 | [NFR-006](../requirements/non-functional/operational-policies.md#nfr-006) | `roles/os-updates/tasks/reboot.yml`, `roles/bootstrap/tasks/configure-sysctl.yml` | LXC skips |