updaze

.project-wiki/technical/INDEX.md

@@ -11,7 +11,7 @@ This section records implemented or observed code behavior and technical structu
 - [Architecture](./architecture.md)
 - [Codebase map](./codebase-map.md)
 - [Testing](./testing.md)
-- [Deployment](./deployment.md)
+- [Deployment](./deployment.md) - image build, launcher, read-only local SSH keys
 - [Security](./security.md)
 
 ## Modules

.project-wiki/technical/deployment.md

@@ -4,7 +4,7 @@ type: technical
 status: active
 title: Deployment (Runtime Environment)
 created: '2026-09-09'
-updated: '2026-09-09'
+updated: '2026-10-11'
 tags:
 - technical
 - deployment
@@ -17,6 +17,7 @@ source_paths:
 - docker/requirements.yml
 - docker/ansible-functs.sh
 - ansible.cfg
+- README.md
 confidence: confirmed
 ---
 
@@ -38,14 +39,24 @@ confidence: confirmed
 
 ## Launch Flow (execute.sh)
 
-1. Pick next free container name `ansible-<n>`.
-2. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
+1. Resolve `SSH_KEY_DIR` (default `$HOME/.ssh`) and reject a missing or
+   unreadable directory before invoking Docker. Relative paths are resolved
+   against the current working directory.
+2. Pick next free container name `ansible-<n>`.
+3. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
    a clear message if the network exists without IPv6).
-3. Run the container detached: repo mounted at `/ansible` (workdir), SSH
-   keys from the `ansible_ssh_keys` volume into `/root/.ssh`, env
+4. Run the container detached: repo mounted at `/ansible` (workdir), local
+   SSH directory bind-mounted read-only at `/root/.ssh`, env
    `ANSIBLE_HOST_KEY_CHECKING=False`, `ANSIBLE_CONFIG=./ansible.cfg`.
-4. Write a per-container SSH client config, print name/IPv4/IPv6/OS, then
-   `docker attach` for interactive use.
+   Abort if `docker run` fails.
+5. Print name/IPv4/IPv6/OS, then `docker attach` for interactive use.
+
+The launcher preserves the local SSH configuration and permissions. Standard
+key names are discovered by OpenSSH; other filenames require `IdentityFile`
+or Ansible's `--private-key /root/.ssh/<filename>`. Host-specific absolute
+paths in SSH configuration must also exist inside the container. Encrypted
+keys can be loaded into an agent started inside the container with
+`eval "$(ssh-agent -s)"` followed by `ssh-add /root/.ssh/<filename>`.
 
 ## Controller-Side Artifacts
 
@@ -57,3 +68,5 @@ confidence: confirmed
 - Changing collections requires updating `docker/requirements.yml` and an
   image rebuild (AGENTS.md).
 - Default image tag: `ansible:deb13`.
+- Build from the repository root with `docker build -t ansible:deb13 docker/`.
+- SSH keys are supplied at runtime, not embedded in the image.

.project-wiki/technical/security.md

@@ -4,7 +4,7 @@ type: technical
 status: active
 title: Security
 created: '2026-09-09'
-updated: '2026-09-09'
+updated: '2026-10-11'
 tags:
 - technical
 - security
@@ -19,6 +19,7 @@ source_paths:
 - roles/monitoring/tasks/configure-psk.yml
 - roles/bootstrap/defaults/main.yml
 - ansible.cfg
+- execute.sh
 confidence: confirmed
 ---
 
@@ -39,6 +40,9 @@ confidence: confirmed
 
 ## SSH Posture
 
+- Runtime key access: `execute.sh` bind-mounts the caller's `$HOME/.ssh`
+  (or `SSH_KEY_DIR`) read-only at `/root/.ssh`. It does not rewrite the host
+  SSH configuration or permissions. Private keys are not baked into the image.
 - Controller/transport: `host_key_checking = False`,
   `StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null` (ansible.cfg,
   execute.sh, Dockerfile). Deliberate for first-time provisioning; README