---
id: NFR-OPERATIONAL-POLICIES
type: requirements
status: active
title: Operational Policies
created: '2026-09-09'
updated: '2026-09-09'
tags:
- requirements
- non-functional
related:
- PROJECT
- CONSTRAINTS
source_paths:
- README.md
- AGENTS.md
confidence: confirmed
---

# Operational Policies

Explicitly stated non-functional requirements (sources: root `README.md`,
`AGENTS.md`; evidence linked in
[requirement-evidence.yml](../../traceability/requirement-evidence.yml)).

<a id="nfr-001"></a>

## NFR-001 - Debian-only target platforms

Status: active
Tags: [platform]
Related: [REQ-001]
Confidence: confirmed

### Statement

All playbooks must target Debian only and verify
`ansible_facts['os_family'] == "Debian"`, aborting on other systems.

### Rationale

README "Voraussetzungen": "Ziel-Hosts: Debian (alle Playbooks prüfen
`os_family == "Debian"`)".

### Acceptance Notes

- Exception observed: `playbooks/hardening/manage-ssh-keys.yml` lacks the
  guard (tracked in the scan report).

<a id="nfr-002"></a>

## NFR-002 - Secrets never committed unencrypted

Status: active
Tags: [security, vault]
Related: [TECH-SECURITY, ALERT-20260909-001]
Confidence: confirmed

### Statement

Sensitive values (passwords, API keys) belong in encrypted `vault.yml`;
no plaintext secrets in `defaults/`, `group_vars/`, or commits.

### Rationale

README "Secrets & Vault" and "Beitragen" rule 3; AGENTS.md "Secrets"
section.

### Acceptance Notes

- Resolved 2026-09-09: `admin_password` moved to encrypted `vault.yml`
  (ALERT-20260909-001); no plaintext secrets remain in `defaults/` or
  `group_vars/`.

<a id="nfr-003"></a>

## NFR-003 - Per-host update audit log

Status: active
Tags: [logging, audit]
Related: [MOD-004, MOD-005]
Confidence: confirmed

### Statement

The `os-updates` and `healthcheck` roles write one update log per host to
`logs/<inventory>/<hostname>/update.log` on the controller as a local
audit trail.

### Rationale

README "Logging" section.

### Acceptance Notes

- `logs/` is git-ignored.

<a id="nfr-004"></a>

## NFR-004 - Docker-based execution environment

Status: active
Tags: [runtime, docker]
Related: [TECH-DEPLOYMENT]
Confidence: confirmed

### Statement

Playbooks must be runnable from the provided Docker environment without a
local Ansible installation (`execute.sh`, `docker/Dockerfile`).

### Rationale

README "Docker-Ausführungsumgebung": "Damit Playbooks nicht lokal
installiert werden müssen, liefert das Repository ein fertiges Docker-Image."

### Acceptance Notes

- Collections pinned in `docker/requirements.yml`; image rebuild on
  collection changes.

<a id="nfr-005"></a>

## NFR-005 - Documentation duty for every change

Status: active
Tags: [documentation, process]
Related: [CONSTRAINTS]
Confidence: confirmed

### Statement

Every new feature, parameter, and variable must be documented in the
corresponding role README before commit; playbook changes update the root
README.

### Rationale

README "Beitragen" rule 2; AGENTS.md "WICHTIG: Dokumentationspflicht bei
Änderungen".

### Acceptance Notes

- None.

<a id="nfr-006"></a>

## NFR-006 - LXC-aware execution

Status: active
Tags: [platform, lxc]
Related: [MOD-004]
Confidence: confirmed

### Statement

Tasks affecting `sysctl` or `reboot` must be skipped on LXC containers
(`virtualization_type != "lxc"`).

### Rationale

AGENTS.md "OS-Unterstützung": "LXC-Container: Tasks, die `sysctl` oder
`reboot` betreffen, müssen ... übersprungen werden."

### Acceptance Notes

- Implemented in `roles/os-updates/tasks/reboot.yml`.