DerLinkman
30f3e9a4c6
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
48 lines
1.6 KiB
Markdown
48 lines
1.6 KiB
Markdown
---
|
|
id: CONSTRAINTS
|
|
type: note
|
|
status: active
|
|
title: Constraints
|
|
created: '2026-09-09'
|
|
updated: '2026-09-09'
|
|
tags:
|
|
- requirements
|
|
- constraints
|
|
related:
|
|
- PROJECT
|
|
source_paths:
|
|
- AGENTS.md
|
|
confidence: confirmed
|
|
---
|
|
|
|
# Constraints
|
|
|
|
Explicitly documented constraints for this repository (source: `AGENTS.md`).
|
|
|
|
## Technical Constraints
|
|
|
|
- **Debian-only**: every playbook must check
|
|
`ansible_facts['os_family'] == "Debian"` and abort on non-Debian hosts.
|
|
- **LXC containers**: tasks affecting `sysctl` or `reboot` must check
|
|
`virtualization_type != "lxc"` and be skipped there.
|
|
- **Ansible style**: modules use FQCN (`ansible.builtin.apt`, ...);
|
|
variable defaults live in `roles/<name>/defaults/main.yml`, never hardcoded
|
|
in tasks; role logic is split into `tasks/<name>.yml` subtask files with
|
|
`tasks/main.yml` containing only imports.
|
|
- **Templates** use `# {{ ansible_managed }}` as header.
|
|
- **Execution environment**: changes to collections require updating
|
|
`docker/requirements.yml` and rebuilding the Docker image.
|
|
|
|
## Process Constraints
|
|
|
|
- **Documentation duty**: every new feature, parameter, or variable must be
|
|
documented in the corresponding README before commit (see `AGENTS.md`
|
|
mapping table).
|
|
- **Code language**: documentation in German, code (variable names, task
|
|
names) in English.
|
|
- **Secrets**: sensitive values belong in encrypted `vault.yml`; `.vault_pass`,
|
|
`setenv.sh`, `logs/`, and `.zabbix-psk/` are git-ignored and must never be
|
|
committed. No plaintext secrets in `defaults/` or `group_vars/`.
|
|
- **Testing**: changes are tested in the Docker container (`./execute.sh`),
|
|
with `ansible-lint` and `--check` dry runs where sensible.
|