73 lines
2.6 KiB
Markdown
73 lines
2.6 KiB
Markdown
---
|
|
id: TECH-DEPLOYMENT
|
|
type: technical
|
|
status: active
|
|
title: Deployment (Runtime Environment)
|
|
created: '2026-09-09'
|
|
updated: '2026-10-11'
|
|
tags:
|
|
- technical
|
|
- deployment
|
|
- docker
|
|
related:
|
|
- TECH-ARCHITECTURE
|
|
source_paths:
|
|
- execute.sh
|
|
- docker/Dockerfile
|
|
- docker/requirements.yml
|
|
- docker/ansible-functs.sh
|
|
- ansible.cfg
|
|
- README.md
|
|
confidence: confirmed
|
|
---
|
|
|
|
# Deployment (Runtime Environment)
|
|
|
|
## Docker Image
|
|
|
|
- `docker/Dockerfile`: `debian:trixie-slim`, `TZ=Europe/Berlin`,
|
|
`ANSIBLE_VERSION=2.20.6` → `pip3 install ansible-core~=2.20.6`.
|
|
- Utilities: nano, git, wget, unzip, curl, python3-pip, tzdata, openssh-client,
|
|
ping, vim, less.
|
|
- Bakes SSH client policy: `StrictHostKeyChecking no`,
|
|
`UserKnownHostsFile /dev/null` (`/etc/ssh/ssh_config.d/99-no-hostkey-check.conf`).
|
|
- Installs pinned collections from `docker/requirements.yml`:
|
|
`ansible.posix` 2.2.0, `community.general` 13.0.1, `community.docker`
|
|
5.2.0, `community.zabbix` 4.2.0.
|
|
- Copies `ansible-functs.sh` into `/root/.bashrc.d/` providing aliases
|
|
`ap` (ansible-playbook), `ag` (ansible-galaxy), `av` (ansible-vault).
|
|
|
|
## Launch Flow (execute.sh)
|
|
|
|
1. Resolve `SSH_KEY_DIR` (default `$HOME/.ssh`) and reject a missing or
|
|
unreadable directory before invoking Docker. Relative paths are resolved
|
|
against the current working directory.
|
|
2. Pick next free container name `ansible-<n>`.
|
|
3. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
|
|
a clear message if the network exists without IPv6).
|
|
4. Run the container detached: repo mounted at `/ansible` (workdir), local
|
|
SSH directory bind-mounted read-only at `/root/.ssh`, env
|
|
`ANSIBLE_HOST_KEY_CHECKING=False`, `ANSIBLE_CONFIG=./ansible.cfg`.
|
|
Abort if `docker run` fails.
|
|
5. Print name/IPv4/IPv6/OS, then `docker attach` for interactive use.
|
|
|
|
The launcher preserves the local SSH configuration and permissions. Standard
|
|
key names are discovered by OpenSSH; other filenames require `IdentityFile`
|
|
or Ansible's `--private-key /root/.ssh/<filename>`. Host-specific absolute
|
|
paths in SSH configuration must also exist inside the container. Encrypted
|
|
keys can be loaded into an agent started inside the container with
|
|
`eval "$(ssh-agent -s)"` followed by `ssh-add /root/.ssh/<filename>`.
|
|
|
|
## Controller-Side Artifacts
|
|
|
|
- `.zabbix-psk/` and `logs/` are written by delegation from the container
|
|
into the mounted repo (git-ignored).
|
|
|
|
## Operational Notes
|
|
|
|
- Changing collections requires updating `docker/requirements.yml` and an
|
|
image rebuild (AGENTS.md).
|
|
- Default image tag: `ansible:deb13`.
|
|
- Build from the repository root with `docker build -t ansible:deb13 docker/`.
|
|
- SSH keys are supplied at runtime, not embedded in the image.
|