- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions
Explicitly documented constraints for this repository (source: AGENTS.md).
Technical Constraints
Debian-only: every playbook must check
ansible_facts['os_family'] == "Debian" and abort on non-Debian hosts.
LXC containers: tasks affecting sysctl or reboot must check
virtualization_type != "lxc" and be skipped there.
Ansible style: modules use FQCN (ansible.builtin.apt, ...);
variable defaults live in roles/<name>/defaults/main.yml, never hardcoded
in tasks; role logic is split into tasks/<name>.yml subtask files with
tasks/main.yml containing only imports.
Templates use # {{ ansible_managed }} as header.
Execution environment: changes to collections require updating
docker/requirements.yml and rebuilding the Docker image.
Process Constraints
Documentation duty: every new feature, parameter, or variable must be
documented in the corresponding README before commit (see AGENTS.md
mapping table).
Code language: documentation in German, code (variable names, task
names) in English.
Secrets: sensitive values belong in encrypted vault.yml; .vault_pass,
setenv.sh, logs/, and .zabbix-psk/ are git-ignored and must never be
committed. No plaintext secrets in defaults/ or group_vars/.
Testing: changes are tested in the Docker container (./execute.sh),
with ansible-lint and --check dry runs where sensible.
DerLinkman
30f3e9a4c6