DerLinkman
30f3e9a4c6
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
3.5 KiB
id, type, status, title, created, updated, tags, related, source_paths, confidence
| id | type | status | title | created | updated | tags | related | source_paths | confidence | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| NFR-OPERATIONAL-POLICIES | requirements | active | Operational Policies | 2026-09-09 | 2026-09-09 |
|
|
|
confirmed |
Operational Policies
Explicitly stated non-functional requirements (sources: root README.md,
AGENTS.md; evidence linked in
requirement-evidence.yml).
NFR-001 - Debian-only target platforms
Status: active Tags: [platform] Related: [REQ-001] Confidence: confirmed
Statement
All playbooks must target Debian only and verify
ansible_facts['os_family'] == "Debian", aborting on other systems.
Rationale
README "Voraussetzungen": "Ziel-Hosts: Debian (alle Playbooks prüfen
os_family == "Debian")".
Acceptance Notes
- Exception observed:
playbooks/hardening/manage-ssh-keys.ymllacks the guard (tracked in the scan report).
NFR-002 - Secrets never committed unencrypted
Status: active Tags: [security, vault] Related: [TECH-SECURITY, ALERT-20260909-001] Confidence: confirmed
Statement
Sensitive values (passwords, API keys) belong in encrypted vault.yml;
no plaintext secrets in defaults/, group_vars/, or commits.
Rationale
README "Secrets & Vault" and "Beitragen" rule 3; AGENTS.md "Secrets" section.
Acceptance Notes
- Resolved 2026-09-09:
admin_passwordmoved to encryptedvault.yml(ALERT-20260909-001); no plaintext secrets remain indefaults/orgroup_vars/.
NFR-003 - Per-host update audit log
Status: active Tags: [logging, audit] Related: [MOD-004, MOD-005] Confidence: confirmed
Statement
The os-updates and healthcheck roles write one update log per host to
logs/<inventory>/<hostname>/update.log on the controller as a local
audit trail.
Rationale
README "Logging" section.
Acceptance Notes
logs/is git-ignored.
NFR-004 - Docker-based execution environment
Status: active Tags: [runtime, docker] Related: [TECH-DEPLOYMENT] Confidence: confirmed
Statement
Playbooks must be runnable from the provided Docker environment without a
local Ansible installation (execute.sh, docker/Dockerfile).
Rationale
README "Docker-Ausführungsumgebung": "Damit Playbooks nicht lokal installiert werden müssen, liefert das Repository ein fertiges Docker-Image."
Acceptance Notes
- Collections pinned in
docker/requirements.yml; image rebuild on collection changes.
NFR-005 - Documentation duty for every change
Status: active Tags: [documentation, process] Related: [CONSTRAINTS] Confidence: confirmed
Statement
Every new feature, parameter, and variable must be documented in the corresponding role README before commit; playbook changes update the root README.
Rationale
README "Beitragen" rule 2; AGENTS.md "WICHTIG: Dokumentationspflicht bei Änderungen".
Acceptance Notes
- None.
NFR-006 - LXC-aware execution
Status: active Tags: [platform, lxc] Related: [MOD-004] Confidence: confirmed
Statement
Tasks affecting sysctl or reboot must be skipped on LXC containers
(virtualization_type != "lxc").
Rationale
AGENTS.md "OS-Unterstützung": "LXC-Container: Tasks, die sysctl oder
reboot betreffen, müssen ... übersprungen werden."
Acceptance Notes
- Implemented in
roles/os-updates/tasks/reboot.yml.