DerLinkman
30f3e9a4c6
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
60 lines
1.9 KiB
Markdown
60 lines
1.9 KiB
Markdown
---
|
|
id: TECH-DEPLOYMENT
|
|
type: technical
|
|
status: active
|
|
title: Deployment (Runtime Environment)
|
|
created: '2026-09-09'
|
|
updated: '2026-09-09'
|
|
tags:
|
|
- technical
|
|
- deployment
|
|
- docker
|
|
related:
|
|
- TECH-ARCHITECTURE
|
|
source_paths:
|
|
- execute.sh
|
|
- docker/Dockerfile
|
|
- docker/requirements.yml
|
|
- docker/ansible-functs.sh
|
|
- ansible.cfg
|
|
confidence: confirmed
|
|
---
|
|
|
|
# Deployment (Runtime Environment)
|
|
|
|
## Docker Image
|
|
|
|
- `docker/Dockerfile`: `debian:trixie-slim`, `TZ=Europe/Berlin`,
|
|
`ANSIBLE_VERSION=2.20.6` → `pip3 install ansible-core~=2.20.6`.
|
|
- Utilities: nano, git, wget, unzip, curl, python3-pip, tzdata, openssh-client,
|
|
ping, vim, less.
|
|
- Bakes SSH client policy: `StrictHostKeyChecking no`,
|
|
`UserKnownHostsFile /dev/null` (`/etc/ssh/ssh_config.d/99-no-hostkey-check.conf`).
|
|
- Installs pinned collections from `docker/requirements.yml`:
|
|
`ansible.posix` 2.2.0, `community.general` 13.0.1, `community.docker`
|
|
5.2.0, `community.zabbix` 4.2.0.
|
|
- Copies `ansible-functs.sh` into `/root/.bashrc.d/` providing aliases
|
|
`ap` (ansible-playbook), `ag` (ansible-galaxy), `av` (ansible-vault).
|
|
|
|
## Launch Flow (execute.sh)
|
|
|
|
1. Pick next free container name `ansible-<n>`.
|
|
2. Ensure IPv6-enabled bridge network `ansible-dualstack` (fails fast with
|
|
a clear message if the network exists without IPv6).
|
|
3. Run the container detached: repo mounted at `/ansible` (workdir), SSH
|
|
keys from the `ansible_ssh_keys` volume into `/root/.ssh`, env
|
|
`ANSIBLE_HOST_KEY_CHECKING=False`, `ANSIBLE_CONFIG=./ansible.cfg`.
|
|
4. Write a per-container SSH client config, print name/IPv4/IPv6/OS, then
|
|
`docker attach` for interactive use.
|
|
|
|
## Controller-Side Artifacts
|
|
|
|
- `.zabbix-psk/` and `logs/` are written by delegation from the container
|
|
into the mounted repo (git-ignored).
|
|
|
|
## Operational Notes
|
|
|
|
- Changing collections requires updating `docker/requirements.yml` and an
|
|
image rebuild (AGENTS.md).
|
|
- Default image tag: `ansible:deb13`.
|