Files

T

DerLinkman 30f3e9a4c6 rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

2026-09-09 14:14:18 +02:00

2.0 KiB

Raw Blame History

id, type, status, title, created, updated, tags, related, source_paths, confidence

type

status

title

created

updated

Bootstrap Role

Responsibility

Full initial setup of a Debian host: packages, admin user, SSH, MOTD, keyboard layout, bashrc, sysctl; then composes Docker and monitoring.

Source Paths

roles/bootstrap/tasks/main.yml - orchestration only
Subtasks: install-basicpackages.yml, create-admin-user.yml, set-motd.yml, set-keyboardlayout.yml, install-openssh.yml, configure-ssh.yml, add-ssh-keys.yml, setup-bashrc.yml, configure-sysctl.yml
Templates: authorized_keys.j2, keyboard.j2, sshd.conf.j2, sudoers-admin.j2

Public Interfaces

Playbook: bootstrap.yml (top level, Debian guard, become, user: admin, vars_files: vault.yml)
Skip flags: skip_docker, skip_monitoring (control role composition)
Tags: motd, ssh, bashrc, sysctl

Important Flows

Basic packages → admin user (+sudo via sudoers-admin.j2, authorized keys via authorized_keys.j2) → MOTD → keyboard layout.
OpenSSH install, hardening config (sshd.conf.j2), authorized keys.
bashrc, sysctl.
import_role: docker (when not skip_docker), then import_role: monitoring (when not skip_monitoring).

Dependencies

Composed roles: docker, monitoring.
admin_authorized_keys (public keys, plaintext OK) from defaults/main.yml; admin_password (SHA-512 hash) lives encrypted in vault.yml, loaded via vars_files in bootstrap.yml (resolved ALERT-20260909-001).

Tests

None automated; manual runs via ./execute.sh.

Notes For Agents

sshd service name differs per host (ssh_service_name, set for gitea and ipam in inventory/cloudlorean.yml).
Keep tasks/main.yml as pure import list when extending.

2.0 KiB Raw Blame History