DerLinkman
30f3e9a4c6
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
168 lines
3.5 KiB
Markdown
168 lines
3.5 KiB
Markdown
---
|
|
id: NFR-OPERATIONAL-POLICIES
|
|
type: requirements
|
|
status: active
|
|
title: Operational Policies
|
|
created: '2026-09-09'
|
|
updated: '2026-09-09'
|
|
tags:
|
|
- requirements
|
|
- non-functional
|
|
related:
|
|
- PROJECT
|
|
- CONSTRAINTS
|
|
source_paths:
|
|
- README.md
|
|
- AGENTS.md
|
|
confidence: confirmed
|
|
---
|
|
|
|
# Operational Policies
|
|
|
|
Explicitly stated non-functional requirements (sources: root `README.md`,
|
|
`AGENTS.md`; evidence linked in
|
|
[requirement-evidence.yml](../../traceability/requirement-evidence.yml)).
|
|
|
|
<a id="nfr-001"></a>
|
|
|
|
## NFR-001 - Debian-only target platforms
|
|
|
|
Status: active
|
|
Tags: [platform]
|
|
Related: [REQ-001]
|
|
Confidence: confirmed
|
|
|
|
### Statement
|
|
|
|
All playbooks must target Debian only and verify
|
|
`ansible_facts['os_family'] == "Debian"`, aborting on other systems.
|
|
|
|
### Rationale
|
|
|
|
README "Voraussetzungen": "Ziel-Hosts: Debian (alle Playbooks prüfen
|
|
`os_family == "Debian"`)".
|
|
|
|
### Acceptance Notes
|
|
|
|
- Exception observed: `playbooks/hardening/manage-ssh-keys.yml` lacks the
|
|
guard (tracked in the scan report).
|
|
|
|
<a id="nfr-002"></a>
|
|
|
|
## NFR-002 - Secrets never committed unencrypted
|
|
|
|
Status: active
|
|
Tags: [security, vault]
|
|
Related: [TECH-SECURITY, ALERT-20260909-001]
|
|
Confidence: confirmed
|
|
|
|
### Statement
|
|
|
|
Sensitive values (passwords, API keys) belong in encrypted `vault.yml`;
|
|
no plaintext secrets in `defaults/`, `group_vars/`, or commits.
|
|
|
|
### Rationale
|
|
|
|
README "Secrets & Vault" and "Beitragen" rule 3; AGENTS.md "Secrets"
|
|
section.
|
|
|
|
### Acceptance Notes
|
|
|
|
- Resolved 2026-09-09: `admin_password` moved to encrypted `vault.yml`
|
|
(ALERT-20260909-001); no plaintext secrets remain in `defaults/` or
|
|
`group_vars/`.
|
|
|
|
<a id="nfr-003"></a>
|
|
|
|
## NFR-003 - Per-host update audit log
|
|
|
|
Status: active
|
|
Tags: [logging, audit]
|
|
Related: [MOD-004, MOD-005]
|
|
Confidence: confirmed
|
|
|
|
### Statement
|
|
|
|
The `os-updates` and `healthcheck` roles write one update log per host to
|
|
`logs/<inventory>/<hostname>/update.log` on the controller as a local
|
|
audit trail.
|
|
|
|
### Rationale
|
|
|
|
README "Logging" section.
|
|
|
|
### Acceptance Notes
|
|
|
|
- `logs/` is git-ignored.
|
|
|
|
<a id="nfr-004"></a>
|
|
|
|
## NFR-004 - Docker-based execution environment
|
|
|
|
Status: active
|
|
Tags: [runtime, docker]
|
|
Related: [TECH-DEPLOYMENT]
|
|
Confidence: confirmed
|
|
|
|
### Statement
|
|
|
|
Playbooks must be runnable from the provided Docker environment without a
|
|
local Ansible installation (`execute.sh`, `docker/Dockerfile`).
|
|
|
|
### Rationale
|
|
|
|
README "Docker-Ausführungsumgebung": "Damit Playbooks nicht lokal
|
|
installiert werden müssen, liefert das Repository ein fertiges Docker-Image."
|
|
|
|
### Acceptance Notes
|
|
|
|
- Collections pinned in `docker/requirements.yml`; image rebuild on
|
|
collection changes.
|
|
|
|
<a id="nfr-005"></a>
|
|
|
|
## NFR-005 - Documentation duty for every change
|
|
|
|
Status: active
|
|
Tags: [documentation, process]
|
|
Related: [CONSTRAINTS]
|
|
Confidence: confirmed
|
|
|
|
### Statement
|
|
|
|
Every new feature, parameter, and variable must be documented in the
|
|
corresponding role README before commit; playbook changes update the root
|
|
README.
|
|
|
|
### Rationale
|
|
|
|
README "Beitragen" rule 2; AGENTS.md "WICHTIG: Dokumentationspflicht bei
|
|
Änderungen".
|
|
|
|
### Acceptance Notes
|
|
|
|
- None.
|
|
|
|
<a id="nfr-006"></a>
|
|
|
|
## NFR-006 - LXC-aware execution
|
|
|
|
Status: active
|
|
Tags: [platform, lxc]
|
|
Related: [MOD-004]
|
|
Confidence: confirmed
|
|
|
|
### Statement
|
|
|
|
Tasks affecting `sysctl` or `reboot` must be skipped on LXC containers
|
|
(`virtualization_type != "lxc"`).
|
|
|
|
### Rationale
|
|
|
|
AGENTS.md "OS-Unterstützung": "LXC-Container: Tasks, die `sysctl` oder
|
|
`reboot` betreffen, müssen ... übersprungen werden."
|
|
|
|
### Acceptance Notes
|
|
|
|
- Implemented in `roles/os-updates/tasks/reboot.yml`.
|