ansible-playbooks/.project-wiki/technical/deployment.md

id, type, status, title, created, updated, tags, related, source_paths, confidence

id	type	status	title	created	updated	tags	related	source_paths	confidence
TECH-DEPLOYMENT	technical	active	Deployment (Runtime Environment)	2026-09-09	2026-10-11	technical deployment docker	TECH-ARCHITECTURE	execute.sh docker/Dockerfile docker/requirements.yml docker/ansible-functs.sh ansible.cfg README.md	confirmed

Deployment (Runtime Environment)

Docker Image

• docker/Dockerfile: debian:trixie-slim, TZ=Europe/Berlin, ANSIBLE_VERSION=2.20.6 → pip3 install ansible-core~=2.20.6.
• Utilities: nano, git, wget, unzip, curl, python3-pip, tzdata, openssh-client, ping, vim, less.
• Bakes SSH client policy: StrictHostKeyChecking no, UserKnownHostsFile /dev/null (/etc/ssh/ssh_config.d/99-no-hostkey-check.conf).
• Installs pinned collections from docker/requirements.yml: ansible.posix 2.2.0, community.general 13.0.1, community.docker 5.2.0, community.zabbix 4.2.0.
• Copies ansible-functs.sh into /root/.bashrc.d/ providing aliases ap (ansible-playbook), ag (ansible-galaxy), av (ansible-vault).

Launch Flow (execute.sh)

1. Resolve SSH_KEY_DIR (default $HOME/.ssh) and reject a missing or unreadable directory before invoking Docker. Relative paths are resolved against the current working directory.
2. Pick next free container name ansible-<n>.
3. Ensure IPv6-enabled bridge network ansible-dualstack (fails fast with a clear message if the network exists without IPv6).
4. Run the container detached: repo mounted at /ansible (workdir), local SSH directory bind-mounted read-only at /root/.ssh, env ANSIBLE_HOST_KEY_CHECKING=False, ANSIBLE_CONFIG=./ansible.cfg. Abort if docker run fails.
5. Print name/IPv4/IPv6/OS, then docker attach for interactive use.

The launcher preserves the local SSH configuration and permissions. Standard key names are discovered by OpenSSH; other filenames require IdentityFile or Ansible's --private-key /root/.ssh/<filename>. Host-specific absolute paths in SSH configuration must also exist inside the container. Encrypted keys can be loaded into an agent started inside the container with eval "$(ssh-agent -s)" followed by ssh-add /root/.ssh/<filename>.

Controller-Side Artifacts

• .zabbix-psk/ and logs/ are written by delegation from the container into the mounted repo (git-ignored).

Operational Notes

• Changing collections requires updating docker/requirements.yml and an image rebuild (AGENTS.md).
• Default image tag: ansible:deb13.
• Build from the repository root with docker build -t ansible:deb13 docker/.
• SSH keys are supplied at runtime, not embedded in the image.