33 Commits

Author	SHA1	Message	Date
ilia	85e475b36d	CI: fix remaining errors ... - Whitelist 0BSD license (for tslib dependency) - Fix roles_path to use absolute path: /workspace/ilia/ansible/roles (relative 'roles' was searching in wrong directories) - Add Node.js install step before checkout in sonar-analysis job (actions/checkout@v4 requires node runtime) All make test and npm test checks pass locally	2026-01-01 22:01:40 -05:00
ilia	64f7273ddd	CI: fix Jinja2 recursion and license check ... - Fix recursive loop in configure_app.yml by using hardcoded defaults instead of self-referential variables (app_backend_port, etc.) - Whitelist BlueOak-1.0.0 license (for sax dependency) - All make test checks pass locally	2026-01-01 21:48:27 -05:00
ilia	a8c83d6efd	CI: fix vault/markdown/license errors ... - Remove ANSIBLE_VAULT_PASSWORD_FILE env (invalid /dev/null) - Fix markdown table spacing in docs/reference/*.md - Whitelist Python-2.0 license (argparse dependency)	2026-01-01 16:33:06 -05:00
ilia	c5f01d27de	CI: fix vault file detection; remove plaintext vault	2026-01-01 13:12:31 -05:00
ilia	0322279ab0	CI: avoid vault requirement in lint/tests	2026-01-01 13:09:29 -05:00
ilia	e0996642bc	CI: fix triggers/conditions; make Sonar non-blocking	2026-01-01 13:03:47 -05:00
ilia	b69284f1c4	CI: enforce license check and ignore private root package	2026-01-01 12:59:18 -05:00
ilia	66d9f416c4	CI: improve Trivy dependency scan output	2026-01-01 12:48:56 -05:00
ilia	ffd4165d24	CI: validate playbooks with CI inventory; install collections	2026-01-01 12:39:36 -05:00
ilia	baf3e3de09	Refactor playbooks: servers/workstations, split monitoring, improve shell	2026-01-01 11:35:24 -05:00
ilia	69a39e5e5b	Add POTE app project support and improve IP conflict detection (#3) ... ## Summary This PR adds comprehensive support for deploying the **POTE** application project via Ansible, along with improvements to IP conflict detection and a new app stack provisioning system for Proxmox-managed LXC containers. ## Key Features ### 🆕 New Roles - **`roles/pote`**: Python/venv deployment role for POTE (PostgreSQL, cron jobs, Alembic migrations) - **`roles/app_setup`**: Generic app deployment role (Node.js/systemd) - **`roles/base_os`**: Base OS hardening role ### 🛡️ Safety Improvements - IP uniqueness validation within projects - Proxmox-side IP conflict detection - Enhanced error messages for IP conflicts ### 📦 New Playbooks - `playbooks/app/site.yml`: End-to-end app stack deployment - `playbooks/app/provision_vms.yml`: Proxmox guest provisioning - `playbooks/app/configure_app.yml`: OS + application configuration ## Security - ✅ All secrets stored in encrypted vault.yml - ✅ Deploy keys excluded via .gitignore - ✅ No plaintext secrets committed ## Testing - ✅ POTE successfully deployed to dev/qa/prod environments - ✅ All components validated (Git, PostgreSQL, cron, migrations) Co-authored-by: ilia <ilia@levkin.ca> Reviewed-on: #3	2026-01-01 11:19:54 -05:00
ilia	e897b1a027	Fix: Resolve linting errors and improve firewall configuration (#2) ... - Fix UFW firewall to allow outbound traffic (was blocking all outbound) - Add HOST parameter support to shell Makefile target - Fix all ansible-lint errors (trailing spaces, missing newlines, document starts) - Add changed_when: false to check commands - Fix variable naming (vault_devGPU -> vault_devgpu) - Update .ansible-lint config to exclude .gitea/ and allow strategy: free - Fix NodeSource repository GPG key handling in shell playbook - Add missing document starts to host_vars files - Clean up empty lines in datascience role files Reviewed-on: #2	2025-12-25 16:47:26 -05:00
ilia	c017ec6941	Fix: Update CI workflow to install a fixed version of Trivy for improved reliability and error handling during installation	2025-12-15 15:50:04 -05:00
ilia	9e7ef8159b	Fix: Update CI workflow to disable SCM in SonarScanner configuration for improved analysis accuracy	2025-12-15 15:36:15 -05:00
ilia	3828e04b13	Fix: Update CI workflow to install Git alongside Node.js and enhance SonarScanner installation process with improved error handling	2025-12-15 15:11:36 -05:00
ilia	d6655babd9	Refactor: Simplify connectivity analysis logic by breaking down into smaller helper functions for improved readability and maintainability	2025-12-15 14:55:10 -05:00
ilia	dc94395bbc	Fix: Enhance SonarScanner error handling in CI workflow with detailed failure messages and troubleshooting guidance	2025-12-14 21:35:52 -05:00
ilia	699aaefac3	Fix: Update CI workflow to improve SonarScanner installation process with enhanced error handling and version management	2025-12-14 21:21:26 -05:00
ilia	83a5d988af	Fix: Update ansible-lint configuration to exclude specific paths and skip certain rules for improved linting flexibility	2025-12-14 21:04:45 -05:00
ilia	a45ee496e4	Fix: Update CI workflow to use Ubuntu 22.04 container, install Node.js and SonarScanner with improved methods, and enhance SonarQube connectivity verification	2025-12-14 20:51:36 -05:00
ilia	e54ecfefc1	Fix: Update CI workflow to enhance playbook syntax checking and improve SonarQube connectivity verification	2025-12-14 20:43:28 -05:00
ilia	f20b671e76	Fix: Update CI workflow to use Alpine-based images, install Node.js and Trivy with improved methods, and enhance dependency scanning steps	2025-12-14 20:28:06 -05:00
ilia	d0699d0b7a	Fix: Add SonarQube analysis to CI workflow and update host inventory for production environment	2025-12-14 20:10:38 -05:00
ilia	d4ce0a247d	Fix: Remove artifact upload, update Trivy flags, add workflow summary, and add git to shell role	2025-12-14 14:57:22 -05:00
ilia	0076155ef1	Fix: Improve Trivy installation with multiple fallback methods and better error handling	2025-12-14 09:06:53 -05:00
ilia	67a9b3ca2b	Fix: Check vault encryption header instead of decrypting files	2025-12-13 23:42:06 -05:00
ilia	6d14cf9253	Fix: Install git for Gitleaks and use direct Trivy binary download	2025-12-13 23:37:38 -05:00
ilia	a9ed19c9d2	Fix: Install Node.js in all Ubuntu containers for checkout action	2025-12-13 23:30:42 -05:00
ilia	1a565cc30e	Fix: Change all jobs to use ubuntu-latest label to match runner	2025-12-13 23:24:02 -05:00
ilia	8818de005f	Add comprehensive security scanning: SAST, license check, vault validation, playbook testing, and artifact uploads	2025-12-13 23:19:10 -05:00
ilia	990f886f02	Fix CI workflow: configure markdownlint, fix Node version, add Ansible validation	2025-12-13 23:13:40 -05:00
ilia	f3b34f3c95	Fix CI workflow: configure markdownlint and make link checking non-blocking	2025-12-13 23:06:26 -05:00
ilia	ba7d4eb5b3	Add CI workflow with markdown linting and self-hosted runner job	2025-12-13 23:00:58 -05:00