refactor-servers-workstations-shell-monitoring #4

Merged

ilia merged 14 commits from refactor-servers-workstations-shell-monitoring into master 2026-01-01 22:11:25 -05:00

Conversation 0 Commits 14 Files Changed 75 +1933 -3179

ilia commented 2025-12-31 23:21:33 -05:00

Owner

Copy Link

Summary

This PR refactors the playbook layout to reduce duplication and make host intent clearer (servers vs workstations), splits monitoring by host type, and restores full Zsh setup for developers while keeping servers aliases-only.

Key changes

• New playbooks

  • playbooks/servers.yml: baseline for server-class hosts (no desktop apps)
  • playbooks/workstations.yml: baseline for dev/desktop/local + desktop apps only on desktop group

• Monitoring split

  • roles/monitoring_server: server monitoring + intrusion prevention (includes fail2ban, sysstat)
  • roles/monitoring_desktop: desktop-oriented monitoring tooling
  • Updated playbooks to use the correct monitoring role per host type

• Shell role: server-safe + developer-friendly

  • roles/shell now supports two modes:
    • shell_mode: minimal (default): aliases-only, does not overwrite .zshrc
    • shell_mode: full: installs Oh My Zsh + Powerlevel10k + plugins and deploys a managed .zshrc
  • playbooks/development.yml and playbooks/workstations.yml use shell_mode: full
  • playbooks/servers.yml remains aliases-only

• Applications

  • Applications role runs only on desktop group (via workstations.yml)
  • Removed Brave installs/repo management
  • Added CopyQ to desktop apps (applications_desktop_packages)

• Docs + architecture

  • Added canonical doc tree under project-docs/ (overview/architecture/standards/workflow/decisions)
  • Consolidated architecture docs: docs/reference/architecture.md is now a pointer to project-docs/architecture.md
  • Fixed broken doc links by adding the missing referenced pages under docs/

Behavior changes (important)

• Desktop GUI apps install only on the desktop inventory group (not on servers, not on dev VMs unless they are in desktop).
• Dev/workstation Zsh is now provisioned in full mode (managed .zshrc + p10k).

How to test (local CI parity)

make test
npm test

Optional dry runs (interactive sudo may be required):

make check
make check-local

Rollout guidance

• Apply to a single host first:
  • Workstations: make workstations HOST=<devhost>
  • Servers: make servers HOST=<serverhost>
• Then expand to group runs.

### Summary This PR refactors the playbook layout to reduce duplication and make host intent clearer (servers vs workstations), splits monitoring by host type, and restores full Zsh setup for developers while keeping servers aliases-only. ### Key changes - **New playbooks** - `playbooks/servers.yml`: baseline for server-class hosts (no desktop apps) - `playbooks/workstations.yml`: baseline for dev/desktop/local + **desktop apps only on `desktop` group** - **Monitoring split** - `roles/monitoring_server`: server monitoring + intrusion prevention (includes `fail2ban`, sysstat) - `roles/monitoring_desktop`: desktop-oriented monitoring tooling - Updated playbooks to use the correct monitoring role per host type - **Shell role: server-safe + developer-friendly** - `roles/shell` now supports two modes: - `shell_mode: minimal` (default): aliases-only, does not overwrite `.zshrc` - `shell_mode: full`: installs Oh My Zsh + Powerlevel10k + plugins and deploys a managed `.zshrc` - `playbooks/development.yml` and `playbooks/workstations.yml` use `shell_mode: full` - `playbooks/servers.yml` remains **aliases-only** - **Applications** - Applications role runs only on `desktop` group (via `workstations.yml`) - Removed Brave installs/repo management - Added **CopyQ** to desktop apps (`applications_desktop_packages`) - **Docs + architecture** - Added canonical doc tree under `project-docs/` (overview/architecture/standards/workflow/decisions) - Consolidated architecture docs: `docs/reference/architecture.md` is now a pointer to `project-docs/architecture.md` - Fixed broken doc links by adding the missing referenced pages under `docs/` ### Behavior changes (important) - Desktop GUI apps install **only** on the `desktop` inventory group (not on servers, not on dev VMs unless they are in `desktop`). - Dev/workstation Zsh is now provisioned in **full mode** (managed `.zshrc` + p10k). ### How to test (local CI parity) ```bash make test npm test ``` Optional dry runs (interactive sudo may be required): ```bash make check make check-local ``` ### Rollout guidance - Apply to a single host first: - Workstations: `make workstations HOST=<devhost>` - Servers: `make servers HOST=<serverhost>` - Then expand to group runs.

ilia added 7 commits 2025-12-31 23:21:33 -05:00

Add POTE app project support and improve IP conflict detection ... c7a300b922

- Add roles/pote: Python/venv deployment role with PostgreSQL, cron jobs
- Add playbooks/app/: Proxmox app stack provisioning and configuration
- Add roles/app_setup: Generic app deployment role (Node.js/systemd)
- Add roles/base_os: Base OS hardening role
- Enhance roles/proxmox_vm: Split LXC/KVM tasks, improve error handling
- Add IP uniqueness validation: Preflight check for duplicate IPs within projects
- Add Proxmox-side IP conflict detection: Check existing LXC net0 configs
- Update inventories/production/group_vars/all/main.yml: Add pote project config
- Add vault.example.yml: Template for POTE secrets (git key, DB, SMTP)
- Update .gitignore: Exclude deploy keys, backup files, and other secrets
- Update documentation: README, role docs, execution flow guides

Security:
- All secrets stored in encrypted vault.yml (never committed in plaintext)
- Deploy keys excluded via .gitignore
- IP conflict guardrails prevent accidental duplicate IP assignments

Update CI workflow to exclude example vault files from validation and add host variables for dev02 ... 9ea1090d02

- Modify CI workflow to filter out example vault files during encryption validation
- Add new host variables for dev02, including sudo configuration and shell user settings
- Disable installation of data science stack components for dev02

Remove Node.js installation step from CI workflow ... c84b0b8260

- Eliminate the installation of Node.js for the checkout action in the CI workflow to streamline the process and reduce unnecessary dependencies.

Add CI skip check for branch name and commit message ... 32479d03f8

- Introduce a new job in the CI workflow to determine if CI should be skipped based on specific patterns in the branch name or commit message.
- Update existing jobs to depend on the skip check, ensuring that CI processes are only executed when necessary.
- Enhance the overall efficiency of the CI pipeline by preventing unnecessary runs for certain commits.

Refactor CI skip check to use a single pattern ... 1b9b801713

- Simplify the CI workflow by consolidating the skip check for both branch names and commit messages to a single case-insensitive pattern: @skipci.
- Remove the previous multiple pattern checks to streamline the logic and improve readability.
- Ensure that the CI process can be effectively skipped based on the new pattern, enhancing overall efficiency.

Add comment to CI skip check job 572af82852

Refactor playbooks: servers/workstations, split monitoring, improve shell 3415340e26

ilia force-pushed refactor-servers-workstations-shell-monitoring from 3415340e26 to a176dd2365 2026-01-01 12:18:50 -05:00 Compare

ilia added 1 commit 2026-01-01 12:39:18 -05:00

CI: validate playbooks with CI inventory; install collections ffd4165d24

ilia added 1 commit 2026-01-01 12:47:43 -05:00

CI: improve Trivy dependency scan output 66d9f416c4

ilia added 1 commit 2026-01-01 12:58:05 -05:00

CI: enforce license check and ignore private root package b69284f1c4

ilia added 1 commit 2026-01-01 13:02:34 -05:00

CI: fix triggers/conditions; make Sonar non-blocking e0996642bc

ilia added 1 commit 2026-01-01 13:08:17 -05:00

CI: avoid vault requirement in lint/tests 0322279ab0

ilia added 2 commits 2026-01-01 13:11:18 -05:00

Update dependencies in package.json and package-lock.json ... 5ad985d9f8

- Upgrade markdownlint-cli2 to version 0.20.0
- Update various dependencies to their latest versions, ensuring compatibility with Node.js 20.x
- Add new dependencies such as string-width and strip-ansi for improved functionality

This change enhances the development environment by keeping dependencies up to date and ensuring compliance with the latest Node.js version requirements.

CI: fix vault file detection; remove plaintext vault c5f01d27de

ilia added 1 commit 2026-01-01 13:15:02 -05:00

inventory: drop become password for root devGPU 84ad3fb56a

ilia added 1 commit 2026-01-01 16:31:55 -05:00

CI: fix vault/markdown/license errors ... a8c83d6efd

- Remove ANSIBLE_VAULT_PASSWORD_FILE env (invalid /dev/null)
- Fix markdown table spacing in docs/reference/*.md
- Whitelist Python-2.0 license (argparse dependency)

ilia added 1 commit 2026-01-01 21:47:14 -05:00

CI: fix Jinja2 recursion and license check ... 64f7273ddd

- Fix recursive loop in configure_app.yml by using hardcoded defaults
  instead of self-referential variables (app_backend_port, etc.)
- Whitelist BlueOak-1.0.0 license (for sax dependency)
- All make test checks pass locally

ilia added 1 commit 2026-01-01 22:00:27 -05:00

CI: fix remaining errors ... 85e475b36d

- Whitelist 0BSD license (for tslib dependency)
- Fix roles_path to use absolute path: /workspace/ilia/ansible/roles
  (relative 'roles' was searching in wrong directories)
- Add Node.js install step before checkout in sonar-analysis job
  (actions/checkout@v4 requires node runtime)

All make test and npm test checks pass locally

ilia merged commit c3e6caf9e8 into master 2026-01-01 22:11:25 -05:00

ilia deleted branch refactor-servers-workstations-shell-monitoring 2026-01-01 22:11:25 -05:00

ilia referenced this issue from a commit 2026-01-01 22:11:26 -05:00

refactor-servers-workstations-shell-monitoring (#4)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

ira ilia

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ilia/ansible#4

No description provided.