ilia
c3e6caf9e8
All checks were successful
CI / skip-ci-check (push) Successful in 1m18s
CI / lint-and-test (push) Successful in 1m23s
CI / ansible-validation (push) Successful in 3m2s
CI / secret-scanning (push) Successful in 1m19s
CI / dependency-scan (push) Successful in 1m24s
CI / sast-scan (push) Successful in 2m32s
CI / license-check (push) Successful in 1m23s
CI / vault-check (push) Successful in 2m22s
CI / playbook-test (push) Successful in 2m25s
CI / container-scan (push) Successful in 1m51s
CI / sonar-analysis (push) Successful in 2m32s
CI / workflow-summary (push) Successful in 1m17s
### Summary
This PR refactors the playbook layout to reduce duplication and make host intent clearer (servers vs workstations), splits monitoring by host type, and restores full Zsh setup for developers while keeping servers aliases-only.
### Key changes
- **New playbooks**
- `playbooks/servers.yml`: baseline for server-class hosts (no desktop apps)
- `playbooks/workstations.yml`: baseline for dev/desktop/local + **desktop apps only on `desktop` group**
- **Monitoring split**
- `roles/monitoring_server`: server monitoring + intrusion prevention (includes `fail2ban`, sysstat)
- `roles/monitoring_desktop`: desktop-oriented monitoring tooling
- Updated playbooks to use the correct monitoring role per host type
- **Shell role: server-safe + developer-friendly**
- `roles/shell` now supports two modes:
- `shell_mode: minimal` (default): aliases-only, does not overwrite `.zshrc`
- `shell_mode: full`: installs Oh My Zsh + Powerlevel10k + plugins and deploys a managed `.zshrc`
- `playbooks/development.yml` and `playbooks/workstations.yml` use `shell_mode: full`
- `playbooks/servers.yml` remains **aliases-only**
- **Applications**
- Applications role runs only on `desktop` group (via `workstations.yml`)
- Removed Brave installs/repo management
- Added **CopyQ** to desktop apps (`applications_desktop_packages`)
- **Docs + architecture**
- Added canonical doc tree under `project-docs/` (overview/architecture/standards/workflow/decisions)
- Consolidated architecture docs: `docs/reference/architecture.md` is now a pointer to `project-docs/architecture.md`
- Fixed broken doc links by adding the missing referenced pages under `docs/`
### Behavior changes (important)
- Desktop GUI apps install **only** on the `desktop` inventory group (not on servers, not on dev VMs unless they are in `desktop`).
- Dev/workstation Zsh is now provisioned in **full mode** (managed `.zshrc` + p10k).
### How to test (local CI parity)
```bash
make test
npm test
```
Optional dry runs (interactive sudo may be required):
```bash
make check
make check-local
```
### Rollout guidance
- Apply to a single host first:
- Workstations: `make workstations HOST=<devhost>`
- Servers: `make servers HOST=<serverhost>`
- Then expand to group runs.
Reviewed-on: #4
Role: base
Description
Installs core system packages and utilities required by all other roles. This is the foundation role that should be applied to all managed hosts.
Requirements
- Ansible 2.9+
- Debian/Ubuntu systems
- Root or sudo access
Installed Packages
Base Utilities
- curl, wget - Download tools
- unzip - Archive extraction
- xclip - Clipboard utility
- tree - Directory visualization
Network & Admin Tools
- net-tools - Network configuration
- ufw - Uncomplicated Firewall
- mailutils - Email utilities
Modern CLI Tools
- jq - JSON processor
- yq - YAML processor (from apt or GitHub binary)
- ripgrep - Fast text search
- fd-find - Fast file finder
Configuration Tasks
- Sets system timezone (default: UTC)
- Configures system locale (default: en_US.UTF-8)
- Creates Ansible temporary directory with proper permissions
- Creates fd symlink for Ubuntu compatibility
Variables
| Variable | Default | Description |
|---|---|---|
timezone |
UTC |
System timezone |
locale |
en_US.UTF-8 |
System locale |
Dependencies
None - this is the foundation role.
Example Playbook
- hosts: all
roles:
- role: base
timezone: America/Toronto
locale: en_US.UTF-8
Tags
base: All base taskssecurity: Security-related tasks
Notes
- This role should be applied before all other roles
- yq is installed from apt if available, otherwise from GitHub binary
- fd-find is symlinked to fd for compatibility across distributions
- UFW firewall is installed but not enabled (handled by SSH role)