ilia
3415340e26
All checks were successful
CI / skip-ci-check (pull_request) Successful in 1m18s
CI / lint-and-test (pull_request) Successful in 1m21s
CI / ansible-validation (pull_request) Successful in 2m43s
CI / secret-scanning (pull_request) Successful in 1m19s
CI / dependency-scan (pull_request) Successful in 1m23s
CI / sast-scan (pull_request) Successful in 2m28s
CI / license-check (pull_request) Successful in 1m20s
CI / vault-check (pull_request) Successful in 2m21s
CI / playbook-test (pull_request) Successful in 2m19s
CI / container-scan (pull_request) Successful in 1m48s
CI / sonar-analysis (pull_request) Successful in 1m26s
CI / workflow-summary (pull_request) Successful in 1m17s
34 lines
1.3 KiB
Plaintext
34 lines
1.3 KiB
Plaintext
## Project rules (Ansible infrastructure repo)
|
|
|
|
### Canonical documentation
|
|
|
|
- Start here: `project-docs/index.md`
|
|
- Architecture: `project-docs/architecture.md`
|
|
- Standards: `project-docs/standards.md`
|
|
- Workflow: `project-docs/workflow.md`
|
|
- Decisions: `project-docs/decisions.md`
|
|
|
|
### Repo structure (high level)
|
|
|
|
- **Inventory**: `inventories/production/`
|
|
- **Playbooks**: `playbooks/`
|
|
- `playbooks/servers.yml`: server baseline
|
|
- `playbooks/workstations.yml`: workstation baseline + desktop apps on `desktop` group only
|
|
- `playbooks/app/*`: Proxmox app-project suite
|
|
- **Roles**: `roles/*` (standard Ansible role layout)
|
|
|
|
### Key standards to follow
|
|
|
|
- **YAML**: 2-space indentation; tasks must have `name:`
|
|
- **Modules**: prefer native modules; use FQCN (e.g., `ansible.builtin.*`, `community.general.*`)
|
|
- **Idempotency**: no “always-changed” shell tasks; use `changed_when:` / `creates:` / `removes:`
|
|
- **Secrets**: never commit plaintext; use Ansible Vault with `vault_`-prefixed vars
|
|
- **Makefile-first**: prefer `make ...` targets over raw `ansible-playbook`
|
|
|
|
### Architectural decisions (must not regress)
|
|
|
|
- Editor/IDE installation is **out of scope** for Ansible roles/playbooks.
|
|
- Monitoring is split: `monitoring_server` vs `monitoring_desktop`.
|
|
- Desktop applications run only for `desktop` group (via workstations playbook).
|
|
|