feat(ansible): idempotent role-based host config for both production VMs

common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles,
orchestrated by site.yml with the ordering that matters (firewall/TLS land
before the services that depend on them). Ansible Vault for secrets, no new
tool introduced for this project's modest secret surface. Explicit
dev/staging/production environment separation, no secrets committed
(.gitignore covers vault plaintext, TLS keys, Terraform state, *.env).

Validated: ansible-playbook --syntax-check clean.

This commit is contained in:

ced4568

2026-08-18 17:13:01 -05:00

parent cbf81b09e7

commit 507ac4c5d3

50 changed files with 1174 additions and 0 deletions

									
										infra/ansible/roles/common/defaults/main.yml
									
		+3
		
												View File
												
				@@ -0,0 +1,3 @@

				---

				common_timezone: UTC

				common_unattended_upgrades: true