ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
30 lines
916 B
Plaintext
30 lines
916 B
Plaintext
# Never commit filled secrets — only *.env.template files are tracked.
|
|
*.env
|
|
!*.env.template
|
|
|
|
# Docker TLS material — CA/server/client certs and keys, generated by
|
|
# infra/scripts/docker-tls/generate-ca.sh and friends. Templates/READMEs stay tracked.
|
|
infra/docker/tls/*.pem
|
|
infra/docker/tls/*.key
|
|
infra/docker/tls/*.crt
|
|
infra/docker/tls/*.srl
|
|
!infra/docker/tls/**/README.md
|
|
|
|
# Ansible Vault password files and any decrypted vars
|
|
infra/ansible/.vault_pass
|
|
infra/ansible/**/vault_plain.yml
|
|
|
|
# Terraform/OpenTofu state and generated vars (may contain resource IDs/IPs)
|
|
infra/terraform/**/*.tfstate
|
|
infra/terraform/**/*.tfstate.*
|
|
infra/terraform/**/.terraform/
|
|
infra/terraform/**/terraform.tfvars
|
|
!infra/terraform/**/terraform.tfvars.example
|
|
|
|
# Backup output and restore scratch space
|
|
infra/backup/output/
|
|
infra/backup/restore-test/
|
|
|
|
# Load test results (local artifacts, not source)
|
|
infra/scripts/loadtest/results/
|