ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
7 lines
452 B
YAML
7 lines
452 B
YAML
---
|
|
# Local path (on the machine running ansible-playbook, NOT on either VM) holding the cert
|
|
# bundle generated by infra/scripts/docker-tls/generate-docker-tls.sh. The CA private key
|
|
# (ca-key.pem) is deliberately never copied to either host by this role — only its public
|
|
# ca.pem, plus the one cert/key pair each host actually needs.
|
|
docker_tls_local_bundle_dir: "{{ lookup('env', 'ROOTNODE_TLS_BUNDLE_DIR') | default('/does/not/exist', true) }}"
|