ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
23 lines
1.3 KiB
Plaintext
23 lines
1.3 KiB
Plaintext
# Ansible Vault template — copy to production.vault.yml and encrypt it, NEVER commit the
|
|
# plaintext or the encrypted file to git (infra/.gitignore already excludes
|
|
# **/vault_plain.yml; the encrypted production.vault.yml itself is small/safe to commit IF
|
|
# encrypted — see docs/PRODUCTION_DEPLOYMENT.md §10 for the actual decision made). Ansible
|
|
# Vault chosen over SOPS/age here because it's already bundled with Ansible (no new tool to
|
|
# install/trust) and this project's secret surface is small enough that Vault's simplicity
|
|
# outweighs SOPS's per-key-value granularity — revisit if that changes.
|
|
#
|
|
# cp production.vault.yml.template production.vault.yml
|
|
# # fill in real values below
|
|
# ansible-vault encrypt production.vault.yml
|
|
#
|
|
# Reference a vaulted value from group_vars/production.yml or a role like:
|
|
# postgres_password: "{{ vault_postgres_password }}"
|
|
|
|
vault_postgres_password: __REPLACE__
|
|
vault_provisioner_shared_secret: __REPLACE_openssl_rand_hex_32__
|
|
vault_owner_bootstrap_password: __REPLACE__ # used once, by a human, per docs/RUNBOOK_FIRST_DEPLOYMENT.md
|
|
vault_postgres_exporter_password: __REPLACE__
|
|
vault_backup_encryption_passphrase: __REPLACE_openssl_rand_base64_32__
|
|
vault_backup_offsite_credentials: __REPLACE_e.g._Hetzner_Storage_Box_ssh_key_passphrase_or_S3_secret_key__
|
|
vault_grafana_admin_password: __REPLACE__
|