A lint gate on every push, a manual deploy form, and a connectivity
workflow for when a deploy hangs instead of failing. Nothing deploys on a
push: merging changes what would be deployed, a person still decides when.
The stack name and pull policy reach a shell command, so they are validated
through env: rather than interpolated into a run: block.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
ansible-lint at the production profile from the first commit, which is much
cheaper than adopting it later. yamllint forbids implicit octal so a file
mode cannot silently become an integer, and the Makefile is a thin wrapper
so `make check` and CI run byte-identical commands.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
check.sh is the full static gate and the single source of the tool version
pins, which CI reads with --print-specs so a workflow cannot drift from what
runs locally. load-ssh-key.sh is the only thing that knows where the deploy
key comes from — file, CI secret, or Vault — and prints a path, never key
material.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The files copied to /srv/stacks/<stack>/ verbatim: compose files, vhosts,
Prometheus configuration, the webapp image source. Payloads are data, never
templated and never linted as Ansible content.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
One role that syncs a payload and brings the stack up, configured entirely
through stack_* variables, plus six playbooks that each demonstrate one part
of that contract. Every playbook runs standalone and is tagged with its
stack name, so site.yml --tags <stack> works.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
MIT license, the ignore list that keeps secrets and Ansible scratch files
out, and a .gitattributes that normalises everything to LF — payloads are
deployed to Linux hosts, where a CRLF breaks a shell script outright.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
