The README says what the directory is, links repo_url as the source of truth,
and covers deploying, stackctl and OpenBao. stackctl.yml refuses to run while
repo_url is a placeholder; AGENTS.md gains "Adopting this repository".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One shared script installed into /srv/stacks on every host, with per-host
groups in server/<host>/stack-groups. Tested in check.sh. Also two new
common mistakes in the adding-a-stack skill.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mode flapping under umask 002, broad NOPASSWD sudo, runner self-updates,
per-secret vault reads and fact caching, each with its cost and fix.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
stack_secrets reads KV v2 on the target host and writes the stack's .env at
0600, failing loudly on a sealed vault, a bad token, a missing field or an
unsafe value. Adds an example OpenBao stack on app and moves webapp onto it;
metrics keeps a hand-placed .env.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bootstrap.yml prepares a host as an admin via -u; new-deploy-key.sh makes the
key pair and refuses to write inside the repo. CI deploys refuse the bootstrap
playbook, since the dispatch API ignores the dropdown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
-e start=false (mode sync in CI) lands the payload and starts nothing, for
migrations. A check run on a never-deployed stack now skips Compose with a note
instead of failing on the missing directory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
README for humans, AGENTS.md for agents and contributors, and the docs that
outlive any one platform: architecture, secrets, connectivity, triggering a
deploy from another repository. CLAUDE.md, GEMINI.md and .claude/skills/ are
pointers rather than copies, so every agent and every human reads the same
text.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
