check.sh is the full static gate and the single source of the tool version
pins, which CI reads with --print-specs so a workflow cannot drift from what
runs locally. load-ssh-key.sh is the only thing that knows where the deploy
key comes from — file, CI secret, or Vault — and prints a path, never key
material.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The files copied to /srv/stacks/<stack>/ verbatim: compose files, vhosts,
Prometheus configuration, the webapp image source. Payloads are data, never
templated and never linted as Ansible content.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
One role that syncs a payload and brings the stack up, configured entirely
through stack_* variables, plus six playbooks that each demonstrate one part
of that contract. Every playbook runs standalone and is tagged with its
stack name, so site.yml --tags <stack> works.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
MIT license, the ignore list that keeps secrets and Ansible scratch files
out, and a .gitattributes that normalises everything to LF — payloads are
deployed to Linux hosts, where a CRLF breaks a shell script outright.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
