jakman85andClaude Opus 4.8
4e2ca88bd4
Where the sudo password goes, codified: - inventory: new [hypervisor] group (localhost, connection=local). - host-prereqs.yml targets 'hypervisor'; become password from vaulted group_vars/hypervisor/vault.yml (ansible_become_password) — user creates it encrypted (safe to commit); README documents the exact commands. - ansible.cfg vault_password_file = ~/.config/home-k3s/ansible-vault-pass (passphrase kept OUTSIDE the repo, never committed). - ci/yamllint.yaml ignores **/vault.yml (vault blob isn't parseable YAML). Nodes keep NOPASSWD sudo (group_vars/all) — vault scoped to the host only. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
18 lines
754 B
INI
18 lines
754 B
INI
[defaults]
|
|
inventory = inventory/hosts.ini
|
|
roles_path = roles
|
|
host_key_checking = False
|
|
retry_files_enabled = False
|
|
# ansible-core 2.20 removed community.general.yaml; use the builtin default with YAML result format.
|
|
stdout_callback = default
|
|
result_format = yaml
|
|
interpreter_python = auto_silent
|
|
# Vault passphrase file — kept OUTSIDE the repo (never committed). Decrypts the vaulted
|
|
# group_vars (e.g. the host become password) so plays run unattended. Create it once:
|
|
# install -m600 /dev/stdin ~/.config/home-k3s/ansible-vault-pass <<<'YOUR_VAULT_PASSPHRASE'
|
|
vault_password_file = ~/.config/home-k3s/ansible-vault-pass
|
|
|
|
[ssh_connection]
|
|
pipelining = True
|
|
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=accept-new
|