jakman85andClaude Opus 4.8
4e2ca88bd4
Where the sudo password goes, codified: - inventory: new [hypervisor] group (localhost, connection=local). - host-prereqs.yml targets 'hypervisor'; become password from vaulted group_vars/hypervisor/vault.yml (ansible_become_password) — user creates it encrypted (safe to commit); README documents the exact commands. - ansible.cfg vault_password_file = ~/.config/home-k3s/ansible-vault-pass (passphrase kept OUTSIDE the repo, never committed). - ci/yamllint.yaml ignores **/vault.yml (vault blob isn't parseable YAML). Nodes keep NOPASSWD sudo (group_vars/all) — vault scoped to the host only. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
# ci/yamllint.yaml — lint config for the yaml/lint gate stage.
|
|
# Kept under ci/ (not repo root) because WS-GITOPS(CI) owns only .gitea/ and ci/.
|
|
# Pass with: yamllint -c ci/yamllint.yaml <paths>
|
|
extends: default
|
|
|
|
yaml-files:
|
|
- "*.yaml"
|
|
- "*.yml"
|
|
|
|
# ansible-vault-encrypted files are a `$ANSIBLE_VAULT;...` blob, not parseable YAML — skip them.
|
|
ignore: |
|
|
**/vault.yml
|
|
|
|
rules:
|
|
# Kubernetes / Kustomize / Helm manifests routinely exceed 80 cols; allow room
|
|
# but keep a sane ceiling so lines stay reviewable.
|
|
line-length:
|
|
max: 160
|
|
level: warning
|
|
# '---' at the top of multi-doc manifests is idiomatic; don't force it, don't ban it.
|
|
document-start: disable
|
|
# Helm/Kustomize templates and CRDs use 'on:', 'yes'/'no' keys legitimately.
|
|
truthy:
|
|
allowed-values: ["true", "false"]
|
|
check-keys: false
|
|
# Gitea/GitHub Actions expressions `${{ ... }}` and inline flow maps
|
|
# (`with: { fetch-depth: 0 }`) legitimately carry a space inside braces.
|
|
braces:
|
|
max-spaces-inside: 1
|
|
min-spaces-inside: 0
|
|
comments:
|
|
min-spaces-from-content: 1
|
|
# Long inline comments in manifests are common.
|
|
comments-indentation: disable
|
|
indentation:
|
|
spaces: 2
|
|
indent-sequences: consistent
|