kevinveenbirkenbachandClaude Opus 4.7
79409ebf10
Tooling integration
* add .markdownlint-cli2.jsonc, .ansible-lint, .ansible-lint-ignore
configs (permissive day-1: cosmetic rules disabled, semantic ones on)
* extend scripts/install/lint.sh with generic install_pip_pkg helper +
ensure_ansible_lint / ensure_galaxy_importer / ensure_markdownlint_cli2
ensure_* functions (pip / npm with sudo / --user / --break-system-packages
fallbacks). install_ansible_tools now also pulls ansible-lint and
galaxy-importer; new `markdown` install group.
* extend scripts/lint/ansible.sh to run ansible-lint after the existing
syntax-check.
* add scripts/lint/markdown.sh and scripts/lint/galaxy.sh runners. The
galaxy runner parallelizes via xargs (-P=$(nproc)), prints OK/FAIL per
role, and treats `bare-name dependency` errors as success since our
roles/ tree is not a Galaxy collection layout. All other Galaxy schema
errors still fail.
* Makefile: new lint-markdown and lint-galaxy targets, both wired into
`make lint`.
* CI: new workflows lint-markdown.yml and lint-galaxy.yml; lint-ansible.yml
now installs ansible-core + ansible-lint; ci-orchestrator wires both
new lint workflows into lint-gate.
Galaxy schema fixes
* shorten the canonical `galaxy_info.company` block from three lines to
two ("Kevin Veen-Birkenbach\nhttps://www.veen.world", 45 chars) so it
stays under Galaxy's hard 50-char limit. Updated everywhere: 229 role
meta/main.yml plus _CANONICAL_COMPANY in
tests/lint/repository/test_role_meta_main_galaxy_schema.py.
* shorten 19 over-long role descriptions to <=255 chars.
* add stub READMEs for sys-svc-compose-ca and sys-utils-service-loader.
Markdown baseline fixes
* markdownlint-cli2 --fix run repo-wide (formatting normalization
across CHANGELOG, role READMEs, docs).
* manual MD041 fixes: prepend H1 in 15 files (CHANGELOG, LICENSE,
TODO.md helpers, role README templates, etc.).
* MD025 / MD003 / MD001 / MD032 manual fixes for heading-style and
list-spacing edge cases.
* role README content polish: "## Single Point of Truth (SPOT)" headings
renamed to "## User data resolution" (D3 self-label rule).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2.2 KiB
Security Guidelines 🛡️
Infinito.Nexus is designed with security in mind. However, while following our guidelines can greatly improve your system's security, no IT system can be 100% secure. Please report any vulnerabilities as soon as possible.
If you discover a security vulnerability in Infinito.Nexus, you MUST report it through SECURITY.md. You MUST NOT open a public issue for security reports.
For optimal personal security, we RECOMMEND the following:
-
Use a Password Manager You SHOULD use a reliable password manager such as KeePass 🔐. (Learn more about password managers on Wikipedia.) KeePass is available for both smartphones and PCs, and it can automatically generate strong, random passwords.
-
Enable Two-Factor Authentication (2FA) You MUST enable 2FA whenever possible. Many password managers (like KeePass) can generate TOTP tokens, adding an extra layer of security even if your password is compromised. Synchronize your password database across devices using the Nextcloud Client 📱💻.
-
Use Encrypted Systems You SHOULD run Infinito.Nexus only on systems with full disk encryption. For example, Linux distributions such as Manjaro (based on ArchLinux) with desktop environments like GNOME provide excellent security. (Learn more about disk encryption on Wikipedia.)
-
Beware of Phishing and Social Engineering You MUST verify email senders, avoid clicking on unknown links, and MUST NEVER share your passwords or 2FA codes with anyone. (Learn more about Phishing and Social Engineering on Wikipedia.)
Following these guidelines will significantly enhance your personal security. No system is completely immune to risk.
For a tutorial on setting up secure password management, see here.