0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-09 20:26:33 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 4bd23d5f1b chore(roles): mark non-invokable roles with nocheck:required-by-coverage (Bundle D)

Adds `# nocheck: required-by-coverage — TODO: declare proper required_by`
markers to meta/services.yml of 74 non-invokable system roles (dev-*, pkgmgr*,
sys-aur*, sys-front-inj-*, sys-front-tls-*, sys-svc-{cdn,certbot,certs,
cln-domains,dns,journalctl,mail*,proxy,rdbms,ssh,sshd}, sys-timer*, sys-stk-*,
user-*, …).

This is the passthrough layer that lets the upcoming `required_by` lint
(Bundle C) hard-fail any *new* non-invokable role without an explicit coverage
declaration, while existing roles get a documented TODO grace period instead
of an immediate CI break.

No runtime effect — comments only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-23 04:23:45 +02:00

files

refactor: centralize docker wrappers, CA injection paths, and update tests

2026-01-31 17:06:09 +01:00

README.md

sys-ca-selfsigned

Description

Creates (once) a local Root CA (self-signed) for the Infinito.Nexus environment.

This role provisions:

Root CA private key: {{ CA_ROOT.key_host }}
Root CA certificate: {{ CA_ROOT.cert_host }}

The generated Root CA certificate can be injected into containers (e.g. via sys-svc-compose-ca) so that containers trust your internal TLS endpoints.

Overview

This role provisions a local Root CA (self-signed, CA:TRUE) for trusting internal TLS endpoints. Produces /etc/infinito.nexus/ca/root-ca.crt for sys-svc-compose-ca injection.

Features

Automated provisioning: Configured by Ansible without manual steps.

Outputs

CA_ROOT.cert_host (default: /etc/infinito.nexus/ca/root-ca.crt)
CA_ROOT.key_host (default: /etc/infinito.nexus/ca/root-ca.key)

Inputs

CA_ROOT (mapping)
- base_dir (string): base directory for CA files
- cert_host (string): host path to Root CA certificate
- key_host (string): host path to Root CA private key
- openssl_conf_host (string): host path for generated openssl.cnf
- days (int): certificate validity
- key_bits (int): RSA key size
- subject (mapping): DN fields (C/O/OU/CN)
- force_regen (bool): if true, remove and regenerate key/cert

Notes

The Root CA private key is generated unencrypted (automation-friendly). Protect file permissions.
This role does not sign leaf certificates. It only provisions the Root CA.

Credits

Developed and maintained by Kevin Veen-Birkenbach. Learn more at veen.world. Part of the Infinito.Nexus Project. Licensed under the Infinito.Nexus Community License (Non-Commercial).