mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 04:36:40 +00:00
kevinveenbirkenbachandClaude Opus 5
b71cf359b4
The private blocks were written out wherever something needed to say "this is us": NETWORK_TRUSTED_PROXY_CIDRS listed all three, Tor's SocksPolicy repeated them, unbound's access-control repeated them again. Four copies of a fact, and nothing tying them together, so narrowing one narrows nothing else. Worse, the block role networks are carved from was never declared at all. The allocator behind 'infinito contributing network address suggest' derives its umbrella from the subnets already in use, so the tree defined the rule instead of the rule defining the tree. Anything consuming "our own address space" had to guess it, and a guess that is one role out of date silently excludes that role. Measured: 106 of 107 role subnets sit in 192.168.0.0/16 and one does not, so a firewall range derived from the pool by eye would have cut BigBlueButton off. The blocks are now named once and everything else is derived, NETWORK_TRUSTED_PROXY_CIDRS included, which renders byte-identically to before for its four consumers. BigBlueButton stays outside because its upstream pins both the block and its gateway, which meta/services.yml repeats as upstream_host 10.7.7.1. The exception list therefore carries the role id rather than the CIDR: the block is already declared in that role's meta/networks.yml, and repeating it here would be the same duplication one layer up. The role_subnets lookup resolves the ids and raises on a role that declares no subnet, because a silently dropped entry would narrow whatever firewall or trust list consumes the result. A lint keeps the declaration honest in both directions: every role subnet must sit in the declared space, and an exception whose block the pool already admits is rejected so it cannot outlive its reason. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Custom Lookup Plugins for Infinito.Nexus
This directory contains custom Ansible lookup plugins used within the Infinito.Nexus project.
When to Use a Lookup Plugin
- Load external data: Use lookups to retrieve data from files, APIs, databases, environment variables, or other external sources.
- Context-aware data access: Lookups can access the full Ansible context, including inventory, facts, and runtime variables.
- Generate dynamic lists: Lookups are often used to build inventories, secrets, or host lists dynamically.
Examples
# Load the contents of a file as a variable
my_secret: "{{ lookup('file', '/path/to/secret.txt') }}"
# Retrieve a list of hostnames from an external source
host_list: "{{ lookup('infinito_inventory_hosts', 'group_name') }}"
When not to Use a Lookup Plugin
- If you only need to manipulate or transform data already available in your playbook, prefer a filter plugin instead.