mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
evangelostsak
33dbd1ed8c
Asserted against real files in a tempdir, because the guarantees are about files: which host_vars a secret may appear in, and whether a second run of an unchanged mesh leaves them alone. Two cases carry the security argument. A private key must reach exactly one host_vars file, which is what keeps one host's inventory from impersonating another, and it must never appear there in plaintext. A third covers the inverse of the idempotence shortcut: a public key whose credential has gone missing is worse than no key, because peers accept it while its owner cannot use it, so that member is reported unkeyed and the pair is reminted together. A worker is asserted NOT to receive the data mesh. Carrying it would peer the worker directly with the NFS server and bypass the routing through the hub that this topology depends on.