The main goal is to both merge as much playbook code into a single ansible monorepo
...And to move as much isolated functionality into a personal collection (ie dotfile roles)
One big fix that needs to be addressed in this new repo, effective use of tags
Currently tags barely funciton because of the dotfiles role that gets used on every inventory host
Dotfiles management is therefore a dependency before merging anything
Needs research on options
A collection with a role for each environment/dotfile-program?
A set of roles that start development in the monorepo's local ./roles/* directory?
This could also be split from the playbook monorepo to become a collection later
Ideally a separate storage system for the inventory should be considered
Most(all?) vault variables can be invalidated and the risk they pose is eliminated
Hostnames in particular is worrying because you cant really invalidate them without getting a whole new domain since if the ansible vault password were to ever leak, even if a new one is used old vault file versions could be decrypted and the hostnames in there would be a massive pain to renew
This may also be a good opportunity to consider a combined place to store a version controlled inventory, ansible.cfg, and vault
A way to bootstrap security credentials for newly installed workstation inventory hosts
Potentially a web of trust type system where the assumption is that at least one interactive workstation host is set up at any given time and it could be used to transfer credentials like gpg to any other new system that needs configuration
NOTE this is not intended for servers, only laptops/desktops
A README section that...
Describes the things that must be completely configured before running any of the workstation plays
Describes the basic commands to run for common tasks this repo is used for
For version tags
For development workflows that includes ansible tags and running newly developed sections with only them
Before the semver commit tag for 1.0.0 is given, ansible-lint & yaml-lint should be clean
Since the dotfiles part is the deepest dependency, clearly it needs to be the first task here, go to issue #2 for details. None of the other considerations are important till this is handled.
./roles/*
directory?1.0.0
is given, ansible-lint & yaml-lint should be clean