railiance-infra/ansible/playbooks/bootstrap.yaml

- hosts: all
  become: true
  vars_files:
    - ../inventory/group_vars/all.yaml
    - ../inventory/group_vars/secrets.sops.yaml
  roles:
    - role: base
    - role: sops_agent
    - role: custodian_agent   # injects ~/.ssh/id_custodian_agent.pub into authorized_keys
    - role: swapfile          # provisions swap file (size + swappiness from host_vars)
    - role: resource_limits   # nproc PAM caps + systemd user slice memory limits
    # - role: wireguard   # enable if you configure WireGuard variables
feat: initial import of RailianceHosts starter 2025-09-13 20:26:11 +02:00			`- hosts: all`
			`become: true`
			`vars_files:`
			`- ../inventory/group_vars/all.yaml`
			`- ../inventory/group_vars/secrets.sops.yaml`
			`roles:`
			`- role: base`
			`- role: sops_agent`
feat(custodian-agent): Ansible role + Makefile for Custodian SSH identity Establishes a dedicated SSH keypair for the Custodian automation agent: - ansible/roles/custodian_agent/: authorized_key task (tagged custodian_agent) - ansible/inventory/group_vars/all.yaml: custodian_agent_user/pubkey vars - ansible/playbooks/bootstrap.yaml: custodian_agent role added - Makefile: provision-custodian-agent / provision-custodian-agent-host targets Keypair generation: cd ~/the-custodian && make custodian-keygen Then deploy: cd ~/railiance-infra && make provision-custodian-agent The private key lives at ~/.ssh/id_custodian_agent — never committed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-03-27 01:21:57 +01:00			`- role: custodian_agent # injects ~/.ssh/id_custodian_agent.pub into authorized_keys`
feat(ansible): add swapfile + resource_limits roles; add CoulombCore to inventory T01: roles/swapfile — idempotent 4GB swapfile, vm.swappiness=10, fstab entry T02: roles/resource_limits — PAM nproc caps (512/1024), systemd user-1000.slice memory limits (1500M/512M); templated per-host via host_vars - inventory/host_vars/CoulombCore.yml — host-specific vars for both roles - inventory/servers.yaml — add CoulombCore with id_ops SSH key - inventory_from_yaml.py — load host_vars files into Ansible hostvars - playbooks/bootstrap.yaml — include swapfile + resource_limits roles - workplans/WP-0004 — flag T04/T09/T10 needs_human, add CoulombCore-local convergence note Codifies manual INC-002 hardening. See RAIL-HO-WP-0004-T01/T02. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-03-27 01:49:35 +01:00			`- role: swapfile # provisions swap file (size + swappiness from host_vars)`
			`- role: resource_limits # nproc PAM caps + systemd user slice memory limits`
feat: initial import of RailianceHosts starter 2025-09-13 20:26:11 +02:00			`# - role: wireguard # enable if you configure WireGuard variables`