Pieter
|
6bc8e508c6
|
Complete SOPS secrets management setup (#5)
Completed Issue #5: SOPS Secrets Management
All objectives met:
- ✅ Age encryption key generated (keys/age-key.txt)
- ✅ SOPS configured with Age backend (.sops.yaml)
- ✅ Secrets directory structure created
- ✅ Example encrypted secrets (shared + test client)
- ✅ Comprehensive documentation for key backup
- ✅ Ready for Ansible integration
Security measures:
- Age private key gitignored (keys/age-key.txt)
- Only encrypted .sops.yaml files committed
- Plaintext secrets explicitly excluded
- Key backup procedures documented
Files added:
- .sops.yaml - SOPS configuration with Age public key
- secrets/shared.sops.yaml - Shared secrets (encrypted)
- secrets/clients/test.sops.yaml - Test client secrets (encrypted)
- secrets/README.md - Complete SOPS usage guide
- keys/README.md - Key backup procedures
- keys/.gitignore - Protects private keys
Updated:
- .gitignore - Allow .sops.yaml, block plaintext
Tested:
- Encryption: ✅ Files encrypted successfully
- Decryption: ✅ Secrets decrypt correctly
- Git safety: ✅ Private key excluded from commits
Next: Ready for Zitadel/Nextcloud deployment with secure credentials
Closes #5
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
|
2025-12-27 14:23:36 +01:00 |
|
Pieter
|
4e72ddf4ef
|
Complete Ansible base configuration (#2)
Completed Issue #2: Ansible Base Configuration
All objectives met:
- ✅ Hetzner Cloud dynamic inventory (hcloud plugin)
- ✅ Common role (SSH hardening, UFW firewall, fail2ban, auto-updates)
- ✅ Docker role (Docker Engine + Compose + networks)
- ✅ Traefik role (reverse proxy with Let's Encrypt SSL)
- ✅ Setup playbook (orchestrates all base roles)
- ✅ Successfully tested on live test server (91.99.210.204)
Additional improvements:
- Fixed ansible.cfg for Ansible 2.20+ compatibility
- Updated ADR dates to 2025
- All roles follow Infrastructure Agent patterns
Test Results:
- SSH hardening applied (key-only auth)
- UFW firewall active (ports 22, 80, 443)
- Fail2ban protecting SSH
- Automatic security updates enabled
- Docker running with traefik network
- Traefik deployed and ready for SSL
Files added:
- ansible/playbooks/setup.yml
- ansible/roles/docker/* (complete)
- ansible/roles/traefik/* (complete)
Closes #2
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
|
2025-12-27 14:13:15 +01:00 |
|
Pieter
|
171cbfbb32
|
WIP: Ansible base configuration - common role (#2)
Progress on Issue #2: Ansible Base Configuration
Completed:
- ✅ Ansible installed via pipx (isolated Python environment)
- ✅ Hetzner Cloud dynamic inventory configured
- ✅ Ansible configuration (ansible.cfg)
- ✅ Common role for base system hardening:
- SSH hardening (key-only, no root password)
- UFW firewall configuration
- Fail2ban for SSH protection
- Automatic security updates
- Timezone and system packages
- ✅ Comprehensive Ansible README with setup guide
Architecture Updates:
- Added Decision #15: pipx for isolated Python environments
- Updated ADR changelog with pipx adoption
Still TODO for #2:
- Docker role
- Traefik role
- Setup playbook
- Deploy playbook
- Testing against live server
Files added:
- ansible/README.md - Complete Ansible guide
- ansible/ansible.cfg - Ansible configuration
- ansible/hcloud.yml - Hetzner dynamic inventory
- ansible/roles/common/* - Base hardening role
Partial progress on #2
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
|
2025-12-27 14:00:22 +01:00 |
|
Pieter
|
0135bd360a
|
Implement OpenTofu infrastructure provisioning (#1)
Completed:
- ✅ Hetzner Cloud provider configuration
- ✅ VPS server provisioning with for_each pattern
- ✅ Cloud firewall rules (SSH, HTTP, HTTPS)
- ✅ SSH key management
- ✅ Outputs for Ansible dynamic inventory
- ✅ Variable structure and documentation
- ✅ Test server successfully provisioned
Deferred:
- DNS configuration (commented out, waiting for domain)
Files added:
- tofu/versions.tf - Provider versions
- tofu/variables.tf - Input variable definitions
- tofu/main.tf - Core infrastructure resources
- tofu/dns.tf - DNS configuration (optional)
- tofu/outputs.tf - Outputs for Ansible integration
- tofu/terraform.tfvars.example - Configuration template
- tofu/README.md - Comprehensive setup guide
Closes #1
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
|
2025-12-27 13:48:42 +01:00 |
|
Pieter
|
3848510e1b
|
Initial project structure with agent definitions and ADR
- Add AI agent definitions (Architect, Infrastructure, Zitadel, Nextcloud)
- Add Architecture Decision Record with complete design rationale
- Add .gitignore to protect secrets and sensitive files
- Add README with quick start guide
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
|
2025-12-24 12:12:17 +01:00 |
|