Files

Gabriel Radureau 1a1d7da329 🔒 fix(ansible): gate vault auth disable behind vault_oidc_force_reset (default off)

The vault auth disable task added in 437fd506 wipes all gitea_cicd_* per-app JWT roles every ansible run (side effect). Gate it behind a default-off flag so normal re-runs preserve those roles. Opt in with --extra-vars vault_oidc_force_reset=true when intentionally rebuilding the OIDC backend (e.g. bound_issuer config drift).

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

2026-05-06 15:03:23 +02:00

docs

docs(adr): extend network-architecture ADR with .lab SSL/TLS deep dive

2026-05-06 12:55:27 +02:00

img

new role gitea_repo

2024-08-16 13:53:03 +02:00

inventory

♻️ refactor(ansible): move gitea secret user-propagation list to inventory (#4 )

2026-05-06 14:48:05 +02:00

README.md

Ansible Collection - arcodange.factory

Documentation for the collection.

MY_TOKEN= #<my token (see https://www.duckdns.org/domains)>
kubectl create secret generic traefik-duckdns-token --from-literal="DUCKDNS_TOKEN=$MY_TOKEN" -n kube-system

%%{init: { 'logLevel': 'debug', 'theme': 'dark' } }%%
timeline
    title Playbook Execution Sequence
    section 01_system
        rpi
            : set hostname
        dns
            : install pi-hole
        ssl
            : step-ca
            : fetch root certificate
            : build docker image with CA
        prepare_disks
            : list partitions
            : format disk
            : mount disk
        system_docker
            : install docker
            : configure docker storage
            : restart docker
        longhorn
            : deploy longhorn
        k3s
            : prepare inventory
            : install k3s collection
            : install socat
            : deploy k3s cluster
            : configure kubeconfig
            : configure traefik
            : configure cert-manager
    section 02_setup
        backup_nfs
            : create RWX volume
            : create recurring job
            : deploy NFS
            : mount NFS
        postgres
            : create database
            : create user
        gitea
            : deploy gitea
            : create admin user
            : create organization
    section 03_cicd
        cicd : CI/CD
        gitea_token
            : generate token
        deploy_docker_compose
            : deploy gitea action
        argocd
            : generate token
            : deploy argocd
    section 04_tools
        Hashicorp Vault
            : gitea_token
            : hashicorp_vault
        Crowdsec
            : crowdsec
    section 05_backup
        Gitea Backup
            : gitea
        K3s PVC Backup
            : k3s_pvc
        Postgres Backup
            : create backup script
            : create restore script