tegwick
ff59d4e0f8
T01: roles/swapfile — idempotent 4GB swapfile, vm.swappiness=10, fstab entry
T02: roles/resource_limits — PAM nproc caps (512/1024), systemd user-1000.slice
memory limits (1500M/512M); templated per-host via host_vars
- inventory/host_vars/CoulombCore.yml — host-specific vars for both roles
- inventory/servers.yaml — add CoulombCore with id_ops SSH key
- inventory_from_yaml.py — load host_vars files into Ansible hostvars
- playbooks/bootstrap.yaml — include swapfile + resource_limits roles
- workplans/WP-0004 — flag T04/T09/T10 needs_human, add CoulombCore-local convergence note
Codifies manual INC-002 hardening. See RAIL-HO-WP-0004-T01/T02.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
53 lines
1.6 KiB
Python
Executable File
53 lines
1.6 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
import json, yaml, subprocess, os, sys, pathlib, glob
|
|
|
|
def load_servers():
|
|
with open(os.path.join(os.path.dirname(__file__), '..', 'inventory', 'servers.yaml')) as f:
|
|
data = yaml.safe_load(f)
|
|
servers = data.get('servers', [])
|
|
return servers
|
|
|
|
def load_tf_outputs():
|
|
# Try to read terraform outputs to attach IPs, if available.
|
|
try:
|
|
out = subprocess.check_output(['terraform', '-chdir=../terraform/hetzner', 'output', '-json'], stderr=subprocess.DEVNULL, text=True)
|
|
j = json.loads(out)
|
|
servers = j.get('servers', {}).get('value', {})
|
|
return servers # {name: ip}
|
|
except Exception:
|
|
return {}
|
|
|
|
def load_host_vars(name):
|
|
"""Load host_vars/<name>.yml if it exists."""
|
|
script_dir = os.path.dirname(__file__)
|
|
path = os.path.join(script_dir, '..', 'inventory', 'host_vars', f'{name}.yml')
|
|
if os.path.exists(path):
|
|
with open(path) as f:
|
|
return yaml.safe_load(f) or {}
|
|
return {}
|
|
|
|
def main():
|
|
server_list = load_servers()
|
|
tf = load_tf_outputs()
|
|
host_names = []
|
|
hostvars = {}
|
|
for s in server_list:
|
|
name = s['name']
|
|
host_names.append(name)
|
|
hvars = {
|
|
"ansible_host": tf.get(name) or s.get('ip'),
|
|
"ansible_user": s.get('ssh_user', 'admin'),
|
|
}
|
|
if s.get('ssh_key'):
|
|
hvars["ansible_ssh_private_key_file"] = s['ssh_key']
|
|
hvars.update(load_host_vars(name))
|
|
hostvars[name] = hvars
|
|
inv = {
|
|
"all": {"hosts": host_names},
|
|
"_meta": {"hostvars": hostvars}
|
|
}
|
|
print(json.dumps(inv))
|
|
|
|
if __name__ == "__main__":
|
|
main()
|