From f98190cf02eb16e17fe06ac08dfcf233b771bcf6 Mon Sep 17 00:00:00 2001 From: swares Date: Mon, 12 Oct 2026 08:15:54 -0600 Subject: [PATCH] repo hygiene: fix the ansible .gitignore, .PHONY and repoURL scheme ansible/.gitignore carried three rules copied from the root file with the ansible/ prefix intact, so inside ansible/ they resolved to ansible/ansible/... and matched nothing. Patterns are relative to the file that contains them. Corrected and verified: git check-ignore -v now names ansible/.gitignore where it previously named the root. No secret was exposed - the root .gitignore has the same lines in the one place that prefix is correct, and was doing the work. The defect is a second layer that looked like protection and provided none, which is worse than no second layer because a reader checking it would stop looking. Makefile: ldap removed from .PHONY; the target went with the ldap-1 VM in July and .PHONY names a missing target without complaint, which is why it survived. make -n help still parses. gitlab-runner.yaml: two repoURL lines used https where thirteen other sources use git@. Argo keys credentials by URL string, so the spellings were two repositories to it, and the https one had no credential - it worked only because the repo is public. All fifteen now match. Normalised toward git@ because that deploy key demonstrably works; the reverse is defensible but a design choice. Also ticks three items that were already true: the sandbox-vm-update comment now explains the deletion rather than pointing at a live file, FETCH_HEAD is not tracked, and TODO-2026-07-14.md does not exist. --- BACKLOG.md | 62 ++++++++++++++++++++++++++++------ Makefile | 7 +++- ansible/.gitignore | 20 +++++++++-- gitops/apps/gitlab-runner.yaml | 17 ++++++++-- 4 files changed, 89 insertions(+), 17 deletions(-) diff --git a/BACKLOG.md b/BACKLOG.md index 83595fa..d95f12b 100644 --- a/BACKLOG.md +++ b/BACKLOG.md @@ -6016,13 +6016,20 @@ them. Scope, checked 2026-08-27: **the Windows copy has no `actions-runner/` and no nested `HomeLab/`**, so sweeps run there are clean. This bites sweeps run on the H4. -- [ ] **`ansible/playbooks/sandbox-vm-update.yml` references `bootstrap-lldap.yml`** in a - comment (1 hit, confirmed still present 2026-08-27). That playbook was deleted on - 08-03. Cosmetic, but it is the kind of stale pointer that sends someone looking for a - file that has not existed for weeks. +- [x] **Already fixed — verified 2026-10-12.** The comment at + `sandbox-vm-update.yml:400` no longer points at a live file; it explains the deletion: -- [ ] **`Makefile:2` still lists `ldap` in `.PHONY`** though the target was removed on - 08-09 and the file carries a comment explaining the removal. Harmless; finish the job. + # lldap_admin_pass comes from Ansible Vault. (bootstrap-lldap.yml, which + # previously shared this var, was deleted 2026-08-02 with the ldap-1 VM.) + + So it is a historical note rather than a stale pointer, and nobody would go looking. + Somebody fixed it and never ticked this. One small discrepancy left standing: this item + says the playbook was deleted **08-03**, the comment says **08-02**. Not worth chasing, + recorded so the next reader does not treat the mismatch as a finding. + +- [x] **Done 2026-10-12.** `ldap` removed from `.PHONY`; `make -n help` still parses. + `.PHONY` names a non-existent target without complaining, which is precisely why it + survived three months after the `ldap:` target went with the ldap-1 VM. - [x] **`FETCH_HEAD` is tracked in git** — a git internal committed by accident. Removed 2026-10-03. @@ -6030,11 +6037,44 @@ them. `ansible/.github/workflows/*`, `ansible/.claude/settings.json`. Only the root copies are read; these are dead weight diverging silently. Moved to `archive/ansible-stale-ci/` 2026-10-03. -- [ ] **Mixed ArgoCD `repoURL` schemes** — 12 files use `git@github.com:`, but - `gitops/apps/gitlab-runner.yaml:18,22` uses `https://`. Argo treats these as two - repos needing two credentials. -- [ ] **`.gitignore` path bug in `ansible/`** (C7) — and note this working copy lives in - `Downloads`, so `LAB-URLS.md` and similar travel with any zip or sync of the folder. +- [x] **Done 2026-10-12 — and the count had grown since this was written.** Thirteen + sources used `git@github.com:`, not twelve, and *two* lines in + `gitops/apps/gitlab-runner.yaml` used `https://`, not one. Both normalised to `git@`; + all **fifteen** references to this repo are now one spelling. + + Argo keys repository credentials by the URL string, so the two spellings were two + repositories to it — and the `https` one had no credential, working only because the + repo is public. Normalised *toward* `git@` because that deploy key demonstrably works + for the other thirteen. The reverse (https everywhere, no key needed now the repo is + public) is defensible but is a design choice, not a cleanup, so it was not made here. +- [x] **Fixed 2026-10-12, and it was worse than "path bug" suggests.** `ansible/.gitignore` + carried three rules copied from the root file, prefix and all: + + ansible/.vault_pass <- inside ansible/, resolves to ansible/ansible/… + ansible/files/pull-secret.json + ansible/files/*.secret + + **Patterns in a `.gitignore` are relative to that file**, so all three matched nothing. + Corrected to `.vault_pass`, `files/pull-secret.json`, `files/*.secret`, and verified — + `git check-ignore -v` now names `ansible/.gitignore` as the matching rule where it + previously named the root. + + **No secret was ever exposed**: the root `.gitignore` has the same three lines, in the + one place that prefix is correct, and it was doing the work the whole time. The defect + is subtler than an exposure — it was a second layer that *looked* like protection and + provided none, which is worse than no second layer, because a reader checking + `ansible/.gitignore` would stop looking. + + **A note on how this was verified, because the first attempt was careless.** Testing + the patterns by `touch`-ing `ansible/.vault_pass` and friends put empty files named + after real secrets into the authoritative checkout — in a repo whose first rule is + never to commit those names — and an empty `.vault_pass` there is its own hazard, since + a run using `--vault-password-file` would get an empty password and fail as though the + vault were corrupt. `git check-ignore -v --no-index ` evaluates paths that **do + not exist** and was available from the start. Test ignore rules that way. + + Still true and unaddressed: this working copy lives in `Downloads`, so `LAB-URLS.md` + and similar travel with any zip or sync of the folder. - [x] **Archive `TODO-2026-07-14.md`** (25/26 done) and collapse `README.md`'s TODO to a pointer at this file. Done 2026-10-03: all three dated TODO files moved to `archive/` unedited, and the README section is now a pointer. diff --git a/Makefile b/Makefile index d3c2af8..c00fba5 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,10 @@ # Convenience targets. All Ansible runs target the host(s) in inventory/hosts.yml. -.PHONY: help check storage microshift backup argocd all dns ai-nodes vault ldap mqtt k3s-vms \ +# +# `ldap` removed from .PHONY 2026-10-12 (BACKLOG §7.1): the target went when the +# ldap-1 VM was decommissioned on 2026-07-04 and lldap moved into k3s, but the +# .PHONY entry stayed. Harmless — .PHONY names a non-existent target without +# complaint — which is exactly why it survived three months. +.PHONY: help check storage microshift backup argocd all dns ai-nodes vault mqtt k3s-vms \ k3s-registry update-containers update-vms bake-image validate-rollout ansible-deps bootstrap \ push-m5stack diff --git a/ansible/.gitignore b/ansible/.gitignore index 029dd26..276e91f 100644 --- a/ansible/.gitignore +++ b/ansible/.gitignore @@ -1,7 +1,21 @@ # Secrets -- never commit -ansible/.vault_pass -ansible/files/pull-secret.json -ansible/files/*.secret +# +# PATHS ARE RELATIVE TO THIS FILE, i.e. to ansible/. Until 2026-10-12 the three +# lines below read `ansible/.vault_pass`, `ansible/files/pull-secret.json` and +# `ansible/files/*.secret` — copied from the root .gitignore, where that prefix is +# correct. Inside ansible/ they resolve to ansible/ansible/… and matched nothing. +# +# The secrets were never actually exposed: the ROOT .gitignore carries the same +# three lines and is in the right place for them, and `git check-ignore -v` names +# that file as the one doing the work. So this file was a second layer that looked +# like protection and provided none — which is worse than no second layer, because +# anyone reading it would stop looking. +# +# BACKLOG §7.1 (C7). Verify with: +# git check-ignore -v ansible/.vault_pass +.vault_pass +files/pull-secret.json +files/*.secret **/*.key **/*.pem kubeconfig diff --git a/gitops/apps/gitlab-runner.yaml b/gitops/apps/gitlab-runner.yaml index e6c9f3d..091121f 100644 --- a/gitops/apps/gitlab-runner.yaml +++ b/gitops/apps/gitlab-runner.yaml @@ -15,11 +15,24 @@ spec: valueFiles: - $values/gitops/workloads/gitlab-runner/values.yaml # Source 2: values file from this repo (ref-only — used by source 1 valueFiles) - - repoURL: https://github.com/swares/HomeLab.git + # + # SCHEME NORMALISED 2026-10-12 (BACKLOG §7.1). These two were the only + # `https://github.com/swares/HomeLab.git` in the tree; thirteen other sources use + # `git@github.com:swares/HomeLab.git`. Argo CD keys its repository credentials by + # the URL string, so the two spellings are two repositories to it — one of which + # had no credential and worked only because the repo is public. Matching the + # thirteen means one credential, one cache entry, and `argocd repo list` showing + # one entry instead of two for the same thing. + # + # Deliberately normalised TOWARD git@ rather than away from it: that deploy key + # demonstrably works for thirteen Applications. Going the other way — https + # everywhere, no key needed now the repo is public — is a defensible design + # choice, but it is a choice, not a cleanup, so it is not made here. + - repoURL: git@github.com:swares/HomeLab.git targetRevision: main ref: values # Source 3: kustomize manifests (ExternalSecret for runner token) - - repoURL: https://github.com/swares/HomeLab.git + - repoURL: git@github.com:swares/HomeLab.git targetRevision: main path: gitops/workloads/gitlab-runner destination: