Basis aus 2nd-brain für LPIC-Prüfungsvorbereitung übernommen

Regeln, Standards, Kontextstruktur und Werkzeuge übernommen; 2nd-brain- Inhalte (Stacks, Ansible-Inventar, Architektur, Knowledge) entfernt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-29 21:56:53 +01:00
commit 7f6b8ebe07
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+#-------------------------------------------------------------------------------
+## @file     .env.sh
+## @brief    Ansible-Kontext für dieses Repo setzen (Pfade + Secret-Store)
+## @author   <AUTOR – aus ai/context/responsible.md>
+## @owner    <VERANTWORTLICH – aus ai/context/responsible.md>
+## @version  1.0.0 (07.10.2026)
+## @usage    source ansible/.env.sh      (bash und zsh, aus beliebigem Verzeichnis)
+#-------------------------------------------------------------------------------
+# Pfad dieser Datei – bash: BASH_SOURCE, zsh: %x
+_ANS_SRC="${BASH_SOURCE[0]:-${(%):-%x}}"
+_ANS_DIR="$(cd "$(dirname "$_ANS_SRC")" && pwd -P)"
+
+# --- Ansible-Pfade (fremden Kontext zurücksetzen) ---
+unset ANSIBLE_CONFIG ANSIBLE_INVENTORY ANSIBLE_ROLES_PATH ANSIBLE_VAULT_PASSWORD_FILE
+export ANSIBLE_BASE_PATH="$_ANS_DIR"
+export ANSIBLE_CONFIG="$ANSIBLE_BASE_PATH/ansible.cfg"
+export ANSIBLE_INVENTORY="$ANSIBLE_BASE_PATH/inv"
+export ANSIBLE_ROLES_PATH="$ANSIBLE_BASE_PATH/roles"
+export ANS_PLAYDIR="$ANSIBLE_BASE_PATH/playbooks"
+export ANS_FILES="$ANSIBLE_BASE_PATH/files"
+export ANS_DEFAULT_HOSTS="<STANDARDHOST>"          # nur Doku – Default steht im Play
+
+# --- Secret-Store (HashiCorp Vault, bevorzugt) – Token aus ~/.vault-token ---
+export VAULT_ADDR="<VAULT_ADDR>"
+export ANSIBLE_HASHI_VAULT_ADDR="$VAULT_ADDR"
+export ANSIBLE_HASHI_VAULT_AUTH_METHOD="token"
+export ANS_VAULT_KV_MOUNT="secret"
+export ANS_VAULT_KV_PATH="<projekt>"
+
+# --- Ansible Vault (nur Fallback, Passwortdatei außerhalb des Repos) ---
+[ -f "$HOME/.ans-secret-<projekt>" ] && export ANSIBLE_VAULT_PASSWORD_FILE="$HOME/.ans-secret-<projekt>"
+
+unset _ANS_DIR _ANS_SRC
+echo "Ansible-Kontext aktiv: ANSIBLE_BASE_PATH=$ANSIBLE_BASE_PATH"
@@ -0,0 +1,24 @@
+## @file  ansible.cfg – Pfade kommen aus .env.sh (source ansible/.env.sh)
+[defaults]
+inventory=$ANSIBLE_BASE_PATH/inv
+roles_path=$ANSIBLE_BASE_PATH/roles
+log_path=$ANSIBLE_BASE_PATH/ansible.log
+fact_caching=jsonfile
+fact_caching_connection=$ANSIBLE_BASE_PATH/fact_caching
+fact_caching_prefix=facts_
+fact_caching_timeout=86400
+gathering=smart
+interpreter_python=auto_silent
+retry_files_enabled=False
+stdout_callback=default
+callback_result_format=yaml
+
+[privilege_escalation]
+become=True
+become_method=sudo
+become_user=root
+become_ask_pass=False
+
+[ssh_connection]
+ssh_args=-o ControlMaster=auto -o ControlPersist=60s
+pipelining=True
@@ -0,0 +1,10 @@
+{#-
+## @file     example.conf.j2
+## @brief    Konfiguration für <Dienst> – verwaltet von Ansible (Rolle example)
+## @author   <AUTOR – aus ai/context/responsible.md>
+## @owner    <VERANTWORTLICH – aus ai/context/responsible.md>
+## @version  0.1.0 (TT.MM.JJJJ)
+-#}
+# {{ ansible_managed }}
+# Nicht von Hand ändern – Änderungen über Ansible.
+password = {{ example_secrets.password | default('') }}
@@ -0,0 +1,10 @@
+---
+## @brief  Globale Variablen für alle Hosts
+ansible_user: "<ANSIBLE_USER>"
+
+# Ablage für Templates/Dateien (aus .env.sh, Fallback relativ zum Repo)
+ans_files: "{{ lookup('env', 'ANS_FILES') | default(playbook_dir ~ '/../files', true) }}"
+
+# Secret-Store (KV v2) – Werte aus .env.sh
+ans_vault_kv_mount: "{{ lookup('env', 'ANS_VAULT_KV_MOUNT') | default('secret', true) }}"
+ans_vault_kv_path: "{{ lookup('env', 'ANS_VAULT_KV_PATH') | default('<projekt>', true) }}"
@@ -0,0 +1,3 @@
+## @file  inv/lab – Inventar Testumgebung (Hosts aus ai/context/knowledge/systems/)
+[example]
+<STANDARDHOST>
@@ -0,0 +1,16 @@
+#-------------------------------------------------------------------------------
+## @file     example.yml
+## @brief    <Dienst> installieren + konfigurieren (Rolle example, Templates aus $ANS_FILES/example)
+## @author   <AUTOR – aus ai/context/responsible.md>
+## @owner    <VERANTWORTLICH – aus ai/context/responsible.md>
+## @version  0.1.0 (TT.MM.JJJJ)
+## @usage    ansible-playbook $ANS_PLAYDIR/example.yml [-e hostlist=host1,gruppe]
+##           Tags: install | config | verify      Trockenlauf: --check --diff
+##           ohne Secret-Store: -e example_secrets_source=vars -e @<testsecrets.yml>
+## @requires source ansible/.env.sh  und  vault login
+#-------------------------------------------------------------------------------
+---
+- name: Example
+  hosts: "{{ hostlist | default('<STANDARDHOST>') }}"
+  roles:
+    - example
@@ -0,0 +1,28 @@
+#-------------------------------------------------------------------------------
+## @file     mini_check.yml
+## @brief    Erreichbarkeit prüfen und Kernfakten anzeigen; -e check_mode=setup sammelt Facts neu
+## @author   <AUTOR – aus ai/context/responsible.md>
+## @owner    <VERANTWORTLICH – aus ai/context/responsible.md>
+## @version  1.0.0 (07.10.2026)
+## @usage    ansible-playbook $ANS_PLAYDIR/mini_check.yml [-e hostlist=…] [-e check_mode=setup]
+#-------------------------------------------------------------------------------
+---
+- name: Mini-Check
+  hosts: "{{ hostlist | default('<STANDARDHOST>') }}"
+  gather_facts: false
+  tasks:
+    - name: Erreichbarkeit prüfen
+      ansible.builtin.ping:
+
+    - name: Facts neu sammeln
+      ansible.builtin.setup:
+      when: (check_mode | default('')) == 'setup'
+
+    - name: Facts aus Cache/Host laden
+      ansible.builtin.setup:
+        gather_subset: [min]
+      when: ansible_facts['distribution'] is not defined
+
+    - name: Kernfakten anzeigen
+      ansible.builtin.debug:
+        msg: "{{ inventory_hostname }}: {{ ansible_facts['distribution'] }} {{ ansible_facts['distribution_version'] }}, Kernel {{ ansible_facts['kernel'] }}"
@@ -0,0 +1,10 @@
+---
+## @brief  Defaults der Rolle example – alle Variablen mit Präfix example_
+
+example_packages: [example]                     # zu installierende Pakete
+example_service: example                        # systemd-Unit
+example_config_file: /etc/example/example.conf  # Ziel der eigenen Konfiguration
+example_config_check_cmd: "example --check-config"   # Prüfbefehl vor jedem Restart
+example_smoke_test: true                        # verify.yml ausführen
+example_secrets_source: vault                   # vault | vars (Test)
+example_test_secrets: {}                        # nur mit secrets_source=vars, Datei außerhalb des Repos
@@ -0,0 +1,13 @@
+---
+## @brief  Handler-Kette: erst Konfiguration prüfen, dann neu starten
+
+- name: Konfiguration prüfen
+  ansible.builtin.command: "{{ example_config_check_cmd }}"
+  changed_when: false
+  listen: example config changed
+
+- name: Dienst neu starten
+  ansible.builtin.service:
+    name: "{{ example_service }}"
+    state: restarted
+  listen: example config changed
@@ -0,0 +1,11 @@
+---
+galaxy_info:
+  role_name: example
+  author: "<AUTOR – aus ai/context/responsible.md>"
+  description: "<Dienst> installieren und konfigurieren"
+  license: proprietary
+  min_ansible_version: "2.15"
+  platforms:
+    - name: Debian
+      versions: [trixie]
+dependencies: []
@@ -0,0 +1,13 @@
+---
+## @brief  Eigene Konfigurationsdateien schreiben (Templates aus files/example/)
+
+- name: Konfiguration schreiben
+  ansible.builtin.template:
+    src: "{{ ans_files }}/example/example.conf.j2"
+    dest: "{{ example_config_file }}"
+    owner: root
+    group: root
+    mode: "0640"
+    backup: true
+  diff: false          # Template enthält Geheimnisse – nicht entfernen
+  notify: example config changed
@@ -0,0 +1,9 @@
+---
+## @brief  Pakete installieren
+
+- name: Pakete installieren
+  ansible.builtin.apt:
+    name: "{{ example_packages }}"
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
@@ -0,0 +1,39 @@
+---
+## @brief  Rolle example – Ablauf: prüfen → Geheimnisse → installieren → konfigurieren → testen
+
+- name: Plattform prüfen (Debian >= 13 erwartet)
+  ansible.builtin.assert:
+    that:
+      - ansible_facts['os_family'] == 'Debian'
+      - ansible_facts['distribution_major_version'] | int >= 13
+    fail_msg: "{{ inventory_hostname }}: {{ ansible_facts['distribution'] }} {{ ansible_facts['distribution_version'] }} – Rolle ist für Debian >= 13 gebaut."
+    quiet: true
+  tags: [always]
+
+- name: Geheimnisse laden
+  ansible.builtin.import_tasks: secrets.yml
+  tags: [always]
+
+- name: Installieren
+  ansible.builtin.import_tasks: install.yml
+  tags: [install]
+
+- name: Konfigurieren
+  ansible.builtin.import_tasks: config.yml
+  tags: [config]
+
+- name: Handler jetzt ausführen (Config-Check vor Restart)
+  ansible.builtin.meta: flush_handlers
+  tags: [always]
+
+- name: Dienst aktiv und gestartet
+  ansible.builtin.service:
+    name: "{{ example_service }}"
+    state: started
+    enabled: true
+  tags: [install, config]
+
+- name: Smoke-Test
+  ansible.builtin.import_tasks: verify.yml
+  when: example_smoke_test | bool
+  tags: [verify]
@@ -0,0 +1,14 @@
+---
+## @brief  Geheimnisse aus dem Secret-Store (Default) oder aus Testvariablen laden
+
+- name: Geheimnisse aus dem Secret-Store lesen
+  ansible.builtin.set_fact:
+    example_secrets: "{{ lookup('community.hashi_vault.vault_kv2_get', ans_vault_kv_path ~ '/example', engine_mount_point=ans_vault_kv_mount).secret }}"
+  when: example_secrets_source == 'vault'
+  no_log: true
+
+- name: Geheimnisse aus Testvariablen übernehmen
+  ansible.builtin.set_fact:
+    example_secrets: "{{ example_test_secrets }}"
+  when: example_secrets_source == 'vars'
+  no_log: true
@@ -0,0 +1,9 @@
+---
+## @brief  Smoke-Test: Dienst läuft und antwortet
+
+- name: Dienststatus abfragen
+  ansible.builtin.command: systemctl is-active {{ example_service }}
+  register: example_active
+  check_mode: false
+  changed_when: false
+  failed_when: example_active.stdout != 'active'