infra/ansible/findings.md

Ansible Repo Audit — Findings

Generated 2026-06-04 after auditing ~70 role files, 7 playbooks/configs, 21 host_vars, and 50+ templates.

Completed Fixes

• Removed all Forgejo references — deleted roles/forgejo/, removed forgejo play from playbook.yml, removed forgejo_servers group from hosts, removed forgejo vars from host_vars/git.mcintire.me.yml, removed docker-mirror CNAME from DNS zone.
• Fixed hardcoded SSH private key paths — replaced all 20 occurrences of /Users/graham/.ssh/id_ed25519 and /Users/graham/.ssh/ansible with ansible_ssh_private_key_file: "{{ lookup('env', 'ANSIBLE_SSH_PRIVATE_KEY_FILE') | default('~/.ssh/ansible', true) }}" in group_vars/all/all.yml. Set ANSIBLE_SSH_PRIVATE_KEY_FILE env var to override.
• Fixed community.mysql collection — added to requirements.yml and installed (fixes monitor role crash).
• Removed broken setup-user Makefile target — referenced non-existent setup-user.sh.
• Fixed tracking issues — git rm --cached for 5 .DS_Store files and .vscode/settings.json; added .ansible/ to .gitignore.
• Fixed stale documentation — updated CLAUDE.md and README.md to reflect actual playbook structure, roles, inventory groups, and collections.
• Fixed non-FQCN module references — converted ~290 short module names (apt:, service:, template:, etc.) to FQCNs (ansible.builtin.apt:, etc.) across all roles and playbooks.
• Fixed become:/gather_facts: boolean forms — become: yes → become: true, gather_facts: no → gather_facts: false in all plays.
• Removed deprecated inject_facts_as_vars from ansible.cfg.
• Added missing task names — import_tasks/include_role calls in base/tasks/main.yml and general/tasks/main.yml now have descriptive names.
• Fixed partial-become bug — added become: yes to librenms clone task.
• Added pipefail to risky shell command in udp-gro-fix.yml.
• Quoted octal mode values — mode: 0755 → mode: '0755', etc.
• Hardened .ansible-lint config — set profile: production, added exclude paths, removed all skip_list entries.
• Added defaults for 4 undefined template variables — ntpserver, template_run_date, deb_mirror, sshd.* all have safe fallbacks now.
• Removed Alpine role reference — include_role: name=alpine in roles/base/tasks/main.yml was pointing to a non-existent role.
• Fixed SSH -t flag placement — Moved before hostname in both bootstrap-reboot and reboot Makefile targets.
• Fixed general.yml references — bootstrap-network, run-all, qc-web Makefile targets now use playbook.yml; removed qc-web target (qc_web group doesn't exist).
• Removed all Docker targets — build-*, run-*, push-*, base-*, latest, local, clean, dirs — no Dockerfile at repo root ever existed.
• Fixed install-collections — removed references to deleted roles/requirements.yml and scripts/fix-deprecated-imports.sh.
• Deleted unreferenced roles — removed icinga2-container/, debug/, mailcow/, syncthing/ (no plays applied them).
• Removed unused Galaxy dependencies — deleted geerlingguy.docker, geerlingguy.kubernetes from requirements.yml; deleted entire roles/requirements.yml (graylog2.graylog, bertvv.bind, artis3n.tailscale); merged netbox.netbox into root file.
• Cleaned fact_cache — removed 56 stale files.
• Removed unused inventory groups — home_cluster and dns_servers (defined but never targeted).

---

🔴 Security (fix immediately)

#	Issue	Location
1	Plaintext secrets in .envrc — Tailscale auth key, PowerDNS API key, PostgreSQL password, Proxmox root password in plaintext on disk. Use ansible-vault or a secrets manager.	.envrc:3,6,9,14
2	Hardcoded cloud-init password — cipassword in plaintext for BIND9 VM. Anyone with repo access can SSH in as debian.	playbook.yml:159
3	Hardcoded SSH public key — Same ed25519 key in playbook, setup-host.sh, and base/files/ansible.pub. Not vaulted. Rotate + move to vault.	playbook.yml:106, setup-host.sh:17, base/files/ansible.pub

---

🔴 Broken Infrastructure (will fail at runtime)

#	Issue	Location
5	general.yml does not exist — Referenced by 3 Makefile targets plus docs. Content was merged into playbook.yml but Makefile was never updated.	Makefile:40,56,68
6	No Dockerfile at repo root — All build-*, run-*, push-* Makefile targets fail. base-latest/base-local reference non-existent sub-targets.	Makefile:3-30
8	geerlingguy.postgresql not in requirements.yml — Role referenced in playbook.yml:73 for postgresql_servers but not installable via ansible-galaxy.	playbook.yml:73, requirements.yml
9	alpine role referenced but doesn't exist — include_role: name=alpine will crash on any Alpine host.	roles/base/tasks/main.yml:46-48
10	db.aprs.me has host_vars but no inventory entry — Orphaned host_vars, Ansible never loads them.	host_vars/db.aprs.me.yml, hosts

---

🔴 Runtime Crashes (undefined template variables)

All template variable defaults have been added. See Completed Fixes for details.

---

🟡 Logic Bugs

#	Issue	Location
18	Firewall role runs twice on every non-Proxmox host — once via base role's include_role and once via explicit firewall play.	playbook.yml:18-25, roles/base/tasks/main.yml:50-55
19	SSH -t flag in wrong position — Placed after hostname where it's treated as a remote command, not a local SSH option.	Makefile:43,65
20	ansible_user in [ssh_connection] section — Silently ignored by Ansible. Should be remote_user under [defaults].	ansible.cfg:32
21	run.sh masks playbook failures — tee pipeline without set -o pipefail always exits 0.	run.sh:18
22	playbook_handlers.yml is orphaned — Defines Restart firewalld handler but is never imported by any playbook.	playbook_handlers.yml
23	changed_when: true on idempotent commands — removes prevents re-execution but changed_when overrides natural detection.	roles/debian/tasks/main.yml:5, roles/general/tasks/udp-gro-fix.yml:27, roles/mailcow/tasks/main.yml:156
24	run-local mounts wrong path — ${PWD}/run/fact_cache doesn't exist. dirs creates tmp/fact_cache which is never used.	Makefile:10,34
25	TAILSCALE_AUTHKEY vs TAILSCALE_KEY mismatch — .envrc exports TAILSCALE_AUTHKEY but docs say role expects TAILSCALE_KEY.	.envrc:3 vs CLAUDE.md
26	bootstrap.yml second play unconditionally uses become_method: sudo — Will hang if graham needs sudo password and -K not provided.	bootstrap.yml:71-81
27	mail.mcintire.me and git.mcintire.me use bare ansible_host=mail/ansible_host=git — DNS resolution depends on control node's search domain.	hosts:24,51
28	Variable naming inconsistency — Some templates use flat names (nameservers), some use nested (network.nameservers).	resolv.conf.j2 vs group_vars/all/all.yml

---

🟡 Best Practice / Lint Violations

All items in this section have been fixed.

---

🟡 Dead Code & Stale Files

All items in this section have been fixed.

---

🟢 Previously Fixed

#	Issue	Fix
4	Hardcoded Forgejo runner token in host_vars	Deleted with forgejo cleanup
7	setup-user.sh doesn't exist	Removed broken Makefile target
11	community.mysql.mysql_db module not found	Added community.mysql to requirements.yml and installed
45	5 .DS_Store files tracked by git	git rm --cached
46	.vscode/settings.json tracked despite gitignore	git rm --cached
47	.ansible/ directory not in .gitignore	Added to .gitignore
48	Stale CLAUDE.md (references general.yml, missing roles, wrong commands)	Rewritten with accurate playbooks, roles, collections, commands
49	Stale README.md (wrong directory tree, incomplete groups)	Rewritten with accurate structure and inventory groups
29	Non-FQCN module references (~290 instances)	Converted all to FQCNs across all roles and playbooks
30	Unquoted octal mode values (9 instances)	All quoted with single quotes
31	become: yes / gather_facts: no	Changed to become: true / gather_facts: false
32	inject_facts_as_vars deprecated	Removed from ansible.cfg
33	Missing task names on import_tasks/include_role	Added descriptive names
34	partial-become bug in librenms	Added become: yes
35	risky-shell-pipe without pipefail	Added set -o pipefail
36	Minimal .ansible-lint config	Set profile: production, added exclude paths, empty skip_list
37	Unreferenced icinga2-container/ and debug/ roles	Deleted
38	Unreferenced mailcow/ and syncthing/ roles	Deleted
39	geerlingguy.docker and geerlingguy.kubernetes never used	Removed from requirements.yml
40	graylog2.graylog and bertvv.bind never used	Deleted roles/requirements.yml
41	collections/requirements.yml redundant	Merged into root file, deleted
42	Stale fact_cache files (56 files)	Deleted all
43	home_cluster and dns_servers groups never targeted	Removed from hosts
12-15	Undefined template variables (ntpserver, template_run_date, deb_mirror, sshd.*)	Added `
--	Alpine role reference to non-existent role	Removed from roles/base/tasks/main.yml
--	SSH -t flag after hostname in Makefile	Moved before hostname

---

Recommended Top 2 Fixes

1. Rotate all 4 plaintext secrets in .envrc and move to ansible-vault
2. Add geerlingguy.postgresql to requirements.yml — will crash otherwise