Add CONTRIBUTING.md explaining the linting setup and how to mark the
repo's intentional dummy credentials so gitleaks does not flag them:
inline `# gitleaks:allow` for lint-clean, comment-capable files, and a
.gitleaksignore baseline otherwise.
Annotate the dummy credentials in four already-lint-clean example files
inline, as the preferred convention going forward.
- DIUN/docker-compose.yaml
- Headscale/Tailscale-Client/docker-compose,yaml
- Homepage/Homepage/services.yaml
- Kubernetes/Traefik-PiHole/Helm/Traefik/Dashboard/secret-dashboard.yaml
Add a GitHub Actions workflow that runs the project's pre-commit hooks
against the files changed in each PR, plus a gitleaks secret scan over
the PR's commits. Both block on findings.
Enrich the existing .pre-commit-config.yaml with general hygiene checks
and four linters (shellcheck, yamllint, actionlint, gitleaks), add a
lenient yamllint config tuned for the repo's existing YAML, and add a
gitleaks config that keeps the full default ruleset while baselining the
repo's pre-existing intentional dummy credentials.
Linting is scoped to changed files, so the checks pass on the current
tree and only hold new or edited files to standard.
- .github/workflows/lint.yml: pull_request workflow, read-only token,
two jobs (pre-commit on changed files + gitleaks on the commit range)
- .pre-commit-config.yaml: keep existing hooks; add hygiene checks,
shellcheck (--severity=warning), yamllint, actionlint, gitleaks
- .yamllint.yaml: lenient ruleset
- .gitleaks.toml: default rules + allowlist for .env/example placeholders
- .gitleaksignore: baseline of pre-existing intentional dummy credentials
* Fix RKE2 MetalLB L2Advertisement to honor custom lb_pool_name (#135)
The apply-manifests role rendered the IPAddressPool from a template using
lb_pool_name, but applied the L2Advertisement from a hardcoded remote file
where the pool name was baked in as 'first-pool'. Setting lb_pool_name to
anything else left the L2Advertisement pointing at a non-existent pool, so
MetalLB assigned LoadBalancer IPs but never advertised them (services got an
external IP but were unreachable).
Template the L2Advertisement locally from lb_pool_name, mirroring the
IPAddressPool pattern, so both manifests always reference the same pool.
* Add explicit become: true to apply-manifests kubectl tasks
These tasks set become_user without a task-level become, tripping
ansible-lint's partial-become rule. become is already enabled globally via
ansible_become in group_vars/all.yaml, so the tasks already escalate to the
ansible user — but that is invisible to the linter (and to anyone reading the
task in isolation). Make it explicit with become: true alongside become_user.
Behavior-neutral: verified with ansible-playbook -vvv that the escalation
target is unchanged (sudo -u ansible; chown ansible on the temp files), so
kubectl still runs as the ansible user that owns ~/.kube/config.
