sjat/boma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
boma/roles/docker_host/README.md
sjat 03d33f83dd fix(O1): scaffold docker_host role so make lint passes on main 
playbooks/site.yml imports the docker_host role, but it didn't exist, so
ansible-lint's syntax-check failed on a clean checkout — breaking CLAUDE.md's
"main must always work" / "Never skip lint" (top open finding O1 from the
2026-06-11 review).

Scaffold docker_host as a proper placeholder via the prescribed mechanism
(make new-role): filled meta/main.yml + README, an honest no-task tasks/main.yml
documenting planned scope (Docker engine + Compose, daemon hardening, nftables.d
container rules per ADR-004/020), and the standard molecule scenario. This
preserves site.yml's full-standard-state intent rather than dropping the play.

Update STATUS.md (docker_host moves from "Not in git" to "scaffolded, no tasks")
and the role/playbook READMEs to match.

make lint: 0 failures, 0 warnings; check-tags OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-11 14:53:55 +02:00

1.2 KiB
Raw Blame History

docker_host

Docker engine + Compose runtime applied to every host in the docker_hosts group. Provides the container platform that the per-service roles (one service = one role, ADR-004) deploy their Compose stacks onto.

Status: scaffolded, not yet implemented. This role has no tasks yet — applying it is a no-op. It is wired into playbooks/site.yml so the full standard state is expressed end-to-end, and so make lint covers it. See STATUS.md.

Planned scope

  • Install Docker engine + the Compose plugin, version-pinned (ADR-011).
  • Daemon hardening: iptables: false (the host base firewall owns nftables, ADR-020), log driver, live-restore, user-namespace remapping where practical (ADR-002).
  • Render container forward/NAT rules into /etc/nftables.d/*.nft — the include hook the base role's ruleset exposes (see roles/base/README.md).
  • Provide the runtime the service roles deploy their Compose files onto.

Variables

None yet. Placeholders will use the docker_host__* namespace (CLAUDE.md convention).

Example

- hosts: docker_hosts
  become: true
  roles:
    - role: docker_host
      tags: [docker_host]

See ADR-004 (docs/decisions/004-docker-model.md) for the Docker & Compose model.