sjat
9b3f8f826f
Converge enables mesh with base__mesh_manage:false (+ dummy key) so the include path runs hermetically; verify asserts netbird is not installed — proving the concern is a clean no-op when the live actions are gated off. Existing firewall/ ssh/fail2ban assertions unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
28 lines
817 B
YAML
28 lines
817 B
YAML
---
|
|
- name: Converge
|
|
hosts: all
|
|
become: true
|
|
gather_facts: true
|
|
vars:
|
|
base__firewall_apply: false
|
|
base__firewall_control_addr: 10.10.0.99 # test control-node LAN address
|
|
# Exercise the mesh concern's include path with the live actions gated off, so it
|
|
# runs hermetically (no coordinator/key needed) and must be a clean no-op.
|
|
base__mesh_enabled: true
|
|
base__mesh_manage: false
|
|
base__mesh_setup_key: "dummy-molecule-key"
|
|
firewall_zones:
|
|
lan: 10.30.0.0/24
|
|
srv: 10.20.0.0/24
|
|
mgmt: 10.10.0.0/24
|
|
firewall_catalog:
|
|
reverse_proxy:
|
|
host: instance
|
|
ingress:
|
|
- { from: lan, port: 443, proto: tcp }
|
|
photoprism:
|
|
host: instance
|
|
ingress:
|
|
- { from: srv, port: 2342, proto: tcp }
|
|
roles:
|
|
- role: base
|