boma/roles
sjat b006196cc5 fix(base): confirm firewall apply over a FRESH connection
established/related keeps the in-flight session alive across the swap, so the
prior 'next task runs' confirm always passed even if new connections were
bricked — the rollback was theater. reset_connection + wait_for_connection now
force a fresh handshake through the new ruleset; failure aborts the play and the
armed timer reverts. (meta: reset_connection ignores 'when' — benign extra
reconnect on no-op runs; verified idempotent in molecule.)
2026-06-06 19:06:39 +02:00
..
base fix(base): confirm firewall apply over a FRESH connection 2026-06-06 19:06:39 +02:00
README.md Reconcile CI to trunk-based; mark base/docker_host not-built (R6-R8,R15-R16) 2026-05-30 19:32:37 +02:00

roles/

Local Ansible roles. No Galaxy roles — every role is written and maintained here (ADR-003). Scaffold new ones with make new-role NAME=<name>; never create the directory structure by hand.

Each role must have: a molecule/default/ scenario (Debian 13), a populated README.md, and a filled-in meta/main.yml. Conventions: CLAUDE.md and docs/runbooks/new-role.md.

Current state: base and docker_host are not built yet — they exist only as empty, untracked dirs, so site.yml would fail on a clean clone. Build them with make new-role when defining the baseline. See STATUS.md.