Replace remote git checkouts on target web nodes with an orchestrated
local staging and rsync deployment pipeline.
Recent OpenSSH updates in Fedora dropped agent forwarding into remote
sessions, breaking remote git fetch operations. Furthermore, pulling
directly from Git on production servers exposed .git repositories in
public webroots and required target servers to hold Git credentials.
- Create an ephemeral, unguessable local staging directory (0700) on
localhost via ansible.builtin.tempfile scoped by inventory_hostname.
- Stage checkouts using repo hash prefixes to prevent collision when
public and private servers share identical FQDNs.
- Execute shallow checkouts (depth: 1) on the control node using local
credentials.
- Push website content to /srv/http/{fqdn}/ via ansible.posix.synchronize
with checksum delta comparisons and automated cleanup (--delete).
- Introduce ensure_apache_rsync_excludes in role defaults to strip
.git*, .env*, CI/CD pipelines (.gitea, .github), editor swap files,
and OS metadata while preserving .htaccess and /.well-known/.
- Enforce httpd_sys_content_t SELinux context recursively across webroots.
- Guarantee staging directory cleanup on localhost via an always block.
Eliminate post-verification discovery and assert tasks (service_facts
and package_facts) across all 19 roles and align AGENTS.md.
Ansible's built-in declarative modules (package, service) already enforce
target state natively and abort execution immediately on failure. The
subsequent assertion loops were redundant, added significant runtime
overhead, and produced false positives on non-service systemd units
(.socket, .timer) and service aliases (e.g., dbus.socket failing under
service_facts).
- Remove service_facts and Assert Managed Services Are Active across
11 service roles (ensure_apache, ensure_cockpit, ensure_dbus,
ensure_dovecot, ensure_fail2ban, ensure_firewalld, ensure_gitea,
ensure_mariadb, ensure_podman, ensure_postfix, ensure_timezone).
- Remove package_facts and Assert Managed Packages Are Installed across
8 package roles (ensure_ansible_prereq, ensure_git, ensure_os_patch,
ensure_os_upgrade, ensure_repo_epel, ensure_repo_rpmfusion,
ensure_rsync, ensure_vim).
- Update AGENTS.md Section 8.2, Section 10, and Section 21 to codify
declarative state enforcement and prohibit redundant post-task
assertion loops.
jmrothst