Replace remote git checkouts on target web nodes with an orchestrated
local staging and rsync deployment pipeline.
Recent OpenSSH updates in Fedora dropped agent forwarding into remote
sessions, breaking remote git fetch operations. Furthermore, pulling
directly from Git on production servers exposed .git repositories in
public webroots and required target servers to hold Git credentials.
- Create an ephemeral, unguessable local staging directory (0700) on
localhost via ansible.builtin.tempfile scoped by inventory_hostname.
- Stage checkouts using repo hash prefixes to prevent collision when
public and private servers share identical FQDNs.
- Execute shallow checkouts (depth: 1) on the control node using local
credentials.
- Push website content to /srv/http/{fqdn}/ via ansible.posix.synchronize
with checksum delta comparisons and automated cleanup (--delete).
- Introduce ensure_apache_rsync_excludes in role defaults to strip
.git*, .env*, CI/CD pipelines (.gitea, .github), editor swap files,
and OS metadata while preserving .htaccess and /.well-known/.
- Enforce httpd_sys_content_t SELinux context recursively across webroots.
- Guarantee staging directory cleanup on localhost via an always block.
jmrothst