9 docs tagged with "infrastructure-as-code"

Decision record for automating NetBox device type imports from netbox-community/devicetype-library for TheBurrow home lab hardware.

Decision record for selecting Ansible Vault + 1Password as the authoritative secrets store for TheBurrow home lab infrastructure.

Deploying Caddy as a reverse proxy on fablehaven to terminate TLS for Pi-hole admin UIs across the three-node cluster, using Step-CA certs and internal DNS.

The Ansible vault password was available to PR-controlled workflow code, creating a path for any contributor to exfiltrate the credential that unlocks every secret in TheBurrow.

Building IoT network isolation on TheBurrow — VLAN 94 design, Kea DHCP subnet activation, OPNsense firewall rules, DNS enforcement NAT redirects, and migrating 31 devices via CSV import.

A compound failure across three bugs left Pi-hole VRRP failover silently broken for weeks — no keepalived on mistborn, wrong VIP ownership, and Kea serving raw IPs instead of VIPs.

Step-CA failed to initialize after vault_edit.py wrote a Python dict string representation instead of valid JSON for the JWK encryptedKey field in ca.json, breaking CA initialization fleet-wide.

Deploying Step-CA as a systemd service on fablehaven, configuring a JWK provisioner, and issuing TLS certificates fleet-wide via Ansible roles.

During the Ansible vault restructure into per-service files, changes were committed directly to main, bypassing all CI gates and violating the branch protection governance workflow.