thesabearandClaude Sonnet 5 c6266c0081 iac-pipeline.md: full 7-step audit ...

- Replaced both mermaid diagrams with real Nextcloud diagrams; the
  Ansible-stages rebuild caught a real omission - the old diagram showed
  only 2 stages (init/compliance) when there are genuinely 3
  (provisioning.yml exists too, currently just clamav/rocky-docker)
- Live-verified against the real iac repo: roles_metadata.yml (9
  cis_hardening + 6 other compliance roles, 1 provisioning role),
  kickstart partitioning/packages/SSH config, both Packer bootstrap
  scripts, terraform.tfvars, pct list on both hypervisors, a real
  rendered host_tags.yml
- KB fix: LXC Strategy note's PBS row was wrong, not just stale - PBS
  genuinely has a populated vm_tags list and live compliance roles
  (confirmed via real artifacts on the host itself), not 'never
  Ansible-managed' as it said; corrected and re-verified via re-fetch
- Added real content not previously in the doc: the deliberately
  permissive build-time SSH window closed by ssh_hardening, the
  admin/ansible identity split baked into the image at build time, and a
  third pipeline exception (PBS) that's genuinely different in kind from
  the other two, including a real Rocky-vs-Debian PAM ordering bug found
  onboarding it
- Considered two screenshot candidates (Proxmox template list, VM/LXC
  mix) - declined as low-value; command evidence covers this
  source-driven topic well on its own
- Sanitize-checked: no internal IPs/MACs/domains/personal info/forbidden
  app names

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 5 <[email protected]>

2026-08-29 08:21:38 +03:00

125 KiB

Raw Blame History