4 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	faa605cead	feat(secrets): webhook URL and git tokens sealed; run output masks its secrets (#5037) ... #5037 "Secrets at rest and in run output: webhook URL and git token encrypted, askpass via env, secret values scrubbed from logs". - webhook.url joins SECRET_KEYS; existing values are sealed at startup by migrate_plaintext_secrets. Settings -> Notifications no longer echoes the URL: it names the saved host, keeps it when left blank, and has a Remove box. - Git source http_token is sealed inside ansible.sources on save and at startup, opened in get_sources, and counted by the undecryptable-secrets scan as ansible.sources[<name>].http_token. - The askpass script holds no token: git runs it with STEWARD_GIT_TOKEN in its environment and printf prints it as data. - The executor masks every secret the run is handed (become/vault passwords, bootstrap passwords, sensitive run vars, and the per-host agent tokens the host_agent plugin now passes as redact) in each line before it is broadcast, logged or stored. - Bundled "Write agent config" tasks are no_log; a test fails if any bundled task templating steward_token lacks it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 11:14:37 -04:00
bvandeusenandClaude Opus 4.8	656bda2e3d	feat(ansible): bundled first-party playbooks + built-in source ... Ships a read-only "steward-builtin" source (steward/ansible/bundled/) that always appears alongside operator-configured sources, with two playbooks: - maintenance/docker_prune.yml — docker system prune for swarm/standalone nodes (safe by default; prune_all_images / prune_volumes extra-vars to widen). Schedule it against a swarm-node group for recurring cleanup (#869). - host_agent/install.yml — installs/updates the host agent (mirrors install.sh: user, agent.py, config, hardened systemd unit), parameterised with steward_url + steward_token extra-vars. get_sources() now prepends the builtin source. Tests updated to find the configured git source by name; added coverage that the bundled playbooks are discoverable. Tasks #869 + agent-install (milestone #37). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-16 11:07:34 -04:00
bvandeusenandClaude Sonnet 4.6	80613d6310	chore(lint): remove unused imports flagged by ruff ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-05 18:55:21 -04:00
bvandeusen	d906232eb2	feat(ansible): GIT_ASKPASS per-source HTTP token auth + settings UI	2026-06-05 18:48:00 -04:00