Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
2026-09-09 16:47:20 +00:00
commit 88a02ababa
418 changed files with 50579 additions and 0 deletions
@@ -0,0 +1,44 @@
+---
+# OIDC auth via Authelia — human login (bao login -method=oidc / UI).
+# The Authelia 'openbao' client must already exist (authelia/values.yaml).
+
+- name: Assert the OIDC client secret is provided
+  ansible.builtin.assert:
+    that:
+      - openbao_oidc_client_secret | length > 0
+    fail_msg: "Set vault_openbao_oidc_client_secret (plaintext of the Authelia openbao client)."
+
+- name: Enable the OIDC auth method
+  ansible.builtin.command: "bao auth enable -path=oidc oidc"
+  environment: "{{ openbao_cli_env }}"
+  register: oidc_enable
+  changed_when: oidc_enable.rc == 0
+  failed_when:
+    - oidc_enable.rc != 0
+    - "'already in use' not in (oidc_enable.stderr | default('')) + (oidc_enable.stdout | default(''))"
+  no_log: "{{ openbao_no_log }}"
+  # Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
+  when: not openbao_config_managed_by_terraform | bool
+
+- name: Configure the OIDC provider (Authelia)
+  ansible.builtin.command: >-
+    bao write auth/oidc/config
+    oidc_discovery_url={{ openbao_oidc_discovery_url }}
+    oidc_client_id={{ openbao_oidc_client_id }}
+    oidc_client_secret={{ openbao_oidc_client_secret }}
+    default_role={{ openbao_oidc_default_role }}
+  environment: "{{ openbao_cli_env }}"
+  register: oidc_config
+  changed_when: oidc_config.rc == 0
+  no_log: true    # carries the client secret — always hidden
+
+- name: Create/update the admin OIDC role (restricted to the admin AD group)
+  ansible.builtin.command: "bao write auth/oidc/role/{{ openbao_oidc_default_role }} -"
+  args:
+    stdin: "{{ lookup('template', 'oidc-admin-role.json.j2') }}"
+  environment: "{{ openbao_cli_env }}"
+  register: oidc_role
+  changed_when: oidc_role.rc == 0
+  no_log: "{{ openbao_no_log }}"
+  # Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
+  when: not openbao_config_managed_by_terraform | bool