Add shared setup wizard integration to deploy-core

.github/workflows/ci.yml

@@ -30,12 +30,29 @@ jobs:
       - name: Scaffold local config
         run: ./scripts/init-local-config.sh
 
+      - name: Create CI vault password placeholder
+        run: |
+          umask 177
+          printf 'ci-test-only\n' > .vault_pass
+
       - name: Install collections
         run: ./scripts/install-collections.sh
 
       - name: Syntax check preflight
         run: ansible-playbook --syntax-check -i inventories/prod/hosts.yml playbooks/preflight.yml
 
+      - name: Smoke test preflight placeholder validation
+        run: bash tests/smoke/test_preflight_placeholder_scan.sh
+
+      - name: Smoke test Tailscale tag validation
+        run: bash tests/smoke/test_preflight_tailscale_tag_validation.sh
+
+      - name: Smoke test builder restic target normalization
+        run: bash tests/smoke/test_builder_restic_target_name_normalization.sh
+
+      - name: Smoke test restic target name preflight validation
+        run: bash tests/smoke/test_preflight_restic_target_name_validation.sh
+
       - name: Syntax check bootstrap
         run: ansible-playbook --syntax-check -i inventories/prod/hosts.yml playbooks/bootstrap.yml
 

.gitignore

@@ -1,11 +1,30 @@
-reports/
+# Standard Ansible/operator-local ignores.
+
+# Ansible runtime artifacts
 .ansible/
-dist/
 *.retry
+
+# Python cache from helper scripts or wizard support modules
+__pycache__/
+*.py[cod]
+
+# Local packaging output
+build/
+dist/
+
+# Operator-local vault password helpers
+.vault_pass
 .vault_pass*
 vault-pass*
 *.vault-password*
+
+# Generated reports
+reports/
+
+# Real inventory values stay local; example files are versioned.
 inventories/prod/hosts.yml
-inventories/prod/group_vars/all.yml
-inventories/prod/group_vars/core_hosts.yml
-inventories/prod/group_vars/vault.yml
+inventories/prod/group_vars/all/main.yml
+inventories/prod/group_vars/all/vault.yml
+inventories/prod/group_vars/core_hosts/main.yml
+inventories/prod/*.bak-*
+inventories/prod/group_vars/**/*.bak-*

README.md

@@ -6,7 +6,7 @@ This repo is the environment-facing deployment layer:
 
 - consume the shared `crownops.deploy_base` collection for fresh-host bootstrap
 - consume the shared `crownops.deploy_base` collection for staged post-join SSH lockdown
-- consume the shared `crownops.deploy_services` collection for reusable service stacks and host backup automation
+- consume the shared `crownops.deploy_services` collection for reusable service stacks and composable host backup automation
 - keep inventory, deployment flow, and feature wiring separate from the reusable collections
 - let features such as Obsidian be enabled, disabled, or replaced without rewriting the base deployment path
 
@@ -19,12 +19,15 @@ This repo should stay thin:
 
 Configuration model:
 
-- `inventories/prod/group_vars/all.yml` is the primary non-secret configuration surface
-- `inventories/prod/group_vars/vault.yml` holds secret values only
+- `inventories/prod/group_vars/all/main.yml` is the primary non-secret configuration surface
+- `inventories/prod/group_vars/all/vault.yml` holds secret values only
+- `.vault_pass` is the repo-local default Ansible Vault password file; keep it local, `0600`, and untracked
+- backup policy is expressed as `restic_targets`, `restic_backup_jobs`, and `restic_backup_contributions`
 
 Read first:
 
 - `docs/QUICKSTART.md`
+- `docs/CONFIG_WIZARD_SPEC.md`
 - `docs/IMPLEMENTATION_STATUS.md`
 - `docs/DEPLOYMENT_SEQUENCE.md`
 - `docs/SECRETS_MODEL.md`
@@ -33,12 +36,17 @@ Read first:
 
 ## Preflight
 
-Run preflight before any bootstrap or deploy action:
+Use the guided setup flow first. It owns configuration, vault handling, collection install, preflight, bootstrap, site deploy, backup setup, and optional SSH lockdown in one explicit stage sequence:
 
 ```bash
-./scripts/init-local-config.sh
-./scripts/install-collections.sh
-ansible-playbook -i inventories/prod/hosts.yml playbooks/preflight.yml
+./scripts/setup.sh
+```
+
+When you need the lower-level runners directly:
+
+```bash
+./scripts/deploy.sh --skip-bootstrap --skip-site --skip-backup
+./scripts/ssh-lockdown.sh --phase1-only
 ```
 
 Behavior:
@@ -51,12 +59,21 @@ Public repo hygiene:
 
 - tracked files end in `.example`
 - real local inventory and vars stay untracked
-- `scripts/init-local-config.sh` creates the local working files from examples
+- `ansible.cfg` points Ansible at `.vault_pass` by default; the wizard can create that file for you and the lower-level runners will use it automatically when present
+- `scripts/setup.sh` is the primary interactive operator entrypoint
+- `scripts/deploy.sh` is the lower-level deployment runner for explicit phase execution
+- `scripts/ssh-lockdown.sh` is the lower-level staged SSH hardening runner
+- on a first run, `scripts/setup.sh` can generate or reuse a managed Ed25519 Ansible key under `~/.ssh/ansible-config-wizard/`, write `ansible_ssh_private_key_file` into local inventory, and either install that key automatically with a one-shot password prompt or pause with exact commands and resume guidance
+- for Linux SFTP backup destinations you control, the wizard can prepare the backup prerequisite script and still keep the main setup flow inside `scripts/setup.sh`
+- when you already have a backup transport key, point the wizard at the local private key file instead of pasting the key into the terminal
+- the Obsidian feature supports two access modes: `public_https` for Traefik + ACME on `443`, and `private_mesh` for VPN or mesh-only reachability without public ingress; preflight rejects a public `5984` firewall rule in `private_mesh`
+- the shared wizard implementation lives outside this repo; this repo only carries the profile, templates, and builder hook
+- `scripts/init-local-config.sh` remains available as a simple scaffold-from-examples fallback
 
 Quality controls:
 
 - GitHub Actions CI scaffolds example local config, installs collections from GitHub, and syntax-checks the site playbooks
-- staged lockdown uses explicit enable and confirm gates plus break-glass support, so a casual deploy run does not remove public SSH
+- staged lockdown uses explicit validation-only and `--confirm` paths plus break-glass support, so a casual deploy run does not remove public SSH
 
 Use this before:
 

ansible.cfg

@@ -9,8 +9,12 @@ stdout_callback = default
 result_format = yaml
 gathering = smart
 forks = 10
+vault_password_file = .vault_pass
 
 [privilege_escalation]
 become = True
 become_method = sudo
 become_ask_pass = False
+
+[ssh_connection]
+pipelining = True

docs/ARCHITECTURE.md

@@ -28,6 +28,14 @@ Current feature set:
 
 `playbooks/backup.yml` uses the `crownops.deploy_services.restic_host_backups` role.
 
+That backup layer is modeled as:
+
+- targets: backup destinations and transport credentials
+- jobs: logical host backup policies with schedule and retention
+- contributions: feature-specific paths and consistency hooks merged into named jobs
+- converge-time performance policy: no fact gathering for the dedicated backup play, SSH pipelining enabled in the repo Ansible config, and package cache reuse controlled through `restic_apt_cache_valid_time`
+- restore-first scope policy: back up durable state such as host identity, local markdown workspaces, CouchDB data, and Traefik ACME state, not broad service roots that can be rebuilt from Ansible
+
 `playbooks/lockdown.yml` consumes the reusable `crownops.deploy_base.network_lockdown` role so SSH lockdown policy stays consistent across site repos.
 
 This keeps the site repo thin while still allowing features to evolve independently.