fix(staging): run the journald-cap check in the post-deploy validation pass

jfraeys commented

2026-10-13 17:50:20 -04:00

Owner

Staging run #596 (the push for the journald-cap merge, #127) failed: 'Verify the systemd journal is capped' failed on staging-web and staging-services. Cause: playbooks/validate-hardening.yml's first pass validates the freshly provisioned nodes BEFORE web.yml/services.yml apply the hardening role, so /etc/systemd/journald.conf.d/50-size-cap.conf does not exist yet. My check from #127 was ungated; Molecule passed because it applies the role first, and the staging ordering only showed up after the merge.

Both copies of the check are gated like the auditd and Docker daemon.json checks: when: validate_post_deploy | default(false) | bool or not inventory_hostname is search('staging') (the same expression already on those tasks). The second pass (staging.sh, -e validate_post_deploy=true, after both playbooks) now checks it.
Header comment updated. yamllint and ansible-lint clean.
Not run end to end: the fix is only proven by the next staging run. Merging this touches playbooks/**, so it starts that run, which also gives main its missing green validation (promote was skipped for #596, so the promotion PR is still validated at an older commit).

🤖 Generated with Claude Code

Staging run #596 (the push for the journald-cap merge, #127) failed: 'Verify the systemd journal is capped' failed on staging-web and staging-services. Cause: playbooks/validate-hardening.yml's first pass validates the freshly provisioned nodes BEFORE web.yml/services.yml apply the hardening role, so /etc/systemd/journald.conf.d/50-size-cap.conf does not exist yet. My check from #127 was ungated; Molecule passed because it applies the role first, and the staging ordering only showed up after the merge. - Both copies of the check are gated like the auditd and Docker daemon.json checks: when: validate_post_deploy | default(false) | bool or not inventory_hostname is search('staging') (the same expression already on those tasks). The second pass (staging.sh, -e validate_post_deploy=true, after both playbooks) now checks it. - Header comment updated. yamllint and ansible-lint clean. - Not run end to end: the fix is only proven by the next staging run. Merging this touches playbooks/**, so it starts that run, which also gives main its missing green validation (promote was skipped for #596, so the promotion PR is still validated at an older commit). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-13 17:50:21 -04:00

fix(staging): the journald-cap check belongs to the post-deploy validation pass

Lint / lint (pull_request) Successful in 1m49s

Details

Secret scan / scan (pull_request) Successful in 14s

Details

ac0a511cca

The first validate-hardening pass runs before web.yml/services.yml apply the hardening role, so the drop-in does not exist yet and
the check failed both staging nodes (run #596 after the journald-cap merge). Gate it like the auditd and Docker checks.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys referenced this pull request

2026-10-13 17:50:49 -04:00

Next: immediate steps (merge, deploy, verify) after the 2026-10-13 session #116

~~jfraeys referenced this pull request 2026-10-13 17:50:49 -04:00~~

Roadmap: remaining infra and secrets work (tracker) #122

jfraeys merged commit bbc85650c0 into main

2026-10-13 17:53:44 -04:00

jfraeys referenced this pull request from a commit

2026-10-13 17:53:47 -04:00

Merge pull request 'fix(staging): run the journald-cap check in the post-deploy validation pass' (#134) from jfraeys/fix/journald-check-post-deploy into main

jfraeys referenced this pull request

2026-10-13 17:54:35 -04:00