Cleanup pass: stale references, duplicated helpers, legacy code, root docs #204

New issue

Open

opened 2026-10-15 18:53:51 -04:00 by jfraeys · 1 comment

jfraeys commented

2026-10-15 18:53:51 -04:00

Owner

Copy link

Request (2026-10-15): clean up and update the infra config itself (scripts, Terraform, workflows, setup/infra/manage) and the docs/README; remove duplicated and dead code; add shared libs or wizards where scripts repeat themselves. Not the roles. Findings from a read-only audit; each box is a small PR.

A. Stale references (verified missing paths)

README: playbooks/test_config.yml, playbooks/deploy.yml, roles/forgejo/update-ai-scrapers.sh do not exist
docs/runbooks/resize-node.md points at docs/DEPLOYMENT.md (the file is docs/runbooks/deployment.md)
docs/secrets-inventory.md rows name secrets/infra.sops.yml / vault.example.yml (neither exists; the vault is secrets/vault.sops.yml)
roles/ci_ephemeral_provisioner/defaults/main.yml comment mentions terraform/environments/ovh/ci-staging.tfvars (instance_type d2-4, does not exist; the decided runner size is d2-2): create it at the runner cutover or fix the comment
Re-run the dangling-path scan after each change (34 hits today, most are test fixtures or git-ignored generated files)

B. Duplicated code -> shared libs

scripts/tests/lib.sh: check/bad/expect defined separately in 9 test scripts
scripts/lib/log.sh: log_info/ok/warn/error defined in rotate-secret.sh and rotate-ovh-s3-credentials.sh
say/ask/ask_secret/banner/confirm/finish are copied between ovh-setup-wizard.sh and cloudflare-migration-setup-wizard.sh (MIGRATION-ONLY: delete both after the cutovers instead of refactoring; a scripts/lib/wizard.sh only if a new wizard is written)
confirm also exists in scripts/lib/manage/core.sh

C. Dead / legacy code

Pre-SOPS Ansible Vault branches in scripts/lib/common-vault.sh (9 refs), rotate-secret.sh (6), rotate-ovh-s3-credentials.sh (6), verify-vaultwarden-token.sh (5), with-vault.sh, setup, manage core: removed together with #120 (needs P7 gate test 2, P8 and R closed first)
secrets/backup/ (R decision in #119)
ansible-profile.cfg: only a doc line mentions it; decide keep or delete
Unused Terraform outputs: no unused variables found; the output check needs a manual pass (cheap grep gave false results)

D. Root docs

ROLLBACK.md (305 lines, still --workspace linode) overlaps docs/runbooks/node-failure.md and the failover runbooks: fold into docs/runbooks/ and make it provider-aware at the OVH cutover (#187)
FUTURE_IMPROVEMENTS.md has strikethrough "done" entries: prune
CHANGELOG.md stops at 2026-10-08: keep it current or retire it in favour of the PR history

Related: #153 (operator tooling), #187 (OVH migration), #120 (Ansible Vault retirement).

**Request (2026-10-15):** clean up and update the infra config itself (scripts, Terraform, workflows, `setup`/`infra`/`manage`) and the docs/README; remove duplicated and dead code; add shared libs or wizards where scripts repeat themselves. Not the roles. Findings from a read-only audit; each box is a small PR. **A. Stale references (verified missing paths)** - [ ] README: `playbooks/test_config.yml`, `playbooks/deploy.yml`, `roles/forgejo/update-ai-scrapers.sh` do not exist - [ ] `docs/runbooks/resize-node.md` points at `docs/DEPLOYMENT.md` (the file is `docs/runbooks/deployment.md`) - [ ] `docs/secrets-inventory.md` rows name `secrets/infra.sops.yml` / `vault.example.yml` (neither exists; the vault is `secrets/vault.sops.yml`) - [ ] `roles/ci_ephemeral_provisioner/defaults/main.yml` comment mentions `terraform/environments/ovh/ci-staging.tfvars` (instance_type d2-4, does not exist; the decided runner size is d2-2): create it at the runner cutover or fix the comment - [ ] Re-run the dangling-path scan after each change (34 hits today, most are test fixtures or git-ignored generated files) **B. Duplicated code -> shared libs** - [ ] `scripts/tests/lib.sh`: `check`/`bad`/`expect` defined separately in 9 test scripts - [ ] `scripts/lib/log.sh`: `log_info/ok/warn/error` defined in `rotate-secret.sh` and `rotate-ovh-s3-credentials.sh` - [ ] `say/ask/ask_secret/banner/confirm/finish` are copied between `ovh-setup-wizard.sh` and `cloudflare-migration-setup-wizard.sh` (MIGRATION-ONLY: delete both after the cutovers instead of refactoring; a `scripts/lib/wizard.sh` only if a new wizard is written) - [ ] `confirm` also exists in `scripts/lib/manage/core.sh` **C. Dead / legacy code** - [ ] Pre-SOPS Ansible Vault branches in `scripts/lib/common-vault.sh` (9 refs), `rotate-secret.sh` (6), `rotate-ovh-s3-credentials.sh` (6), `verify-vaultwarden-token.sh` (5), `with-vault.sh`, `setup`, `manage` core: removed together with #120 (needs P7 gate test 2, P8 and R closed first) - [ ] `secrets/backup/` (R decision in #119) - [ ] `ansible-profile.cfg`: only a doc line mentions it; decide keep or delete - [ ] Unused Terraform outputs: no unused variables found; the output check needs a manual pass (cheap grep gave false results) **D. Root docs** - [ ] `ROLLBACK.md` (305 lines, still `--workspace linode`) overlaps `docs/runbooks/node-failure.md` and the failover runbooks: fold into `docs/runbooks/` and make it provider-aware at the OVH cutover (#187) - [ ] `FUTURE_IMPROVEMENTS.md` has strikethrough "done" entries: prune - [ ] `CHANGELOG.md` stops at 2026-10-08: keep it current or retire it in favour of the PR history Related: #153 (operator tooling), #187 (OVH migration), #120 (Ansible Vault retirement).

jfraeys referenced this issue

2026-10-15 18:55:19 -04:00

refactor(infra): move ./infra's logic into scripts/lib/infra, like manage and setup #205