jfraeys/infra

Watch

Fork 0

fix(molecule): tooling fixes (pinned systemctl, collections in --setup, firewall scenario, Colima socket) #14

Merged

jfraeys merged 6 commits from fix/molecule-tooling into main

2026-10-02 21:35:58 -04:00

jfraeys commented

2026-10-02 21:26:23 -04:00

Owner

Brings fix/molecule-tooling up to date with main and opens it. Five commits:

pin the fake systemctl to a commit with a verified checksum and drop ignore_errors (the unpinned master URL ran as root in the test container; checksum re-verified against the pinned commit)
install Ansible collections in molecule-test.sh --setup (a fresh venv/runner had none)
define traefik_certresolver in the firewall scenario (it errored without it)
detect Colima's ~/.config socket, ahead of ~/.colima
reboot-alert timer: enabled but not started under molecule (state: omit)

Merge with main: two overlaps with today's work (Colima socket, the timer task) were resolved in favor of this branch's versions; molecule-test.sh merged cleanly with the .python-version venv logic.

Tested locally on the merged result: ./scripts/molecule-test.sh --setup, then hardening and firewall scenarios pass (converge, idempotence, verify). Not re-run: docker, crowdsec, forgejo_runner_native scenarios.

🤖 Generated with Claude Code

Brings fix/molecule-tooling up to date with main and opens it. Five commits: - pin the fake systemctl to a commit with a verified checksum and drop ignore_errors (the unpinned master URL ran as root in the test container; checksum re-verified against the pinned commit) - install Ansible collections in molecule-test.sh --setup (a fresh venv/runner had none) - define traefik_certresolver in the firewall scenario (it errored without it) - detect Colima's ~/.config socket, ahead of ~/.colima - reboot-alert timer: enabled but not started under molecule (state: omit) Merge with main: two overlaps with today's work (Colima socket, the timer task) were resolved in favor of this branch's versions; molecule-test.sh merged cleanly with the .python-version venv logic. Tested locally on the merged result: ./scripts/molecule-test.sh --setup, then hardening and firewall scenarios pass (converge, idempotence, verify). Not re-run: docker, crowdsec, forgejo_runner_native scenarios. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 6 commits

2026-10-02 21:26:24 -04:00

fix(scripts): detect Colima's XDG docker socket path 83c2b6d0cf

Newer Colima puts its socket at ~/.config/colima/default/docker.sock, which
config.sh never checked, so DOCKER_HOST stayed unset and Molecule's Python
Docker client failed with FileNotFoundError even though the docker CLI
(which resolves it through its context) worked.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(molecule): install Ansible collections in --setup 85b95615ef

Bare ansible-core ships no collections, and the repo-relative
./ansible/collections in ansible.cfg doesn't resolve when Molecule runs from a
role's directory. The firewall role's first collection module
(community.general.ufw) surfaced this: converge failed with "couldn't resolve
module/action". Install requirements.yml into ~/.ansible/collections.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(molecule): define traefik_certresolver in the firewall scenario d978e70213

The role's firewall_restrict_web_to_cloudflare default derives from it, and
undefined it made the Cloudflare-IP task's `when:` error out. Reproduced on
unmodified main: the firewall scenario already failed at converge before any
UFW change, so the Molecule step in staging-validate.yml could not have
passed for this role.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(hardening): don't start the reboot-alert timer under Molecule 2d193681c8

Molecule's fake systemctl (docker-systemctl-replacement) can't start .timer
units, so the hardening scenario failed at converge on "Enable and start
reboot-required alert timer". Reproduced against an identical roles/hardening
on main, so it already failed there; the timer was added after the scenario
was written. Skip only the start (still enable) when molecule_test is set --
production behavior is unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(molecule): pin the fake systemctl to a commit and verify its checksum 6df66e3c9a

hardening's prepare.yml fetched systemctl3.py from an unpinned master URL, so
an upstream change could break the scenario with no change here, and nothing
verified the file that runs as root in the container. Pin to
gdraheim/docker-systemctl-replacement 15a2509 (v1.7.1311, byte-identical to
master at the time) with its sha256. Also drop ignore_errors, which would
have turned a checksum failure into a confusing converge error later.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge branch 'main' into fix/molecule-tooling

Lint / lint (pull_request) Successful in 1m21s

Details

aabd9e95ec

# Conflicts:
#	roles/hardening/tasks/main.yml
#	scripts/lib/setup/config.sh

jfraeys merged commit c324310a21 into main

2026-10-02 21:35:58 -04:00

jfraeys referenced this pull request from a commit

2026-10-02 21:35:59 -04:00

Merge pull request 'fix(molecule): tooling fixes (pinned systemctl, collections in --setup, firewall scenario, Colima socket)' (#14) from fix/molecule-tooling into main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!14

No description provided.

Rows
Columns