[thiras]

What

decdn.node and decdn.publisher now ship the playbooks this repo deploys with, and their playbooks/group_vars/. Someone who installs them from Galaxy needs only an inventory: ansible-playbook -i inventory/hosts.yml decdn.publisher.site does what make deploy does, firewall holes, placement checks and lifecycle guards included. Until now the collections shipped roles only, so every consumer had to rebuild that glue by hand.

How

• What ships. galaxy/<collection>/playbooks.txt lists each collection's playbooks.
  • decdn.node: node.yml, plus node-only backup.yml/decommission.yml in galaxy/node/playbooks/. make test-scripts keeps those equal to the fleet-wide node plays, in both directions.
  • decdn.publisher: every playbook, its own node.yml included. A run never imports across collections, so it never mixes two releases' group_vars/.
• The glue ships unchanged. A collection playbook loads the group_vars/ beside it, with the same precedence as in this repo. I confirmed that in ansible-core's source and with a probe run as a collection playbook.
• Role names. galaxy/stage-playbooks.py (stdlib, called by build.sh) rewrites role references to FQCNs at staging only. The repo's playbooks stay unqualified, so an installed collection can never stand in for roles/ on a deploy. It refuses any role-reference form it cannot qualify, checks each tasks_from exists, and refuses an import_playbook that doesn't ship. That check matters because --syntax-check does not resolve include_role.
• Backup location. decdn_backup_local_dir / sponsord_backup_local_dir used to put a collection run's fetched backups inside the installed collection, where an upgrade would delete them. From a collection playbook they now go to backups/ beside the project's ansible.cfg, or the run fails loudly if there is no project ansible.cfg. Repo runs are unchanged.
• Release. release.sh counts the shipped playbooks, group_vars/ and stage-playbooks.py in each collection's changelog. decdn.publisher now depends on decdn.node >=0.2.0.
• Example. examples/collection-fleet/ is a consumer project skeleton: requirements.yml, ansible.cfg and .gitignore.
• Docs. I updated the collection READMEs, ansible/README.md, AGENTS.md, RELEASING.md, CONTRIBUTING.md and the operator front doors.

Tests

• make galaxy-check-<collection> now also runs galaxy/check-playbooks.sh. It installs the tarball, syntax-checks every shipped playbook by FQCN, and runs the firewall-holes check against the installed collection.
• New molecule scenario collection. It builds and installs decdn.node, then runs decdn.node.node → .backup → .decommission with an empty roles path. It checks where the fetched backup lands and what decommission removes.
• make test-scripts covers:
  • staging on both collections, and that it changes only role names;
  • every refusal, each checked by its message;
  • quoted and ansible.legacy names;
  • the node lifecycle copies;
  • the shared backup default;
  • the new release paths.
• Also run locally, all passing:
  • make test-scripts, make galaxy-check, make lint, make lint-ansible, make security-ansible
  • make molecule SCENARIOS='collection lifecycle'
  • check-playbooks.sh and the backup default on ansible-core 2.15.13, the collections' floor
  • decdn.publisher.site --list-tasks from the example project matches playbooks/site.yml --list-tasks exactly, apart from FQCN prefixes

Notes

• galaxy-importer still warns that it can't resolve the playbooks' roles. Its embedded ansible-lint checks the collection outside any collections path. The import succeeds, and check-playbooks.sh does that check properly.
• The >=0.2.0 floors assume this is released as node-collection-v0.2.0, then publisher-collection-v0.2.0. Release node first, because release.sh refuses the publisher release until a node tag satisfies the floor.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The packaging, release integration, lifecycle behavior, and consumer workflow are comprehensively validated.

0 open findings

What changed in this PR

Ships deployment playbooks and shared variables in both Galaxy collections, enabling inventory-only fleet deployment.

Changes:

• Adds playbook staging with FQCN role rewriting and validation.
• Adds consumer-level checks, Molecule coverage, and release tracking.
• Documents collection usage and provides a starter fleet project.

File	Description
tests/​scripts-test.sh	Tests staging, lifecycle copies, and release paths.
scripts/​release.sh	Tracks shipped playbooks in releases.
RELEASING.md	Documents release scope.
README.md	Advertises collection playbooks.
Makefile	Clarifies Galaxy validation.
examples/​collection-fleet/​requirements.yml	Defines collection dependencies.
examples/​collection-fleet/​README.md	Documents fleet setup.
examples/​collection-fleet/​ansible.cfg	Configures collection-based runs.
examples/​collection-fleet/​.gitignore	Excludes secrets, backups, and installations.
docs/​publishers.md	Documents publisher playbooks.
docs/​node-operators.md	Documents node playbooks.
CONTRIBUTING.md	Describes expanded checks.
ansible/​tests/​firewall-holes/​check.sh	Supports installed-collection validation.
ansible/​roles/​sponsord/​defaults/​main.yml	Relocates collection-run backups safely.
ansible/​roles/​decdn_node/​defaults/​main.yml	Relocates collection-run backups safely.
ansible/​README.md	Documents collection packaging and usage.
ansible/​playbooks/​sponsord.yml	Updates collection-related commentary.
ansible/​playbooks/​origin.yml	Updates collection-related commentary.
ansible/​playbooks/​node.yml	Documents collection invocation.
ansible/​playbooks/​iroh_relay.yml	Updates collection-related commentary.
ansible/​playbooks/​iroh_dns_server.yml	Updates collection-related commentary.
ansible/​playbooks/​decommission.yml	Documents collection lifecycle usage.
ansible/​playbooks/​backup.yml	Documents collection backup usage.
ansible/​molecule/​collection/​verify.yml	Verifies backup and decommission results.
ansible/​molecule/​collection/​prepare.yml	Builds and installs the node collection.
ansible/​molecule/​collection/​molecule.yml	Defines collection consumer testing.
ansible/​molecule/​collection/​converge.yml	Exercises shipped playbooks by FQCN.
ansible/​Makefile	Integrates consumer-level checks.
ansible/​galaxy/​stage-playbooks.py	Stages and validates collection playbooks.
ansible/​galaxy/​publisher/​README.md	Documents publisher playbooks.
ansible/​galaxy/​publisher/​playbooks.txt	Lists publisher playbooks.
ansible/​galaxy/​publisher/​galaxy.yml	Raises the node dependency floor.
ansible/​galaxy/​node/​README.md	Documents node playbooks.
ansible/​galaxy/​node/​playbooks/​decommission.yml	Adds node-only decommissioning.
ansible/​galaxy/​node/​playbooks/​backup.yml	Adds node-only backup.
ansible/​galaxy/​node/​playbooks.txt	Lists node playbooks.
ansible/​galaxy/​node/​galaxy.yml	Updates packaging commentary.
ansible/​galaxy/​check-playbooks.sh	Validates installed playbooks and variables.
ansible/​galaxy/​build.sh	Adds playbook staging to collection builds.
ansible/​.ansible-lint	Excludes runtime-only collection convergence.
AGENTS.md	Records the new packaging conventions.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.