feat(ansible): make per-node host_vars config committable, isolate rpc_url secret

[thiras]

What

Template-repo fix: forkers can now keep their per-node config in git while the one secret stays out.

• Split host_vars/<node>.yml into a directory: committed main.yml (non-secret config — contract addresses, region, cache origin, version, economics) + git-ignored secret.yml (decdn_rpc_url only) + committed secret.yml.example. Uses Ansible's native host_vars/<host>/ directory merge — no ansible.cfg change.
• Un-ignore hosts.yml so a fork can track its own inventory (host IPs are topology, not secrets).
• Narrow ansible/.gitignore to ignore only inventory/host_vars/*/secret.yml.
• Docs/comments updated to the new model (root + ansible/README.md, role README + defaults, group_vars, hosts.yml.example, CI comment); fixed parallel "ships *.example only" claims in AGENTS.md, CONTRIBUTING.md, root .gitignore (also drops dead bin/*.sh references).

Why

decdn_rpc_url (may embed an API key) was the only reason the whole per-node file was git-ignored — the decdn_node role already isolates it (0600 env file, no_log, kept out of the --check-diffable node.toml). This extends that "rpc_url is the lone secret" split up into the source vars so a forker's config is committable.

Verification

• ansible-inventory --host decdn-node-1 resolves both main.yml + secret.yml vars into one set.
• git check-ignore: real secret.yml ignored (does not surface in git status); main.yml + secret.yml.example tracked.
• yamllint + ansible-lint (production profile, 0 failures) + markdownlint (0 errors) clean.
• Molecule, the galaxy collection build, and CI syntax-check are structurally unaffected.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation

  • Clarified setup and deployment instructions for per-node configuration.
  • Documented the separation between committed non-secret settings and local secret values.
  • Expanded security guidance for on-host secret rendering, restricted permissions, and ignored files.
  • Updated examples and role documentation to reflect the current configuration layout.

• Configuration

  • Added guidance for storing each node’s RPC URL in a local secret file.
  • Narrowed ignored files while keeping secret templates available for version control.

[coderabbitai]

Warning

Review limit reached

@thiras, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 67e7cb00-47a7-4fd3-8794-4e8ad8d76ed7

📥 Commits

Reviewing files that changed from the base of the PR and between 7c54630 and 1ffaf60.

📒 Files selected for processing (1)

• ansible/.gitignore

📝 Walkthrough

Walkthrough

The changes document a per-node Ansible configuration split: committed non-secret values remain in main.yml, while decdn_rpc_url moves to a git-ignored secret.yml. Repository ignore rules, setup instructions, role documentation, and security guidance are updated accordingly.

Changes

Per-node secret configuration policy

Layer / File(s)	Summary
Repository secret-handling guidance .gitignore, AGENTS.md, CONTRIBUTING.md, README.md, .github/workflows/ci.yml	Repository guidance now distinguishes secret templates and generated files from directly committed non-secret configuration, and clarifies the dummy inventory used for Ansible syntax checks.
Per-node inventory secret split ansible/.gitignore, ansible/inventory/group_vars/*, ansible/inventory/host_vars/decdn-node-1/*, ansible/inventory/hosts.yml.example	Inventory rules and templates place committed node settings in main.yml and the sensitive decdn_rpc_url in git-ignored secret.yml.
Deployment and role documentation ansible/README.md, ansible/roles/decdn_node/README.md, ansible/roles/decdn_node/defaults/main.yml	Deployment and role guidance describes copying per-node secret templates, configuring RPC credentials separately, and locating the remaining node values in main.yml.

Estimated code review effort: 2 (Simple) | ~10 minutes

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request restructures Ansible configuration and secret management by committing non-secret per-node configurations (such as main.yml) and the hosts.yml inventory, while isolating the sensitive decdn_rpc_url into a git-ignored secret.yml file. Documentation and templates have been updated accordingly. The review feedback correctly points out a security risk where using the .yaml extension instead of .yml for secrets would bypass .gitignore, and suggests keeping hosts.yml ignored by default to prevent accidental leaks of real host IPs to the upstream repository.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Copilot]

Pull request overview

This PR updates the DevOps monorepo’s Ansible inventory layout to make per-node configuration committable while isolating the single sensitive value (decdn_rpc_url) into a git-ignored file, and aligns repo documentation/ignore rules with that model.

Changes:

• Split per-node host_vars into host_vars/<node>/main.yml (committed) + host_vars/<node>/secret.yml (git-ignored) with a committed secret.yml.example.
• Narrow ansible/.gitignore to ignore only inventory/host_vars/*/secret.yml and allow forks to commit their inventory/hosts.yml if desired.
• Update README/docs/comments and CI commentary to match the new inventory/vars model and clarify what is/waswo isn’t committed.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Updates quickstart to create/edit per-node secret.yml alongside committed main.yml.
CONTRIBUTING.md	Clarifies that only secret templates are shipped; non-secret config can be committed.
ansible/roles/decdn_node/README.md	Updates variable location guidance to host_vars/<node>/ with secret.yml for decdn_rpc_url.
ansible/roles/decdn_node/defaults/main.yml	Updates defaults header comments to the new main.yml + secret.yml split.
ansible/README.md	Updates setup and configuration docs to reflect the committable main.yml and ignored secret.yml.
ansible/inventory/hosts.yml.example	Updates inventory template commentary to reflect hosts.yml no longer being force-ignored.
ansible/inventory/host_vars/decdn-node-1/secret.yml.example	Adds the per-node secret template for decdn_rpc_url.
ansible/inventory/host_vars/decdn-node-1/main.yml	Removes decdn_rpc_url from committed vars and documents that it lives in secret.yml.
ansible/inventory/group_vars/decdn_nodes.yml	Updates group vars comments to reflect the new per-node var split.
ansible/.gitignore	Narrows ignore patterns to only per-node secret.yml and un-ignores hosts.yml.
AGENTS.md	Updates agent guidance to clarify that only secret templates are shipped.
.gitignore	Updates top-level commentary to reflect that non-secret config may be committed.
.github/workflows/ci.yml	Adjusts CI comments about inventory assumptions for syntax-check.

Comments suppressed due to low confidence (1)

ansible/inventory/host_vars/decdn-node-1/main.yml:11

• This comment references decdn/contracts/deployments/421614.json, but that file doesn’t exist in this repository (the only references are in this file). If the intent is to point to a different repository/workspace source-of-truth, it’d be clearer to say so explicitly (or provide a link) so forkers can verify where these “canonical” addresses came from.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.