chore: prepare repo for public release as the official deCDN Ansible - #20
Conversation
De-brand docs and re-add automated node test coverage so this repo can be
published as the official Ansible for deploying a deCDN node.
- Docs: drop the private-workspace framing (the /home/thiras path, "team's
monorepo", "workspace CLAUDE.md") from README/AGENTS/CONTRIBUTING/ansible
READMEs; point cross-refs at AGENTS.md and the dead legacy `services/`/
`etc/`-mirror convention is removed.
- Genericize private sibling-repo references: `decdn/adr/` and
`decdn/contracts/deployments/<chainId>.json` become prose ("the deCDN ADRs /
contract deployment") with no dead links; public Arbitrum Sepolia testnet
contract addresses stay.
- Document the binary-source dependency: release installs need a publicly
reachable `v<version>` release; override `decdn_node_release_base` or use the
`manual` install method otherwise.
- Add a `decdn_node` molecule scenario (converge/idempotence/verify in a
privileged systemd container against a stub daemon), re-add the `molecule.yml`
workflow and `make molecule` targets, and note it in the Testing/CI docs.
- CI: reword the KICS SARIF comment to drop the private-repo assumption.
- .gitignore: ignore Python bytecode (molecule stub / local tooling).
Verified: yamllint + ansible-lint (production), site.yml syntax-check,
make build + galaxy-importer, molecule test (exit 0), KICS (0 HIGH), actionlint.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 30 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughChangesMolecule validation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Molecule
participant Docker
participant Ansible
participant decdn_node
GitHubActions->>Molecule: run molecule test for ansible/** changes
Molecule->>Docker: create privileged systemd container
Molecule->>Ansible: converge and verify scenario
Ansible->>decdn_node: apply role with manual stub binaries
decdn_node->>Docker: render configuration and start service
Ansible->>decdn_node: validate files, service state, and loopback metrics
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces containerized testing for the decdn_node Ansible role using Molecule and Docker, adding a Python-based stub daemon and playbooks to verify host preparation, configuration rendering, and systemd unit hardening. It also updates documentation to reflect these testing capabilities and replaces references to CLAUDE.md with AGENTS.md. The review feedback highlights three potential playbook crashes in the verify.yml assertions where properties of potentially undefined variables are accessed; the reviewer recommends combining these checks using and to leverage Jinja's short-circuit evaluation and ensure custom failure messages are correctly displayed.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
There was a problem hiding this comment.
Pull request overview
Prepares the decdn/devops repository for a public release as the official Ansible-based deployment project for running a deCDN node, primarily by de-internalizing documentation and restoring automated role verification via Molecule.
Changes:
- Rewrites repository and Ansible documentation to remove private workspace framing and replace private cross-repo references with neutral prose.
- Reintroduces automated test coverage for
decdn_nodevia a new Molecule scenario (stub daemon + systemd container) and adds a dedicated GitHub Actions workflow to run it. - Adds
make moleculetargets and small repo hygiene updates (e.g., Python bytecode ignores, CI comment wording).
Reviewed changes
Copilot reviewed 17 out of 18 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Updates repo positioning for public release; documents CI gates including Molecule. |
| Makefile | Adds a root molecule convenience target delegating to ansible/. |
| CONTRIBUTING.md | Updates references to AGENTS.md and documents the Molecule workflow. |
| ansible/roles/decdn_node/tasks/main.yml | Adjusts validation error messaging to remove private repo path references. |
| ansible/roles/decdn_node/README.md | Documents decdn_node_release_base and clarifies public reachability requirements. |
| ansible/roles/baseline/README.md | Updates wording from “team” to “operator” for public-facing docs. |
| ansible/README.md | Updates onboarding docs and adds detailed explanation of Molecule-based verification. |
| ansible/molecule/default/verify.yml | Adds Molecule verification assertions (user, TOML validity, unit validity, loopback metrics, permissions, service state). |
| ansible/molecule/default/prepare.yml | Stages placeholder keystore/password files so the role’s keystore gate can pass in CI. |
| ansible/molecule/default/molecule.yml | Defines the Docker/systemd-based Molecule scenario for decdn_node. |
| ansible/molecule/default/files/decdn-node-stub | Adds a Python stub “node” binary for containerized verification without real releases/chain. |
| ansible/molecule/default/converge.yml | Converges decdn_node in manual-install mode using the stub binary and placeholder chain inputs. |
| ansible/Makefile | Adds an ansible/-local molecule target to run the scenario. |
| ansible/inventory/host_vars/decdn-node-1/main.yml | Rewords contract-address provenance comments to avoid private repo paths while keeping on-chain facts. |
| AGENTS.md | Rewrites agent guidance to be public-repo focused and adds Molecule guidance. |
| .gitignore | Ignores Python bytecode artifacts (e.g., from the Molecule stub). |
| .github/workflows/molecule.yml | Adds a new workflow to run molecule test on ansible/** changes. |
| .github/workflows/ci.yml | Rewords KICS SARIF comment to remove “private repo” assumptions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address bot review feedback on PR #20: - verify.yml: combine each guard+deref pair into a single `and` expression (user/nologin, file exists+mode, service membership+state). Ansible templates each `that:` item independently — the separate guard lines did not protect the later derefs, so an absent user/file/service raised AnsibleUndefinedVariable and bypassed the fail_msg. One expression restores short-circuiting and the intended clean failure message. (Gemini Code Assist) - molecule.yml: pin the geerlingguy/docker-debian12-ansible base image by digest instead of :latest, matching the repo's SHA/digest-pinning convention for reproducible CI. (Copilot) Declined Copilot's PyPI-pinning suggestion: ci.yml installs its Python tooling unpinned with --upgrade in every job; pinning only molecule.yml would be the lone inconsistent workflow. Reproducibility of the systemd/docker layer is covered by the pinned base image above. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
One CI issue to address: this workflow is intended to become a required check, but the workflow-level Please make the workflow run for every PR and gate the expensive Molecule job using a lightweight changed-files job with a successful no-op path, or avoid making |
…kstop Address the multi-agent PR review findings: verify.yml - Assert node.toml *content* (region, metrics_bind, chain_id, the three contract addresses), not just that it parses. The prior tomllib-load check passed on any valid TOML — a role regression rendering metrics_bind=0.0.0.0 or dropping an address would not be caught. Content is asserted via a staged script (no shell quoting hazards). - Assert the keystore + password file are 0600. prepare.yml now stages them at 0644, so the assertion attributes the lock-down to the role, not to prepare. - Assert the hardened unit carries its load-bearing directives (NoNewPrivileges, ProtectSystem=strict, RestrictAddressFamilies, SystemCallFilter, User) — systemd-analyze only checks syntax. - Reject all non-loopback wildcard forms on :9090 ([::], *), not just 0.0.0.0. converge.yml - Set decdn_node_version to match the stub's --version so the install-time version-match backstop is actually exercised instead of degrading to a bare liveness check. files/decdn-node-stub - Serve 200 only on /metrics (404 elsewhere) so readiness tests the real path. - Only `run` serves; unknown invocations exit non-zero (fail loud). Guard the bind with a legible stderr error instead of a bare traceback. molecule.yml / ansible/README.md - Correct the baseline-skip rationale: this scenario connects over the Docker driver (docker exec, not SSH), so ssh_hardening would not "sever the connection". baseline is skipped because its host-level hardening (nftables default-deny, DevSec os/ssh hardening, fail2ban) isn't meaningful in a throwaway container. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
What & why
Prepares
decdn/devopsto be published as the official public Ansible for deploying a deCDN node. The internal anvil devnet was already removed (commit5bbce04), so this focuses on the remaining public-readiness gaps: scrubbing private-workspace framing, genericizing references to the still-private sibling repos, and re-adding automated test coverage for the node role (the only molecule scenario had been deleted with anvil).Changes
De-brand docs
/home/thiras/dev/decdn/workspace path (the one hard personal leak) and "deCDN team's monorepo / workspaceCLAUDE.md" framing acrossREADME.md,AGENTS.md,CONTRIBUTING.md, and theansible/READMEs.AGENTS.mdto describe only the public Ansible project; drop the dead legacyservices//etc/-mirror convention.Genericize private cross-repo references
decdn/adr/…anddecdn/contracts/deployments/<chainId>.json(both in the still-privatedecdn/decdn) become prose — "the deCDN ADRs / contract deployment" — with no dead links. Public Arbitrum Sepolia testnet contract addresses stay (public on-chain facts).Document the binary-source dependency
releaseinstalls need a publicly reachablev<version>release;decdn_node_release_baseis overridable andmanualinstall is the no-release escape hatch.Re-add node test coverage
ansible/molecule/default/scenario: convergesdecdn_nodein a privileged systemd container against a stub daemon (manualinstall → no private release needed), stages a placeholder keystore, and asserts the node user, valid TOML, a valid hardened unit, loopback-only metrics,0600env file, and a running service.molecule.ymlworkflow andmake moleculetargets; note in Testing/CI docs.Misc
.gitignore: ignore Python bytecode (molecule stub / local tooling).Verification
site.yml --syntax-checkmake build+ galaxy-importermolecule test(node scenario)Note
The node binary is still fetched from
github.com/decdn/decdn/releases(private) and ADRs live in the privatedecdn/decdn. Per the agreed approach the sourcing is kept and only the docs are genericized — external users can't fully deploy until that release/those assets are public (or they overridedecdn_node_release_base). The docs now state this.🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
make moleculecommand for running the scenario locally.Documentation
Chores