All Linode creates fire simultaneously via async/poll:0 loop instead of
serial include_tasks. One shared root pass + SSH key generated before
the loop eliminates per-node credential races. async_status collects
all create confirmations before add_host. Play 2 runs with strategy:free
and -f 50 so all nodes configure, scan, and collect results concurrently.
Per-node serial provision file retired — logic is now inline.
create_extra_vars callers pass {**config} copies so linode_token never
landed in the original config dict. Pull provider credentials from the
environment (already set by set_provider_environment) so the temp-file
secret path works regardless of how config was constructed.
Passes linode_token and other secrets to Ansible through a 0o600 temp
file (@tmpfile) rather than the main --extra-vars JSON blob. Fixes
undefined variable errors for provision tasks that reference linode_token
as an Ansible variable, while keeping secrets out of process listings.
Temp file is removed in finally block regardless of outcome.
Also fixes absolute path for node_chunks_file and other logs-relative
paths so Ansible lookup('file', ...) resolves correctly from any
playbook directory.
deployment_engine.py fallback for missing linode_token now calls
creds get LINODE_TOKEN homelab at runtime instead of loading from
providers/Linode/vars.yaml. Token has been moved to Infisical.
- providers/webrunner.yml: wrap loop_var under loop_control in all three
provider provision tasks — Ansible was rejecting loop_var as a conflicting
action statement alongside include_tasks
- deployment_engine.py: strip _SECRET_KEYS (tokens, passwords, api keys)
from create_extra_vars() — credentials are already set as env vars by
set_provider_environment(), no need to pass them through --extra-vars
where they end up in process listings and logs
- deployment_engine.py: remove debug log line that dumped the full
ansible-playbook command including all extra-vars JSON with live creds
- deployment_engine.py: create deployment log files with 0o600 permissions
instead of world-readable 0o644
- deploy_webrunner.py: remove load_vars_file() call that was pulling
phishing module creds (SMTP password, gophish port, domain) into the
webrunner config dict — all provider creds already collected by
gather_provider_config()
- deploy_webrunner.py: remove unused select_provider import
- .gitignore: narrow 'deployment*' glob to specific artifact patterns so
deployment_engine.py is no longer excluded from tracking
n0mad1k