This repository contains Ansible playbooks for a personal Raspberry Pi K3s homelab. It is public for documentation and reuse; treat inventory and network details as non-sensitive but not an invitation to scan.
If you find a security issue in these playbooks or documentation (for example a secret that should not be public, or a dangerous default):
- Open a private security advisory if available, or
- Email the repository owner via the address on their GitHub profile.
Please do not open a public issue for leaked credentials.
- Ansible Vault ciphertext may appear in
group_vars/; the vault password is not in the repository (~/.ansible/vault-pass-pi-clusteron the operator workstation). - Application secrets for Flux-managed apps are out of band (see docs/GITOPS.md).
- Do not open PRs that add kubeconfigs, tokens, or unvaulted credentials.
Pull requests and pushes to main run YAML lint, ansible-lint, actionlint, and
gitleaks (see .github/workflows/lint.yml). GitHub secret scanning and push
protection are enabled on the remote.