Provisioning Pipeline

Provisioning Pipeline

The main workflow that builds and configures the NAS from scratch (or applies incremental changes).

Trigger

on:
  push:
    branches: [main]
    paths-ignore: ['**/*.md']

Runs on every push to main (excluding markdown-only changes).

Strategy

strategy:
  fail-fast: true
  max-parallel: 1
  matrix:
    environment: [test, production]

Deploys sequentially — test first, then production. If test fails, production is skipped (fail-fast: true). This gives a safety net before touching the real NAS.

Workflow Steps

#	Step	Purpose
1	Checkout	Get the code
2	Azure Login	Authenticate to Azure using SPN
3	Get KeyVault Secrets	Pull all secrets, mask them, export as env vars
4	Replace Tokens	Substitute #{TOKEN}# patterns in .yml files with secret values
5	Connect to WireGuard	Establish VPN tunnel to home network
6	Add Routes	Route NAS IP over the WireGuard interface
7	Add SSH Key	Install private key + pinned host fingerprint
8	Configure SSH	Set up multiplexing and keepalives
9	Run Ansible Playbook	Execute provision.yml against the target environment
10	Generate Report	Parse Ansible output into a GitHub job summary

Token Replacement

The workflow uses a Python script (inline in the YAML) to handle token replacement safely. This avoids the regex escaping issues that plague sed-based approaches when secret values contain special characters ($, &, /, etc.):

re.sub(r'#\{([^}]+)\}#', lambda m: os.environ.get(m.group(1), m.group(0)), content)

Deployment Report

After each run, a structured job summary is generated showing:

• Overall result (success/failure)
• Play recap table (OK, Changed, Unreachable, Failed, Skipped per host)

This makes it easy to see at a glance what changed without digging through logs.

Related

• Secrets & Credentials — how secrets flow into the workflow
• Network & Connectivity — WireGuard and SSH details
• Ansible Structure — what the playbook actually does
• Validation Pipeline — PR-level checks before merge

---

Validation Pipeline

A separate workflow runs on all branches except main (i.e. on PRs and feature branches):

Check	Tool	Purpose
Syntax	ansible-playbook --syntax-check	Catches YAML/Ansible syntax errors
Lint	ansible-lint	Enforces best practices and style
SARIF	CodeQL upload	Surfaces issues in the GitHub Security tab

This means broken Ansible never reaches main — you catch issues before merge.

🔗 GitHub Actions docs | Ansible Lint