Initial commit: itential.valkey collection

.ansible-lint

@@ -0,0 +1,13 @@
+---
+# .ansible-lint
+
+# Exclude these files from the linter
+exclude_paths:
+  - .git*
+
+# Rules that we feel should not be errors but warnings
+warn_list:
+  - yaml[line-length]
+  - var-naming[no-role-prefix]
+  - meta-runtime[unsupported-version]
+  - run-once[task]

.github/workflows/ansible-lint.yml

@@ -0,0 +1,18 @@
+# .github/workflows/ansible-lint.yml
+name: ansible-lint
+on:
+  push:
+    branches: ["main", "dev"]
+  pull_request:
+    branches: ["main", "dev"]
+jobs:
+  build:
+    name: Ansible Lint # Naming the build is important to use it as a status check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run ansible-lint
+        uses: ansible/ansible-lint@v25.1.3 # or version tag instead of 'main'
+        with:
+          args: "--exclude .ansible"
+          requirements_file: "requirements.yml"

.github/workflows/publish_ansible_collection.yml

@@ -0,0 +1,64 @@
+name: Publish Ansible Galaxy Collection
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  publish-collection:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo content
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ssh-key: ${{ secrets.DEPLOY_PRIVATE_KEY }}
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.8
+
+      - name: Install Ansible
+        run: pip install ansible
+
+      - name: Determine Ansible Galaxy version
+        run: echo "GALAXY_VERSION=$(echo ${{ github.ref_name }} | cut -c2-)" >> $GITHUB_ENV
+
+      - name: Update Ansible Galaxy version
+        run: |
+          git config user.name github-actions
+          git config user.email github-actions@github.com
+          git checkout main
+          echo "Updating version to ${{ env.GALAXY_VERSION }} in galaxy.yml"
+          sed -i 's/\(version:\) .*/\1 ${{ env.GALAXY_VERSION }}/g' galaxy.yml
+          git add galaxy.yml
+
+      - name: Update changelog
+        run: |
+          python scripts/changelog.py > CHANGELOG.md
+          git add CHANGELOG.md
+
+      - name: Commit changes
+        run: |
+          git commit -m "Update galaxy version and changelog for release ${{ env.GALAXY_VERSION }} [skip ci]"
+          git push origin HEAD:main
+
+      - name: Update release tag
+        run: |
+          git pull
+          git tag -f ${{ github.ref_name }}
+          git push origin HEAD:main
+          git push origin -f ${{ github.ref_name }}
+
+      - name: Build Ansible collection
+        run: ansible-galaxy collection build
+
+      - name: Determine Ansible collection archive name
+        run: echo "ARTIFACT=itential-valkey-${{ env.GALAXY_VERSION }}.tar.gz" >> $GITHUB_ENV
+
+      - name: Publish collection to Ansible Galaxy
+        env:
+          ANSIBLE_API_TOKEN: ${{ secrets.ANSIBLE_API_TOKEN }}
+        run: ansible-galaxy collection publish ${{ env.ARTIFACT }} --token $ANSIBLE_API_TOKEN

.github/workflows/role-readme-check.yml

@@ -0,0 +1,27 @@
+# .github/workflows/role-readme-check.yml
+#
+# Ansible Galaxy requires every role to have its own README. This job fails the build
+# (blocking merge to dev) if any directory under roles/ is missing one.
+name: role-readme-check
+on:
+  push:
+    branches: ["dev"]
+  pull_request:
+    branches: ["dev"]
+jobs:
+  check-role-readmes:
+    name: Role READMEs # Naming the build is important to use it as a status check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Verify every role has a README
+        run: |
+          missing=0
+          for dir in roles/*/; do
+            role=$(basename "$dir")
+            if ! ls "$dir" 2>/dev/null | grep -qi '^readme'; then
+              echo "::error::Role '$role' is missing a README (required by Ansible Galaxy)"
+              missing=1
+            fi
+          done
+          exit "$missing"

.gitignore

@@ -0,0 +1,18 @@
+cspell.json
+.ansible/*
+.claude/*
+.vscode/*
+.DS_Store
+**.DS_Store
+**/ansible.cfg
+**/*.bin
+**/*.whl
+**/*.tgz
+**/*.gz
+**/*.pem
+**/*.log
+**/*.keep
+inventories/*
+inventories
+certificates/*
+__pycache__

.yamllint

@@ -0,0 +1,6 @@
+---
+rules:
+  line-length:
+    max: 100
+    allow-non-breakable-words: true
+    allow-non-breakable-inline-mappings: false

CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## 1.0.0
+
+Initial release. Adds the `valkey` role and its playbooks (`valkey.yml`, `verify.yml`,
+`certify.yml`, `download_packages.yml`) as a Remi-free, EL9/Amazon Linux 2023-only
+alternative to `itential.deployer`'s `redis` role.

CLAUDE.md

@@ -0,0 +1,59 @@
+# itential.valkey — Ansible Collection
+
+## Overview
+
+`itential.valkey` is a standalone Ansible collection (namespace `itential`, name `valkey`)
+that installs and configures Valkey as an alternative to `itential.deployer`'s `redis` role.
+
+**This collection is transitional.** It exists separately from `itential.deployer` only until
+`roles/redis` is retired there. At that point, `roles/valkey` and its playbooks are intended to
+be merged directly into `itential.deployer`, and this repository archived. See
+`roles/valkey/CLAUDE.md`'s "Collection Context" section for exactly what reverts at merge time.
+
+## Collection Metadata
+
+| Field | Value |
+|-------|-------|
+| Namespace | `itential` |
+| Name | `valkey` |
+| Version | `1.0.0` |
+| Depends on | `itential.deployer` `>=4.0.0` |
+
+## Playbook Inventory
+
+| Playbook | FQCN | Description |
+|----------|------|-------------|
+| `valkey.yml` | `itential.valkey.valkey` | Install Valkey on `valkey_master`/`valkey_replica`; Sentinel on `valkey_sentinel` hosts |
+| `verify.yml` | `itential.valkey.verify` | Pre-install verification for Valkey hosts |
+| `certify.yml` | `itential.valkey.certify` | Generate Valkey/Sentinel installation certification reports |
+| `download_packages.yml` | `itential.valkey.download_packages` | Download Valkey packages for offline install |
+
+## Roles Summary
+
+| Role | Purpose |
+|------|---------|
+| `valkey` | Installs and configures Valkey (via the native OS package repositories only — EL9 AppStream or Amazon Linux 2023's core repo) and Valkey Sentinel: auth, TLS, replication. No source install, no Remi, no EL8 support, no relocatable install paths, no role-level SELinux step (handled entirely by the base OS policy). See `roles/valkey/CLAUDE.md` for full detail. |
+
+## Cross-Collection Dependency
+
+`roles/valkey`'s tasks call two shared utility roles that live in `itential.deployer`, by FQCN:
+
+- `itential.deployer.common` (used in `verify-valkey.yml`, `verify-sentinel.yml`)
+- `itential.deployer.offline` (used in `download-packages.yml`, `install-from-repo.yml`)
+
+Both collections must be installed together for this to work — see `README.md`'s
+Installation section. This is declared in `galaxy.yml`'s `dependencies`.
+
+## Docs Index
+
+| File | Contents |
+|------|----------|
+| `docs/valkey_guide.md` | Valkey role variables, Sentinel, TLS, EL9/Amazon Linux 2023 native package install |
+
+## CI
+
+| Workflow | Trigger | Purpose |
+|----------|---------|---------|
+| `ansible-lint.yml` | push/PR to `main`, `dev` | Lint validation |
+| `role-readme-check.yml` | push/PR to `dev` | Fails the build if any `roles/*/` directory is missing a README (Ansible Galaxy requirement) |
+| `publish_ansible_collection.yml` | GitHub release or manual | Bumps `galaxy.yml`'s version, regenerates `CHANGELOG.md`, and publishes to Galaxy (no separate changelog workflow -- that step lives here) |

CODE_OF_CONDUCT.md

@@ -0,0 +1,70 @@
+# Code of Conduct - Itential Deployer
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to make participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, or to ban
+temporarily or permanently any contributor for other behaviors that they deem
+inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at <>.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://contributor-covenant.org/), version
+[1.4](https://www.contributor-covenant.org/version/1/4/code-of-conduct/code_of_conduct.md) and
+[2.0](https://www.contributor-covenant.org/version/2/0/code_of_conduct/code_of_conduct.md),
+and was generated by [contributing-gen](https://github.com/bttger/contributing-gen).