feat: initial infrastructure baseline

.clinerules/workstation.md

@@ -0,0 +1,24 @@
+# Workstation Infrastructure Rules
+
+## 1. System Changes
+- **Preferred Method**: All persistent system changes MUST be implemented via Ansible roles in `ansible/`.
+- **Validation**: Before applying Ansible playbooks, always use `--check` mode if possible.
+- **Manual Overrides**: Document any manual system changes in `docs/tech/manual-overrides.md`.
+
+## 2. Maintenance Scripts
+- **Standard Header**: All bash scripts MUST start with:
+  ```bash
+  #!/bin/bash
+  set -euo pipefail
+  ```
+- **Logging**: Scripts should log to stdout for systemd integration and to `/var/log/satway/` if they are long-running.
+
+## 3. Configuration Management
+- **Template First**: Prefer `.j2` templates for configuration files that contain machine-specific variables.
+- **Secrets**: NEVER store raw secrets. Use `ansible-vault` for variables in `ansible/vars/`.
+
+## 4. Documentation (PARA)
+- **Product**: System overview, user guides.
+- **Tech**: Hardware specs, software versions, network setup.
+- **ADR**: Architectural Decision Records for OS choices, partitioning, etc.
+- **Learnings**: Incident reports, post-mortems, tips & tricks.