---
description: >-
  Specific rules and standards for managing the mw-pfeddersheim-workstation
  infrastructure.
tags:
  - workstation
  - rules
  - infrastructure
  - ansible
last_updated: '2026-03-09'
---

# Workstation Infrastructure Rules

## 1. System Changes
- **Preferred Method**: All persistent system changes MUST be implemented via Ansible roles in `ansible/`.
- **Validation**: Before applying Ansible playbooks, always use `--check` mode if possible.
- **Manual Overrides**: Document any manual system changes in `docs/tech/manual-overrides.md`.

## 2. Maintenance Scripts
- **Standard Header**: All bash scripts MUST start with:
  ```bash
  #!/bin/bash
  set -euo pipefail
  ```
- **Logging**: Scripts should log to stdout for systemd integration and to `/var/log/satway/` if they are long-running.

## 3. Configuration Management
- **Template First**: Prefer `.j2` templates for configuration files that contain machine-specific variables.
- **Secrets**: NEVER store raw secrets. Use `ansible-vault` for variables in `ansible/vars/`.

## 4. Documentation (PARA)
- **Product**: System overview, user guides.
- **Tech**: Hardware specs, software versions, network setup.
- **ADR**: Architectural Decision Records for OS choices, partitioning, etc.
- **Learnings**: Incident reports, post-mortems, tips & tricks.