From 26ea3388cd1dd522fcac716ad0bec6793e31b104 Mon Sep 17 00:00:00 2001
From: Jordan Del Pilar <jordan@delpilar.net>
Date: Fri, 12 Jun 2026 17:10:55 -0700
Subject: [PATCH 1/2] chore: Update Runner token

---
 host_vars/new-bark.yaml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/host_vars/new-bark.yaml b/host_vars/new-bark.yaml
index b84e1e8..9d9c865 100644
--- a/host_vars/new-bark.yaml
+++ b/host_vars/new-bark.yaml
@@ -36,9 +36,9 @@ runner_services:
     gitea_url: https://git.delpilar.net
     runner_token: !vault |
           $ANSIBLE_VAULT;1.1;AES256
-          35303036303665376330616430373733363066333332323362623237373262383230316431346338
-          3862636465623436343062316662666531623562353164650a313434633865656634366136643430
-          37653263636535656561613663363165313332323164313365306433363036333437373333316632
-          6563356532323964660a626531303962626236363961356639623263373030663462623235393366
-          36343736663063313933306465626634383863366538343930386335353762663866623535636465
-          3461386532333061323435363366653633613035386363633162
+          35633638333533656334616237666165663262616538653833633065633066633437336563633766
+          3865643937383633363665633438616361363666386335300a663437643763323933613638653037
+          63623535353236306262316561623037613064346264393435653931396562613335663163353265
+          3631366361653166310a616432386638613461623332383062336566613131353433303337366633
+          37663263626532656630646332303532653165653835666362656263616162356137316465336332
+          3934303430626561306166393262646139646234333364656237
-- 
2.54.0


From b98c3ee77c9a0c9b38699b13b586c32ad737738b Mon Sep 17 00:00:00 2001
From: Jordan Del Pilar <jordan@delpilar.net>
Date: Sat, 13 Jun 2026 16:35:16 -0700
Subject: [PATCH 2/2] feat: Add CI/CD Workflow

---
 .gitea/workflows/ansible-cicd.yaml | 55 ++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 .gitea/workflows/ansible-cicd.yaml

diff --git a/.gitea/workflows/ansible-cicd.yaml b/.gitea/workflows/ansible-cicd.yaml
new file mode 100644
index 0000000..4086163
--- /dev/null
+++ b/.gitea/workflows/ansible-cicd.yaml
@@ -0,0 +1,55 @@
+name: Johto Infrastructure Pipeline
+
+on:
+  push:
+    branches:
+      - '**'
+
+jobs:
+  lint:
+    name: Run Ansible Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Install Ansible and Lint
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ansible ansible-lint
+
+      - name: Inject Vault Password
+        run: echo "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" > .vault-pass.txt
+
+      - name: Lint Playbooks
+        run: ansible-lint site.yaml
+
+  deploy:
+    name: Deploy to Production
+    runs-on: ubuntu-latest
+    needs: lint
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Install Ansible
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ansible
+
+      - name: Inject SSH Key for Ansible
+        uses: webfactory/ssh-agent@v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.ANSIBLE_SSH_KEY }}
+
+      - name: Add Headscale IPs to Known Hosts
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan 100.64.0.1 100.64.0.2 >> ~/.ssh/known_hosts
+
+      - name: Inject Vault Password
+        run: echo "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" > .vault-pass.txt
+
+      - name: Run Ansible Playbook
+        run: ansible-playbook site.yaml
-- 
2.54.0