[anfimovdm]

Moves the Pulp deployment here from pulp-deploy, so all ALBS deployment code lives in one place.

Changes

• Role pulp copied as-is from pulp-deploy (only git-tracked files): Docker Compose or Podman/Quadlet orchestration, optional custom image with vendored pulpcore patches (export.py, datarepair.py), OpenTelemetry collector, journald retention, TLS provisioning.
• Playbook playbooks/pulp.yml (adds become: true, which pulp-deploy set globally in its ansible.cfg).
• Inventory inventories/pulp with dev, staging and prod groups under pulp_all. Hosts are placeholders; group_vars copied from pulp-deploy.
• The original prod DB-fields encryption key and token keypair are committed Ansible Vault encrypted as roles/pulp/files/*.vault; group_vars/prod.yml points at them.
• .gitignore: vault password files, secrets/, plaintext keys/certs in roles/pulp/files/, local prod inventories (inventories/pulp/prod_hosts.*), sign_vars.yml, Python/OS caches.
• README section with run commands and where secrets go.

Testing

• ansible-inventory -i inventories/pulp resolves the group tree and prod group_vars.
• Scanned all new files for private keys and tokens; all .vault files have the $ANSIBLE_VAULT header; no plaintext key/PEM exists in any commit of the repo.
• --check run against prod was started; it stopped on the missing key files, which led to the vault-encrypted keys above.

Notes

• No Resolves/Fixes issue link yet, so the commit-message check will fail until one is added.
• Prod still needs pulp_postgres_password and pulp_secret_key from a vault (e.g. -e @secrets/prod.yml).

🤖 Generated with Claude Code