From 6eedfb73444602c493e827f75e934c90666724b9 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Thu, 30 Jul 2026 12:15:43 -0500
Subject: [PATCH] feat(playbooks): add hello world and setup new system
 playbooks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add two playbooks:

- hello_world.yml: AWX smoke test that asserts Debian-family OS and
  reports facts. Use this as the first Job Template to confirm AWX
  can reach hosts, become root, and gather facts.

- setup_new_system.yml: Full host provisioning playbook that mirrors
  the function call order of SetupNewSystem.sh. Each role is gated by
  a run_* feature toggle so the same template can do partial runs.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
---
 playbooks/hello_world.yml      | 33 +++++++++++++
 playbooks/setup_new_system.yml | 89 ++++++++++++++++++++++++++++++++++
 2 files changed, 122 insertions(+)
 create mode 100644 playbooks/hello_world.yml
 create mode 100644 playbooks/setup_new_system.yml

diff --git a/playbooks/hello_world.yml b/playbooks/hello_world.yml
new file mode 100644
index 0000000..277645b
--- /dev/null
+++ b/playbooks/hello_world.yml
@@ -0,0 +1,33 @@
+---
+# AWX "hello world" smoke-test playbook.
+#
+# Point an AWX Project at this repo, then create a Job Template whose
+# playbook is playbooks/hello_world.yml and run it against any inventory.
+# A passing run confirms AWX can: clone the repo, parse the playbook,
+# reach the target over SSH, become root, and report facts.
+
+- name: AWX connectivity smoke test
+  hosts: all
+  gather_facts: true
+  become: true
+
+  tasks:
+    - name: Confirm reachable and privileged
+      ansible.builtin.assert:
+        that:
+          - ansible_facts.os_family == "Debian"
+        fail_msg: >-
+          KNELIAC only manages Debian-family hosts (Debian/Ubuntu/Kali/RPi OS);
+          found OS family "{{ ansible_facts.os_family }}".
+        success_msg: "Host {{ inventory_hostname }} is Debian-family ({{ ansible_facts.distribution }} {{ ansible_facts.distribution_version }})."
+
+    - name: Report management target
+      ansible.builtin.debug:
+        msg: >-
+          AWX successfully managed {{ inventory_hostname }}
+          ({{ ansible_facts.distribution }} {{ ansible_facts.distribution_version }},
+          kernel {{ ansible_facts.kernel }}, arch {{ ansible_facts.architecture }}).
+
+    - name: Show where full provisioning runs from
+      ansible.builtin.debug:
+        msg: "Run playbooks/setup_new_system.yml for the full host build."
diff --git a/playbooks/setup_new_system.yml b/playbooks/setup_new_system.yml
new file mode 100644
index 0000000..697fc07
--- /dev/null
+++ b/playbooks/setup_new_system.yml
@@ -0,0 +1,89 @@
+---
+# Full host provisioning — Ansible port of PFVCluster/provisioning/SetupNewSystem.sh
+#
+# The role order below matches the function call order at the bottom of the
+# legacy bash script:
+#
+#   PreflightCheck            -> roles/preflight
+#   global-oam                -> roles/oam
+#   global-installPackages    -> roles/packages
+#   global-systemServiceConfigurationFiles -> roles/system_config (phase 1)
+#   global-postPackageConfiguration         -> roles/system_config (phase 2)
+#   secharden-ssh             -> roles/security_ssh
+#   secharden-wazuh           -> roles/security_wazuh
+#   secharden-scap-stig       -> roles/security_scap_stig
+#   secharden-2fa             -> roles/security_2fa
+#
+# Each role is gated by a feature toggle (see group_vars/all.yml) so the same
+# Job Template can be reused for partial runs.
+
+- name: Preflight — verify we may provision this host
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: preflight
+
+- name: OAM — LibreNMS / check_mk agent
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: oam
+      when: run_oam | bool
+
+- name: Packages — up2date, install fleet toolset, remove unwanted packages
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: packages
+      when: run_packages | bool
+
+- name: System configuration — service config files + post-package tuning
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: system_config
+      when: run_system_config | bool
+
+- name: Security hardening — SSH
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_ssh
+      when: run_security_ssh | bool
+
+- name: Security hardening — Wazuh agent
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_wazuh
+      when: run_security_wazuh | bool
+
+- name: Security hardening — SCAP/STIG baseline
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_scap_stig
+      when: run_security_scap_stig | bool
+
+- name: Security hardening — two-factor authentication
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_2fa
+      when: run_security_2fa | bool
+
+- name: Security hardening — auditd / journald / logrotate
+  hosts: all
+  gather_facts: true
+  become: true
+  roles:
+    - role: security_audit
+      when: run_security_audit | bool