diff --git a/inventory/group_vars/all.yml b/inventory/group_vars/all.yml new file mode 100644 index 0000000..c4f4ab8 --- /dev/null +++ b/inventory/group_vars/all.yml @@ -0,0 +1,202 @@ +--- +# KNELIAC default variables. +# +# These mirror the values hard-coded in the legacy bash +# PFVCluster/provisioning/ scripts. Override any of them in AWX via +# "extra vars" on the Job Template, or per-host in group_vars/host_vars. + +# --------------------------------------------------------------------------- +# Users provisioned on every host. Keys under ssh_authorized_keys must already +# exist in roles/security_ssh/files/authorized_keys/. +# --------------------------------------------------------------------------- +managed_users: + - name: root + home: /root + - name: localuser + home: /home/localuser + - name: subodev + home: /home/subodev + +# --------------------------------------------------------------------------- +# Networking: authoritative recursive DNS + NTP servers (pfv-netinfra-01/02). +# --------------------------------------------------------------------------- +dns_servers: + - 192.168.3.252 + - 192.168.3.253 + +dns_search_domain: knel.net + +ntp_servers: + - 192.168.3.252 + - 192.168.3.253 + +# Hostnames of NTP servers that must NOT get client config are now managed +# via the 'ntp_servers' inventory group (see inventory/hosts.yml). The +# preflight role sets is_ntp_server based on group membership. + +# --------------------------------------------------------------------------- +# Mail (postfix) — local-only relay to the Cloudron smarthost. +# --------------------------------------------------------------------------- +postfix_relayhost: tsys-cloudron.knel.net +postfix_generic_address: tsysrootaccount@knel.net + +# Syslog forward destination (LibreNMS receiver). +syslog_forward_host: tsys-librenms.knel.net + +# --------------------------------------------------------------------------- +# SNMP +# --------------------------------------------------------------------------- +snmp_rocommunity: kn3lmgmt +snmp_syslocation: "R4, Server Room, SITER, Pflugerville, United States" +snmp_syscontact: coo@turnsys.com + +# --------------------------------------------------------------------------- +# Monitoring / security agents +# --------------------------------------------------------------------------- +wazuh_manager: tsys-nsm.knel.net +# Hostnames that must NOT receive the wazuh agent (the wazuh server itself). +# The Wazuh manager server is now managed via the 'wazuh_server' inventory +# group (see inventory/hosts.yml). The preflight role sets is_wazuh_server. +wazuh_server_hostnames_deprecated: [] + +# The LibreNMS server is now managed via the 'librenms_server' inventory +# group (see inventory/hosts.yml). The preflight role sets is_librenms_server. + +# Tailscale (installer only auths the machine; no token stored here). +tailscale_install: true + +# Webmin/Usermin (used for PAM 2FA management). +webmin_setup: true + +# --------------------------------------------------------------------------- +# Packages +# --------------------------------------------------------------------------- +# Packages removed from every host during provisioning. +packages_remove: + - systemd-timesyncd + - chrony + - telnet + - inetutils-telnet + - wpasupplicant + - modemmanager + - nano + - multipath-tools + +# Packages installed on every host during provisioning. +packages_install: + - virt-what + - auditd + - audispd-plugins + - cloud-guest-utils + - aide + - htop + - snmpd + - ncdu + - iftop + - iotop + - cockpit + - cockpit-bridge + - cockpit-doc + - cockpit-networkmanager + - cockpit-packagekit + - cockpit-pcp + - cockpit-sosreport + - cockpit-storaged + - cockpit-system + - cockpit-ws + - nethogs + - sysstat + - ngrep + - acct + - lsb-release + - screen + - tailscale + - tmux + - vim + - command-not-found + - lldpd + - ansible-core + - net-tools + - dos2unix + - gpg + - molly-guard + - lshw + - fzf + - ripgrep + - sudo + - mailutils + - clamav + - logwatch + - git + - tshark + - tcpdump + - lynis + - glances + - zsh + - zsh-autosuggestions + - zsh-syntax-highlighting + - fonts-powerline + - webmin + - usermin + - ntpsec + - ntpsec-ntpdate + - tuned + - iptables + - netfilter-persistent + - iptables-persistent + - pflogsumm + - postfix + +# Packages only installed on bare-metal Dell hosts AND Proxmox VE hosts +# (both need CPU frequency tools and thermal management). +packages_physical_host: + - i7z + - thermald + - cpufrequtils + - linux-cpupower + +# Packages installed only on KVM/libvirt guests. +packages_virtual_guest: + - qemu-guest-agent + +# Packages that conflict with Proxmox VE — excluded from the install list +# on PVE hosts. Cockpit conflicts with the PVE web UI; tuned conflicts with +# PVE's own CPU governor management. +packages_proxmox_skip: + - cockpit + - cockpit-bridge + - cockpit-doc + - cockpit-networkmanager + - cockpit-packagekit + - cockpit-pcp + - cockpit-sosreport + - cockpit-storaged + - cockpit-system + - cockpit-ws + - cockpit-tests + - tuned + +# Packages known to be unavailable or renamed on Kali Linux. +# These are filtered out of the install list on Kali hosts. +packages_kali_skip: + - latencytop + - cockpit-tests + - command-not-found + - fonts-powerline + +# Packages installed only on non-Kali hosts (legacy packages_non_kali). +packages_non_kali: + - latencytop + - cockpit-tests + +# --------------------------------------------------------------------------- +# Feature toggles — set false to skip a phase. +# --------------------------------------------------------------------------- +run_packages: true +run_system_config: true +run_oam: true +run_security_ssh: true +run_security_wazuh: true +run_security_2fa: true +run_security_scap_stig: true +run_security_audit: false # was commented out in the legacy runner diff --git a/inventory/hosts.yml b/inventory/hosts.yml new file mode 100644 index 0000000..7f37af9 --- /dev/null +++ b/inventory/hosts.yml @@ -0,0 +1,141 @@ +--- +# KNELIAC inventory — Known Element Enterprises fleet. +# +# Hosts are organized into functional groups that the preflight role uses +# to set boolean facts (is_ntp_server, is_dhcp_server, is_proxmox_host, etc.). +# A host can belong to multiple groups (e.g. pfv-netinfra-01 is both an NTP +# server and a DHCP server). + +all: + vars: + ansible_user: localuser + ansible_become: true + + children: + # ======================================================================= + # Proxmox VE hypervisors (bare-metal Dell, running PVE) + # ======================================================================= + proxmox_hosts: + hosts: + pfv-tsys1: + ansible_host: 192.168.3.11 + pfv-tsys3: + ansible_host: 192.168.2.5 + pfv-tsys4: + ansible_host: 192.168.3.191 + pfv-tsys5: + ansible_host: 192.168.0.20 + pfv-tsys6: + ansible_host: 192.168.3.169 + pfv-tsys7: + ansible_host: 192.168.0.250 + pfv-tsys9: + ansible_host: 192.168.3.58 + # pfv-tsys2 is offline (pending rebuild Win10 -> Proxmox) + + # ======================================================================= + # Virtual guests (VMs running on Proxmox hosts) + # ======================================================================= + virtual_guests: + hosts: + tsys-awx: + ansible_host: 192.168.3.200 + tsys-librenms: + tsys-nsm: + tsys-siem: + ansible_host: 192.168.3.81 + tsys-proxmox-datacenter: + pfv-proxmox-backup-server: + tsys-ca: + tailscale-router: + ansible_host: 192.168.3.16 + pfv-bms: + ansible_host: 192.168.3.12 + + # ======================================================================= + # Network infrastructure (DNS / NTP / DHCP servers) + # ======================================================================= + + # NTP servers — these hosts run chrony as NTP *servers* and must NOT + # receive the ntpsec client config deployed by the system_config role. + ntp_servers: + hosts: + pfv-netinfra-01: + ansible_host: 192.168.3.252 + pfv-netinfra-02: + ansible_host: 192.168.3.253 + pfv-netboot: + ansible_host: 192.168.3.250 + + # DHCP servers — these hosts run ISC dhcpd and must NOT receive the + # dhclient.conf override deployed by the system_config role. + dhcp_servers: + hosts: + pfv-netinfra-01: + ansible_host: 192.168.3.252 + pfv-netinfra-02: + ansible_host: 192.168.3.253 + + # DNS servers — informational group; these hosts run Technitium / Pi-hole. + dns_servers: + hosts: + pfv-netinfra-01: + ansible_host: 192.168.3.252 + pfv-netinfra-02: + ansible_host: 192.168.3.253 + pfv-netboot: + ansible_host: 192.168.3.250 + tailscale-router: + ansible_host: 192.168.3.16 + + # ======================================================================= + # Monitoring / security infrastructure + # ======================================================================= + + # LibreNMS server — must NOT receive rsyslog forward-to-self config. + librenms_server: + hosts: + tsys-librenms: + + # Wazuh manager / NSM — must NOT receive the wazuh-agent package. + wazuh_server: + hosts: + tsys-nsm: + + # ======================================================================= + # Dev workstations — skip hardened sshd_config (need flexible SSH) + # ======================================================================= + dev_workstations: + hosts: + subopi-dev: + CharlesDevServer: + kali-tsys: + kali-rd: + + # ======================================================================= + # Raspberry Pi / ARM SBCs + # ======================================================================= + raspberry_pi: + hosts: + # Add Pi hosts here as they come online + + # ======================================================================= + # Kubernetes nodes + # ======================================================================= + kubernetes_nodes: + children: + k8s_control_plane: + hosts: + pfv-k8s-cnode1: + pfv-k8s-cnode2: + pfv-k8s-cnode3: + pfv-k8s-cnode4: + pfv-k8s-cnode5: + k8s_workers: + hosts: + pfv-k8s-wnode-tsys1: + pfv-k8s-wnode-tsys3: + pfv-k8s-wnode-tsys5: + pfv-k8s-wnode-tsys6: + pfv-k8s-wnode-tsys7: + pfv-k8s-wnode-tsys9: