KNEL/KNELIAC
1
0
Fork 0
Code Pull Requests Actions Packages Releases Activity

feat(inventory): add fleet inventory with all host groups

Browse Source 
Add inventory/hosts.yml with real fleet hostnames organized into
functional groups:

- proxmox_hosts: 7 physical Dell hypervisors (pfv-tsys1/3/4/5/6/7/9)
- virtual_guests: VMs running on Proxmox (tsys-awx, tsys-librenms, etc.)
- ntp_servers: pfv-netinfra-01/02, pfv-netboot (skip client config)
- dhcp_servers: pfv-netinfra-01/02 (skip dhclient.conf deploy)
- dns_servers: Technitium/Pi-hole hosts
- librenms_server: tsys-librenms (skip rsyslog forward)
- wazuh_server: tsys-nsm (skip agent install)
- dev_workstations: subopi-dev, CharlesDevServer, kali-tsys
- kubernetes_nodes: control plane and worker nodes

Add inventory/group_vars/all.yml with all tunable variables (packages,
DNS servers, NTP servers, postfix relayhost, feature toggles) that
mirror the hard-coded values from the legacy bash scripts.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
mrcharles
2026-07-30 12:15:36 -05:00
parent 7a2ad022c8
commit 754b47fb37
2 changed files with 343 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
inventory/group_vars/all.yml
+202
View File
@@ -0,0 +1,202 @@
---
# KNELIAC default variables.
#
# These mirror the values hard-coded in the legacy bash
# PFVCluster/provisioning/ scripts. Override any of them in AWX via
# "extra vars" on the Job Template, or per-host in group_vars/host_vars.
# ---------------------------------------------------------------------------
# Users provisioned on every host. Keys under ssh_authorized_keys must already
# exist in roles/security_ssh/files/authorized_keys/.
# ---------------------------------------------------------------------------
managed_users:
- name: root
home: /root
- name: localuser
home: /home/localuser
- name: subodev
home: /home/subodev
# ---------------------------------------------------------------------------
# Networking: authoritative recursive DNS + NTP servers (pfv-netinfra-01/02).
# ---------------------------------------------------------------------------
dns_servers:
- 192.168.3.252
- 192.168.3.253
dns_search_domain: knel.net
ntp_servers:
- 192.168.3.252
- 192.168.3.253
# Hostnames of NTP servers that must NOT get client config are now managed
# via the 'ntp_servers' inventory group (see inventory/hosts.yml). The
# preflight role sets is_ntp_server based on group membership.
# ---------------------------------------------------------------------------
# Mail (postfix) — local-only relay to the Cloudron smarthost.
# ---------------------------------------------------------------------------
postfix_relayhost: tsys-cloudron.knel.net
postfix_generic_address: tsysrootaccount@knel.net
# Syslog forward destination (LibreNMS receiver).
syslog_forward_host: tsys-librenms.knel.net
# ---------------------------------------------------------------------------
# SNMP
# ---------------------------------------------------------------------------
snmp_rocommunity: kn3lmgmt
snmp_syslocation: "R4, Server Room, SITER, Pflugerville, United States"
snmp_syscontact: coo@turnsys.com
# ---------------------------------------------------------------------------
# Monitoring / security agents
# ---------------------------------------------------------------------------
wazuh_manager: tsys-nsm.knel.net
# Hostnames that must NOT receive the wazuh agent (the wazuh server itself).
# The Wazuh manager server is now managed via the 'wazuh_server' inventory
# group (see inventory/hosts.yml). The preflight role sets is_wazuh_server.
wazuh_server_hostnames_deprecated: []
# The LibreNMS server is now managed via the 'librenms_server' inventory
# group (see inventory/hosts.yml). The preflight role sets is_librenms_server.
# Tailscale (installer only auths the machine; no token stored here).
tailscale_install: true
# Webmin/Usermin (used for PAM 2FA management).
webmin_setup: true
# ---------------------------------------------------------------------------
# Packages
# ---------------------------------------------------------------------------
# Packages removed from every host during provisioning.
packages_remove:
- systemd-timesyncd
- chrony
- telnet
- inetutils-telnet
- wpasupplicant
- modemmanager
- nano
- multipath-tools
# Packages installed on every host during provisioning.
packages_install:
- virt-what
- auditd
- audispd-plugins
- cloud-guest-utils
- aide
- htop
- snmpd
- ncdu
- iftop
- iotop
- cockpit
- cockpit-bridge
- cockpit-doc
- cockpit-networkmanager
- cockpit-packagekit
- cockpit-pcp
- cockpit-sosreport
- cockpit-storaged
- cockpit-system
- cockpit-ws
- nethogs
- sysstat
- ngrep
- acct
- lsb-release
- screen
- tailscale
- tmux
- vim
- command-not-found
- lldpd
- ansible-core
- net-tools
- dos2unix
- gpg
- molly-guard
- lshw
- fzf
- ripgrep
- sudo
- mailutils
- clamav
- logwatch
- git
- tshark
- tcpdump
- lynis
- glances
- zsh
- zsh-autosuggestions
- zsh-syntax-highlighting
- fonts-powerline
- webmin
- usermin
- ntpsec
- ntpsec-ntpdate
- tuned
- iptables
- netfilter-persistent
- iptables-persistent
- pflogsumm
- postfix
# Packages only installed on bare-metal Dell hosts AND Proxmox VE hosts
# (both need CPU frequency tools and thermal management).
packages_physical_host:
- i7z
- thermald
- cpufrequtils
- linux-cpupower
# Packages installed only on KVM/libvirt guests.
packages_virtual_guest:
- qemu-guest-agent
# Packages that conflict with Proxmox VE — excluded from the install list
# on PVE hosts. Cockpit conflicts with the PVE web UI; tuned conflicts with
# PVE's own CPU governor management.
packages_proxmox_skip:
- cockpit
- cockpit-bridge
- cockpit-doc
- cockpit-networkmanager
- cockpit-packagekit
- cockpit-pcp
- cockpit-sosreport
- cockpit-storaged
- cockpit-system
- cockpit-ws
- cockpit-tests
- tuned
# Packages known to be unavailable or renamed on Kali Linux.
# These are filtered out of the install list on Kali hosts.
packages_kali_skip:
- latencytop
- cockpit-tests
- command-not-found
- fonts-powerline
# Packages installed only on non-Kali hosts (legacy packages_non_kali).
packages_non_kali:
- latencytop
- cockpit-tests
# ---------------------------------------------------------------------------
# Feature toggles — set false to skip a phase.
# ---------------------------------------------------------------------------
run_packages: true
run_system_config: true
run_oam: true
run_security_ssh: true
run_security_wazuh: true
run_security_2fa: true
run_security_scap_stig: true
run_security_audit: false # was commented out in the legacy runner
inventory/hosts.yml
+141
View File
@@ -0,0 +1,141 @@
---
# KNELIAC inventory — Known Element Enterprises fleet.
#
# Hosts are organized into functional groups that the preflight role uses
# to set boolean facts (is_ntp_server, is_dhcp_server, is_proxmox_host, etc.).
# A host can belong to multiple groups (e.g. pfv-netinfra-01 is both an NTP
# server and a DHCP server).
all:
vars:
ansible_user: localuser
ansible_become: true
children:
# =======================================================================
# Proxmox VE hypervisors (bare-metal Dell, running PVE)
# =======================================================================
proxmox_hosts:
hosts:
pfv-tsys1:
ansible_host: 192.168.3.11
pfv-tsys3:
ansible_host: 192.168.2.5
pfv-tsys4:
ansible_host: 192.168.3.191
pfv-tsys5:
ansible_host: 192.168.0.20
pfv-tsys6:
ansible_host: 192.168.3.169
pfv-tsys7:
ansible_host: 192.168.0.250
pfv-tsys9:
ansible_host: 192.168.3.58
# pfv-tsys2 is offline (pending rebuild Win10 -> Proxmox)
# =======================================================================
# Virtual guests (VMs running on Proxmox hosts)
# =======================================================================
virtual_guests:
hosts:
tsys-awx:
ansible_host: 192.168.3.200
tsys-librenms:
tsys-nsm:
tsys-siem:
ansible_host: 192.168.3.81
tsys-proxmox-datacenter:
pfv-proxmox-backup-server:
tsys-ca:
tailscale-router:
ansible_host: 192.168.3.16
pfv-bms:
ansible_host: 192.168.3.12
# =======================================================================
# Network infrastructure (DNS / NTP / DHCP servers)
# =======================================================================
# NTP servers — these hosts run chrony as NTP *servers* and must NOT
# receive the ntpsec client config deployed by the system_config role.
ntp_servers:
hosts:
pfv-netinfra-01:
ansible_host: 192.168.3.252
pfv-netinfra-02:
ansible_host: 192.168.3.253
pfv-netboot:
ansible_host: 192.168.3.250
# DHCP servers — these hosts run ISC dhcpd and must NOT receive the
# dhclient.conf override deployed by the system_config role.
dhcp_servers:
hosts:
pfv-netinfra-01:
ansible_host: 192.168.3.252
pfv-netinfra-02:
ansible_host: 192.168.3.253
# DNS servers — informational group; these hosts run Technitium / Pi-hole.
dns_servers:
hosts:
pfv-netinfra-01:
ansible_host: 192.168.3.252
pfv-netinfra-02:
ansible_host: 192.168.3.253
pfv-netboot:
ansible_host: 192.168.3.250
tailscale-router:
ansible_host: 192.168.3.16
# =======================================================================
# Monitoring / security infrastructure
# =======================================================================
# LibreNMS server — must NOT receive rsyslog forward-to-self config.
librenms_server:
hosts:
tsys-librenms:
# Wazuh manager / NSM — must NOT receive the wazuh-agent package.
wazuh_server:
hosts:
tsys-nsm:
# =======================================================================
# Dev workstations — skip hardened sshd_config (need flexible SSH)
# =======================================================================
dev_workstations:
hosts:
subopi-dev:
CharlesDevServer:
kali-tsys:
kali-rd:
# =======================================================================
# Raspberry Pi / ARM SBCs
# =======================================================================
raspberry_pi:
hosts:
# Add Pi hosts here as they come online
# =======================================================================
# Kubernetes nodes
# =======================================================================
kubernetes_nodes:
children:
k8s_control_plane:
hosts:
pfv-k8s-cnode1:
pfv-k8s-cnode2:
pfv-k8s-cnode3:
pfv-k8s-cnode4:
pfv-k8s-cnode5:
k8s_workers:
hosts:
pfv-k8s-wnode-tsys1:
pfv-k8s-wnode-tsys3:
pfv-k8s-wnode-tsys5:
pfv-k8s-wnode-tsys6:
pfv-k8s-wnode-tsys7:
pfv-k8s-wnode-tsys9: