feat(inventory): add fleet inventory with all host groups
Add inventory/hosts.yml with real fleet hostnames organized into functional groups: - proxmox_hosts: 7 physical Dell hypervisors (pfv-tsys1/3/4/5/6/7/9) - virtual_guests: VMs running on Proxmox (tsys-awx, tsys-librenms, etc.) - ntp_servers: pfv-netinfra-01/02, pfv-netboot (skip client config) - dhcp_servers: pfv-netinfra-01/02 (skip dhclient.conf deploy) - dns_servers: Technitium/Pi-hole hosts - librenms_server: tsys-librenms (skip rsyslog forward) - wazuh_server: tsys-nsm (skip agent install) - dev_workstations: subopi-dev, CharlesDevServer, kali-tsys - kubernetes_nodes: control plane and worker nodes Add inventory/group_vars/all.yml with all tunable variables (packages, DNS servers, NTP servers, postfix relayhost, feature toggles) that mirror the hard-coded values from the legacy bash scripts. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
@@ -0,0 +1,202 @@
|
||||
---
|
||||
# KNELIAC default variables.
|
||||
#
|
||||
# These mirror the values hard-coded in the legacy bash
|
||||
# PFVCluster/provisioning/ scripts. Override any of them in AWX via
|
||||
# "extra vars" on the Job Template, or per-host in group_vars/host_vars.
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Users provisioned on every host. Keys under ssh_authorized_keys must already
|
||||
# exist in roles/security_ssh/files/authorized_keys/.
|
||||
# ---------------------------------------------------------------------------
|
||||
managed_users:
|
||||
- name: root
|
||||
home: /root
|
||||
- name: localuser
|
||||
home: /home/localuser
|
||||
- name: subodev
|
||||
home: /home/subodev
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Networking: authoritative recursive DNS + NTP servers (pfv-netinfra-01/02).
|
||||
# ---------------------------------------------------------------------------
|
||||
dns_servers:
|
||||
- 192.168.3.252
|
||||
- 192.168.3.253
|
||||
|
||||
dns_search_domain: knel.net
|
||||
|
||||
ntp_servers:
|
||||
- 192.168.3.252
|
||||
- 192.168.3.253
|
||||
|
||||
# Hostnames of NTP servers that must NOT get client config are now managed
|
||||
# via the 'ntp_servers' inventory group (see inventory/hosts.yml). The
|
||||
# preflight role sets is_ntp_server based on group membership.
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Mail (postfix) — local-only relay to the Cloudron smarthost.
|
||||
# ---------------------------------------------------------------------------
|
||||
postfix_relayhost: tsys-cloudron.knel.net
|
||||
postfix_generic_address: tsysrootaccount@knel.net
|
||||
|
||||
# Syslog forward destination (LibreNMS receiver).
|
||||
syslog_forward_host: tsys-librenms.knel.net
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# SNMP
|
||||
# ---------------------------------------------------------------------------
|
||||
snmp_rocommunity: kn3lmgmt
|
||||
snmp_syslocation: "R4, Server Room, SITER, Pflugerville, United States"
|
||||
snmp_syscontact: coo@turnsys.com
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Monitoring / security agents
|
||||
# ---------------------------------------------------------------------------
|
||||
wazuh_manager: tsys-nsm.knel.net
|
||||
# Hostnames that must NOT receive the wazuh agent (the wazuh server itself).
|
||||
# The Wazuh manager server is now managed via the 'wazuh_server' inventory
|
||||
# group (see inventory/hosts.yml). The preflight role sets is_wazuh_server.
|
||||
wazuh_server_hostnames_deprecated: []
|
||||
|
||||
# The LibreNMS server is now managed via the 'librenms_server' inventory
|
||||
# group (see inventory/hosts.yml). The preflight role sets is_librenms_server.
|
||||
|
||||
# Tailscale (installer only auths the machine; no token stored here).
|
||||
tailscale_install: true
|
||||
|
||||
# Webmin/Usermin (used for PAM 2FA management).
|
||||
webmin_setup: true
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Packages
|
||||
# ---------------------------------------------------------------------------
|
||||
# Packages removed from every host during provisioning.
|
||||
packages_remove:
|
||||
- systemd-timesyncd
|
||||
- chrony
|
||||
- telnet
|
||||
- inetutils-telnet
|
||||
- wpasupplicant
|
||||
- modemmanager
|
||||
- nano
|
||||
- multipath-tools
|
||||
|
||||
# Packages installed on every host during provisioning.
|
||||
packages_install:
|
||||
- virt-what
|
||||
- auditd
|
||||
- audispd-plugins
|
||||
- cloud-guest-utils
|
||||
- aide
|
||||
- htop
|
||||
- snmpd
|
||||
- ncdu
|
||||
- iftop
|
||||
- iotop
|
||||
- cockpit
|
||||
- cockpit-bridge
|
||||
- cockpit-doc
|
||||
- cockpit-networkmanager
|
||||
- cockpit-packagekit
|
||||
- cockpit-pcp
|
||||
- cockpit-sosreport
|
||||
- cockpit-storaged
|
||||
- cockpit-system
|
||||
- cockpit-ws
|
||||
- nethogs
|
||||
- sysstat
|
||||
- ngrep
|
||||
- acct
|
||||
- lsb-release
|
||||
- screen
|
||||
- tailscale
|
||||
- tmux
|
||||
- vim
|
||||
- command-not-found
|
||||
- lldpd
|
||||
- ansible-core
|
||||
- net-tools
|
||||
- dos2unix
|
||||
- gpg
|
||||
- molly-guard
|
||||
- lshw
|
||||
- fzf
|
||||
- ripgrep
|
||||
- sudo
|
||||
- mailutils
|
||||
- clamav
|
||||
- logwatch
|
||||
- git
|
||||
- tshark
|
||||
- tcpdump
|
||||
- lynis
|
||||
- glances
|
||||
- zsh
|
||||
- zsh-autosuggestions
|
||||
- zsh-syntax-highlighting
|
||||
- fonts-powerline
|
||||
- webmin
|
||||
- usermin
|
||||
- ntpsec
|
||||
- ntpsec-ntpdate
|
||||
- tuned
|
||||
- iptables
|
||||
- netfilter-persistent
|
||||
- iptables-persistent
|
||||
- pflogsumm
|
||||
- postfix
|
||||
|
||||
# Packages only installed on bare-metal Dell hosts AND Proxmox VE hosts
|
||||
# (both need CPU frequency tools and thermal management).
|
||||
packages_physical_host:
|
||||
- i7z
|
||||
- thermald
|
||||
- cpufrequtils
|
||||
- linux-cpupower
|
||||
|
||||
# Packages installed only on KVM/libvirt guests.
|
||||
packages_virtual_guest:
|
||||
- qemu-guest-agent
|
||||
|
||||
# Packages that conflict with Proxmox VE — excluded from the install list
|
||||
# on PVE hosts. Cockpit conflicts with the PVE web UI; tuned conflicts with
|
||||
# PVE's own CPU governor management.
|
||||
packages_proxmox_skip:
|
||||
- cockpit
|
||||
- cockpit-bridge
|
||||
- cockpit-doc
|
||||
- cockpit-networkmanager
|
||||
- cockpit-packagekit
|
||||
- cockpit-pcp
|
||||
- cockpit-sosreport
|
||||
- cockpit-storaged
|
||||
- cockpit-system
|
||||
- cockpit-ws
|
||||
- cockpit-tests
|
||||
- tuned
|
||||
|
||||
# Packages known to be unavailable or renamed on Kali Linux.
|
||||
# These are filtered out of the install list on Kali hosts.
|
||||
packages_kali_skip:
|
||||
- latencytop
|
||||
- cockpit-tests
|
||||
- command-not-found
|
||||
- fonts-powerline
|
||||
|
||||
# Packages installed only on non-Kali hosts (legacy packages_non_kali).
|
||||
packages_non_kali:
|
||||
- latencytop
|
||||
- cockpit-tests
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Feature toggles — set false to skip a phase.
|
||||
# ---------------------------------------------------------------------------
|
||||
run_packages: true
|
||||
run_system_config: true
|
||||
run_oam: true
|
||||
run_security_ssh: true
|
||||
run_security_wazuh: true
|
||||
run_security_2fa: true
|
||||
run_security_scap_stig: true
|
||||
run_security_audit: false # was commented out in the legacy runner
|
||||
Reference in New Issue
Block a user