KNEL/KNELIAC
9
0
Fork 0
Code Pull Requests Actions Packages Releases Activity
27 Commits 2 Branches 0 Tags
0606d268b451906ae1d40e1f7c61165790ae4f8c
Commit Graph
5 Commits
Author SHA1 Message Date
mrcharles 0606d268b4 [#784] framework fix: cn_count double-count (grep -c prints 0 + || echo 0 appended second line)
ci / audit (push) Successful in 54s
Details 
https://projects.knownelement.com/issues/784
 2026-09-05 07:16:14 -05:00
mrcharles 962a8f197d [#454] adopt enforcement framework + STATUS; modernize librenms agent scripts 
check-rules green; shellcheck fixes to dpkg.sh/os-updates.sh (legacy
backticks, unquoted vars, array-quoted command builders); Discourse
pointers added to basis docs; awx/k8s/compliance repos referenced.
https://projects.knownelement.com/issues/454
 2026-09-05 05:35:44 -05:00
mrcharles aa70486eaa feat(awx): serve AWX over HTTPS via nginx TLS-termination proxy 
Add playbooks/setup_awx_https.yml that deploys a host-level nginx
reverse proxy in front of the AWX LoadBalancer service, terminating
TLS on 443 and proxying to the existing HTTP service on 80.

Why a reverse proxy and not in-pod TLS: the AWX Operator only wires
nginx for HTTPS on the OpenShift Route passthrough code path
(ingress_type: route + route_tls_termination_mechanism: passthrough),
which requires the Route CRD and fails on k3s. The cluster has no
ingress controller either. A host nginx proxy is the lowest-risk
option and is trivially swappable when the internal CA / an ingress
controller + cert-manager arrive.

The self-signed cert (CN=tsys-awx.knel.net) carries SANs for the
FQDN, short hostname, and both LAN and Tailscale IPs. Re-run the
playbook to rotate the cert once the internal CA is rolled out.

Also update scripts/awx_create_job_templates.py to use https by
default and add AWX_VERIFY_TLS / AWX_CA_BUNDLE env vars so it works
with the self-signed cert now and verifies properly once the internal
CA bundle is distributed.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
 2026-07-30 16:45:58 -05:00
mrcharles b9b4820051 fix(security): remove hardcoded AWX credential from script 
The AWX admin password was hardcoded in scripts/awx_create_job_templates.py.
Read credentials from environment variables instead (AWX_USER,
AWX_PASSWORD, AWX_URL) and fail loudly when AWX_PASSWORD is unset.

No credentials are stored in this repository.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
 2026-07-30 16:04:59 -05:00
mrcharles 7fa2792256 feat(awx): add AWX job template creation script 
Add scripts/awx_create_job_templates.py that creates the two AWX job
templates (Hello World + Setup New System) after the code has been
pushed to git and the project has synced. Run this once after cloning
the repo on a new AWX instance.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
 2026-07-30 12:16:44 -05:00