4 Commits

Include renames

Author	SHA1	Message	Date
mrcharles	75b42c7e46	[#454] codify CMDB drift report as AWX job template (runs on workstation, su to reachableceo) ... https://projects.knownelement.com/issues/454	2026-09-05 21:59:41 -05:00
mrcharles	88e3f40331	[#385] ssh_ca role + onboarding playbook (fleet SSH cert CA rollout) ... Idempotent role: install fleet User CA public key + TrustedUserCAKeys drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR. https://projects.knownelement.com/issues/385	2026-09-05 17:11:12 -05:00
mrcharles	aa70486eaa	feat(awx): serve AWX over HTTPS via nginx TLS-termination proxy ... Add playbooks/setup_awx_https.yml that deploys a host-level nginx reverse proxy in front of the AWX LoadBalancer service, terminating TLS on 443 and proxying to the existing HTTP service on 80. Why a reverse proxy and not in-pod TLS: the AWX Operator only wires nginx for HTTPS on the OpenShift Route passthrough code path (ingress_type: route + route_tls_termination_mechanism: passthrough), which requires the Route CRD and fails on k3s. The cluster has no ingress controller either. A host nginx proxy is the lowest-risk option and is trivially swappable when the internal CA / an ingress controller + cert-manager arrive. The self-signed cert (CN=tsys-awx.knel.net) carries SANs for the FQDN, short hostname, and both LAN and Tailscale IPs. Re-run the playbook to rotate the cert once the internal CA is rolled out. Also update scripts/awx_create_job_templates.py to use https by default and add AWX_VERIFY_TLS / AWX_CA_BUNDLE env vars so it works with the self-signed cert now and verifies properly once the internal CA bundle is distributed. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>	2026-07-30 16:45:58 -05:00
mrcharles	6eedfb7344	feat(playbooks): add hello world and setup new system playbooks ... Add two playbooks: - hello_world.yml: AWX smoke test that asserts Debian-family OS and reports facts. Use this as the first Job Template to confirm AWX can reach hosts, become root, and gather facts. - setup_new_system.yml: Full host provisioning playbook that mirrors the function call order of SetupNewSystem.sh. Each role is gated by a run_* feature toggle so the same template can do partial runs. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>	2026-07-30 12:15:43 -05:00