6 Commits

Include renames

Author	SHA1	Message	Date
mrcharles	3815aee578	[#784] framework: set-e-safe cn_count fallback (|| true, not bare removal) ... https://projects.knownelement.com/issues/784	2026-09-05 07:35:37 -05:00
mrcharles	0606d268b4	[#784] framework fix: cn_count double-count (grep -c prints 0 + || echo 0 appended second line) ... https://projects.knownelement.com/issues/784	2026-09-05 07:16:14 -05:00
mrcharles	962a8f197d	[#454] adopt enforcement framework + STATUS; modernize librenms agent scripts ... check-rules green; shellcheck fixes to dpkg.sh/os-updates.sh (legacy backticks, unquoted vars, array-quoted command builders); Discourse pointers added to basis docs; awx/k8s/compliance repos referenced. https://projects.knownelement.com/issues/454	2026-09-05 05:35:44 -05:00
mrcharles	aa70486eaa	feat(awx): serve AWX over HTTPS via nginx TLS-termination proxy ... Add playbooks/setup_awx_https.yml that deploys a host-level nginx reverse proxy in front of the AWX LoadBalancer service, terminating TLS on 443 and proxying to the existing HTTP service on 80. Why a reverse proxy and not in-pod TLS: the AWX Operator only wires nginx for HTTPS on the OpenShift Route passthrough code path (ingress_type: route + route_tls_termination_mechanism: passthrough), which requires the Route CRD and fails on k3s. The cluster has no ingress controller either. A host nginx proxy is the lowest-risk option and is trivially swappable when the internal CA / an ingress controller + cert-manager arrive. The self-signed cert (CN=tsys-awx.knel.net) carries SANs for the FQDN, short hostname, and both LAN and Tailscale IPs. Re-run the playbook to rotate the cert once the internal CA is rolled out. Also update scripts/awx_create_job_templates.py to use https by default and add AWX_VERIFY_TLS / AWX_CA_BUNDLE env vars so it works with the self-signed cert now and verifies properly once the internal CA bundle is distributed. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>	2026-07-30 16:45:58 -05:00
mrcharles	b9b4820051	fix(security): remove hardcoded AWX credential from script ... The AWX admin password was hardcoded in scripts/awx_create_job_templates.py. Read credentials from environment variables instead (AWX_USER, AWX_PASSWORD, AWX_URL) and fail loudly when AWX_PASSWORD is unset. No credentials are stored in this repository. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>	2026-07-30 16:04:59 -05:00
mrcharles	7fa2792256	feat(awx): add AWX job template creation script ... Add scripts/awx_create_job_templates.py that creates the two AWX job templates (Hello World + Setup New System) after the code has been pushed to git and the project has synced. Run this once after cloning the repo on a new AWX instance. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>	2026-07-30 12:16:44 -05:00