Port Modules/Security/secharden-ssh.sh.
Deploys:
- Authorized keys for root, localuser, subodev (conditional on existence)
- Hardened /etc/ssh/sshd_config (skipped on dev workstations)
- ssh-audit hardening drop-in for algorithm restrictions (skipped on
Ubuntu where it breaks openssh-server)
- Lockdown of sshd_config.d directory permissions
SSH service is validated (sshd -t) before restart.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
Port Modules/OAM/oam-librenms.sh.
Deploys the check_mk agent and systemd socket for LibreNMS monitoring,
along with the local plugins: distro, dmi, dpkg, ntp-client,
os-updates, postfixdetailed, and postfix-queues.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
Port global-systemServiceConfigurationFiles() and
global-postPackageConfiguration().
Manages:
- Global zsh config (/etc/zshrc)
- Mail aliases and postfix relay (local-only, smarthost to Cloudron)
- Static DNS resolv.conf (replaces systemd-resolved symlinks)
- rsyslog forwarding to LibreNMS (skipped on LibreNMS server itself)
- DHCP client config (skipped on DHCP servers pfv-netinfra-01/02)
- SNMP daemon config selected by host class (Pi/physical/Proxmox/VM)
- NTP client config (skipped on NTP server hosts)
- LLDP network discovery
- Cockpit disallowed-users
- Default user shells (zsh, conditional on user existence)
- Process accounting (accton)
- CPU governor on physical/Proxmox hosts (performance)
- tuned profile on VM guests (virtual-guest)
Infrastructure configs use Jinja2 templates parameterized by variables
in group_vars/all.yml.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
Port PreflightCheck.sh and pi-detect.sh to the preflight role.
Detects at runtime:
- Physical Dell host (dmidecode, NOT Proxmox, NOT Pi)
- Proxmox VE host (dpkg-query proxmox-ve)
- Virtual guest (virt-what: hyperv/kvm)
- KVM guest specifically
- Raspberry Pi (device-tree model file)
- Distro: Debian, Ubuntu, Kali
- User existence: localuser, subodev
Derives from inventory groups:
- NTP server, DHCP server, DNS server
- LibreNMS server, Wazuh server
- Dev workstation
All facts are cacheable so downstream roles can branch on them without
re-running detection commands.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
Add two playbooks:
- hello_world.yml: AWX smoke test that asserts Debian-family OS and
reports facts. Use this as the first Job Template to confirm AWX
can reach hosts, become root, and gather facts.
- setup_new_system.yml: Full host provisioning playbook that mirrors
the function call order of SetupNewSystem.sh. Each role is gated by
a run_* feature toggle so the same template can do partial runs.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
Make explicit that agents must commit and push automatically after every
logical unit of work — never wait to be asked.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
Add agent guidelines for AI assistants working on this repository:
- Document atomic commit requirements
- Specify conventional commit format with examples
- Require verbose, formatted commit messages
- Emphasize immediate commit/push behavior
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
mrcharles
Charles N Wyble
reachableceo