---
# KNELIAC inventory — Known Element Enterprises fleet.
#
# Hosts are organized into functional groups that the preflight role uses
# to set boolean facts (is_ntp_server, is_dhcp_server, is_proxmox_host, etc.).
# A host can belong to multiple groups (e.g. pfv-netinfra-01 is both an NTP
# server and a DHCP server).

all:
  vars:
    ansible_user: localuser
    ansible_become: true

  children:
    # =======================================================================
    # Proxmox VE hypervisors (bare-metal Dell, running PVE)
    # =======================================================================
    proxmox_hosts:
      hosts:
        pfv-tsys1:
          ansible_host: 192.168.3.11
        pfv-tsys3:
          ansible_host: 192.168.2.5
        pfv-tsys4:
          ansible_host: 192.168.3.191
        pfv-tsys5:
          ansible_host: 192.168.0.20
        pfv-tsys6:
          ansible_host: 192.168.3.169
        pfv-tsys7:
          ansible_host: 192.168.0.250
        pfv-tsys9:
          ansible_host: 192.168.3.58
      # pfv-tsys2 is offline (pending rebuild Win10 -> Proxmox)

    # =======================================================================
    # Virtual guests (VMs running on Proxmox hosts)
    # =======================================================================
    virtual_guests:
      hosts:
        tsys-awx:
          ansible_host: 192.168.3.200
        tsys-librenms:
        tsys-nsm:
        tsys-siem:
          ansible_host: 192.168.3.81
        tsys-proxmox-datacenter:
        pfv-proxmox-backup-server:
        tsys-ca:
        tailscale-router:
          ansible_host: 192.168.3.16
        pfv-bms:
          ansible_host: 192.168.3.12

    # =======================================================================
    # Network infrastructure (DNS / NTP / DHCP servers)
    # =======================================================================

    # NTP servers — these hosts run chrony as NTP *servers* and must NOT
    # receive the ntpsec client config deployed by the system_config role.
    ntp_servers:
      hosts:
        pfv-netinfra-01:
          ansible_host: 192.168.3.252
        pfv-netinfra-02:
          ansible_host: 192.168.3.253
        pfv-netboot:
          ansible_host: 192.168.3.250

    # DHCP servers — these hosts run ISC dhcpd and must NOT receive the
    # dhclient.conf override deployed by the system_config role.
    dhcp_servers:
      hosts:
        pfv-netinfra-01:
          ansible_host: 192.168.3.252
        pfv-netinfra-02:
          ansible_host: 192.168.3.253

    # DNS servers — informational group; these hosts run Technitium / Pi-hole.
    dns_servers:
      hosts:
        pfv-netinfra-01:
          ansible_host: 192.168.3.252
        pfv-netinfra-02:
          ansible_host: 192.168.3.253
        pfv-netboot:
          ansible_host: 192.168.3.250
        tailscale-router:
          ansible_host: 192.168.3.16

    # =======================================================================
    # Monitoring / security infrastructure
    # =======================================================================

    # LibreNMS server — must NOT receive rsyslog forward-to-self config.
    librenms_server:
      hosts:
        tsys-librenms:

    # Wazuh manager / NSM — must NOT receive the wazuh-agent package.
    wazuh_server:
      hosts:
        tsys-nsm:

    # =======================================================================
    # Dev workstations — skip hardened sshd_config (need flexible SSH)
    # =======================================================================
    dev_workstations:
      hosts:
        subopi-dev:
        CharlesDevServer:
        kali-tsys:
        kali-rd:

    # =======================================================================
    # Raspberry Pi / ARM SBCs
    # =======================================================================
    raspberry_pi:
      hosts:
        # Add Pi hosts here as they come online

    # =======================================================================
    # Kubernetes nodes
    # =======================================================================
    kubernetes_nodes:
      children:
        k8s_control_plane:
          hosts:
            pfv-k8s-cnode1:
            pfv-k8s-cnode2:
            pfv-k8s-cnode3:
            pfv-k8s-cnode4:
            pfv-k8s-cnode5:
        k8s_workers:
          hosts:
            pfv-k8s-wnode-tsys1:
            pfv-k8s-wnode-tsys3:
            pfv-k8s-wnode-tsys5:
            pfv-k8s-wnode-tsys6:
            pfv-k8s-wnode-tsys7:
            pfv-k8s-wnode-tsys9: