# KNELIAC Basis — Executive Summary

**Question:** How does legacy `KNELServerBuild` (bash) become `KNELIAC` (Ansible), and how does the PFVCluster netinfra dns/dhcp/ntp code (Redmine #472) move into KNELIAC?

**Headline:** KNELIAC is not greenfield — the fleet-build port from KNELServerBuild is already ~complete (9 roles, AWX-driven, inventory already lists `pfv-netinfra-01/02` in `ntp_servers`/`dhcp_servers`/`dns_servers` groups). The real work is #472: porting PFVCluster's `netinfra/` into four new roles.

**Key findings**

- **KNELServerBuild**: architecturally sound bash (phases, modules, preflight, tests) but end-of-life — vendored-framework runtime dependency, deprecated CDN var, documented code-review debt, and a drifted `dns-cluster-setup` copy at repo root. Treat as *specification only*; ~90% already ported. Nothing else needs porting except tests and a few docs.
- **KNELIAC conventions to follow:** `<area>_<thing>` role names, `preflight` facts (`is_dhcp_server`...) from inventory groups, `run_*` toggles, strict no-secrets AGENTS.md, `setup_<purpose>.yml` playbooks.
- **#472 mapping (PFVCluster `netinfra/` → new roles):** `dhcp/` → `roles/dhcp_server` (dhcpd.conf.j2, failover vars, primary/secondary host_vars); Pi-hole + Technitium compose + `technitium-zone-sync` systemd timer → `roles/dns_pihole` / `roles/dns_technitium` (rsync sync, not AXFR — Pi-hole owns :53); host ntpsec → `roles/ntp_server`; netinfra snmpd (scoped ACL + lease extends) → variant in `system_config`. All driven by one `playbooks/setup_netinfra.yml`.
- **Gaps:** ntpsec config exists **only on hosts** (capture before repave); Webmin hand-edits will fight templates; Technitium `auth.config` contains creds and must never enter git; zone data must survive re-runs (idempotency); SNMP community currently plaintext in group_vars → move to Vault; port from the **PFVCluster** copies of duplicated scripts (they carry the fixes).
- **Sequencing:** (0) capture ntpsec + zone/gravity snapshots → (1) group/host_vars → (2) ntp_server role → (3) dhcp_server role → (4) DNS containers + zone-sync → (5) snmp + AWX job templates → (6) replace PFVCluster `netinfra/` subdirs with pointer stubs (Discourse 306 pattern), keep `switches/` and audit artifacts → (7) stub the KNELServerBuild duplicate. Old scripts stay until each role runs green on both nodes; nothing else in PFVCluster references `netinfra/`, so blast radius is minimal.

Full detail: `kneliac-basis-analysis.md`