mrcharles
754b47fb37
Add inventory/hosts.yml with real fleet hostnames organized into functional groups: - proxmox_hosts: 7 physical Dell hypervisors (pfv-tsys1/3/4/5/6/7/9) - virtual_guests: VMs running on Proxmox (tsys-awx, tsys-librenms, etc.) - ntp_servers: pfv-netinfra-01/02, pfv-netboot (skip client config) - dhcp_servers: pfv-netinfra-01/02 (skip dhclient.conf deploy) - dns_servers: Technitium/Pi-hole hosts - librenms_server: tsys-librenms (skip rsyslog forward) - wazuh_server: tsys-nsm (skip agent install) - dev_workstations: subopi-dev, CharlesDevServer, kali-tsys - kubernetes_nodes: control plane and worker nodes Add inventory/group_vars/all.yml with all tunable variables (packages, DNS servers, NTP servers, postfix relayhost, feature toggles) that mirror the hard-coded values from the legacy bash scripts. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
203 lines
5.4 KiB
YAML
203 lines
5.4 KiB
YAML
---
|
|
# KNELIAC default variables.
|
|
#
|
|
# These mirror the values hard-coded in the legacy bash
|
|
# PFVCluster/provisioning/ scripts. Override any of them in AWX via
|
|
# "extra vars" on the Job Template, or per-host in group_vars/host_vars.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Users provisioned on every host. Keys under ssh_authorized_keys must already
|
|
# exist in roles/security_ssh/files/authorized_keys/.
|
|
# ---------------------------------------------------------------------------
|
|
managed_users:
|
|
- name: root
|
|
home: /root
|
|
- name: localuser
|
|
home: /home/localuser
|
|
- name: subodev
|
|
home: /home/subodev
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Networking: authoritative recursive DNS + NTP servers (pfv-netinfra-01/02).
|
|
# ---------------------------------------------------------------------------
|
|
dns_servers:
|
|
- 192.168.3.252
|
|
- 192.168.3.253
|
|
|
|
dns_search_domain: knel.net
|
|
|
|
ntp_servers:
|
|
- 192.168.3.252
|
|
- 192.168.3.253
|
|
|
|
# Hostnames of NTP servers that must NOT get client config are now managed
|
|
# via the 'ntp_servers' inventory group (see inventory/hosts.yml). The
|
|
# preflight role sets is_ntp_server based on group membership.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Mail (postfix) — local-only relay to the Cloudron smarthost.
|
|
# ---------------------------------------------------------------------------
|
|
postfix_relayhost: tsys-cloudron.knel.net
|
|
postfix_generic_address: tsysrootaccount@knel.net
|
|
|
|
# Syslog forward destination (LibreNMS receiver).
|
|
syslog_forward_host: tsys-librenms.knel.net
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# SNMP
|
|
# ---------------------------------------------------------------------------
|
|
snmp_rocommunity: kn3lmgmt
|
|
snmp_syslocation: "R4, Server Room, SITER, Pflugerville, United States"
|
|
snmp_syscontact: coo@turnsys.com
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Monitoring / security agents
|
|
# ---------------------------------------------------------------------------
|
|
wazuh_manager: tsys-nsm.knel.net
|
|
# Hostnames that must NOT receive the wazuh agent (the wazuh server itself).
|
|
# The Wazuh manager server is now managed via the 'wazuh_server' inventory
|
|
# group (see inventory/hosts.yml). The preflight role sets is_wazuh_server.
|
|
wazuh_server_hostnames_deprecated: []
|
|
|
|
# The LibreNMS server is now managed via the 'librenms_server' inventory
|
|
# group (see inventory/hosts.yml). The preflight role sets is_librenms_server.
|
|
|
|
# Tailscale (installer only auths the machine; no token stored here).
|
|
tailscale_install: true
|
|
|
|
# Webmin/Usermin (used for PAM 2FA management).
|
|
webmin_setup: true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Packages
|
|
# ---------------------------------------------------------------------------
|
|
# Packages removed from every host during provisioning.
|
|
packages_remove:
|
|
- systemd-timesyncd
|
|
- chrony
|
|
- telnet
|
|
- inetutils-telnet
|
|
- wpasupplicant
|
|
- modemmanager
|
|
- nano
|
|
- multipath-tools
|
|
|
|
# Packages installed on every host during provisioning.
|
|
packages_install:
|
|
- virt-what
|
|
- auditd
|
|
- audispd-plugins
|
|
- cloud-guest-utils
|
|
- aide
|
|
- htop
|
|
- snmpd
|
|
- ncdu
|
|
- iftop
|
|
- iotop
|
|
- cockpit
|
|
- cockpit-bridge
|
|
- cockpit-doc
|
|
- cockpit-networkmanager
|
|
- cockpit-packagekit
|
|
- cockpit-pcp
|
|
- cockpit-sosreport
|
|
- cockpit-storaged
|
|
- cockpit-system
|
|
- cockpit-ws
|
|
- nethogs
|
|
- sysstat
|
|
- ngrep
|
|
- acct
|
|
- lsb-release
|
|
- screen
|
|
- tailscale
|
|
- tmux
|
|
- vim
|
|
- command-not-found
|
|
- lldpd
|
|
- ansible-core
|
|
- net-tools
|
|
- dos2unix
|
|
- gpg
|
|
- molly-guard
|
|
- lshw
|
|
- fzf
|
|
- ripgrep
|
|
- sudo
|
|
- mailutils
|
|
- clamav
|
|
- logwatch
|
|
- git
|
|
- tshark
|
|
- tcpdump
|
|
- lynis
|
|
- glances
|
|
- zsh
|
|
- zsh-autosuggestions
|
|
- zsh-syntax-highlighting
|
|
- fonts-powerline
|
|
- webmin
|
|
- usermin
|
|
- ntpsec
|
|
- ntpsec-ntpdate
|
|
- tuned
|
|
- iptables
|
|
- netfilter-persistent
|
|
- iptables-persistent
|
|
- pflogsumm
|
|
- postfix
|
|
|
|
# Packages only installed on bare-metal Dell hosts AND Proxmox VE hosts
|
|
# (both need CPU frequency tools and thermal management).
|
|
packages_physical_host:
|
|
- i7z
|
|
- thermald
|
|
- cpufrequtils
|
|
- linux-cpupower
|
|
|
|
# Packages installed only on KVM/libvirt guests.
|
|
packages_virtual_guest:
|
|
- qemu-guest-agent
|
|
|
|
# Packages that conflict with Proxmox VE — excluded from the install list
|
|
# on PVE hosts. Cockpit conflicts with the PVE web UI; tuned conflicts with
|
|
# PVE's own CPU governor management.
|
|
packages_proxmox_skip:
|
|
- cockpit
|
|
- cockpit-bridge
|
|
- cockpit-doc
|
|
- cockpit-networkmanager
|
|
- cockpit-packagekit
|
|
- cockpit-pcp
|
|
- cockpit-sosreport
|
|
- cockpit-storaged
|
|
- cockpit-system
|
|
- cockpit-ws
|
|
- cockpit-tests
|
|
- tuned
|
|
|
|
# Packages known to be unavailable or renamed on Kali Linux.
|
|
# These are filtered out of the install list on Kali hosts.
|
|
packages_kali_skip:
|
|
- latencytop
|
|
- cockpit-tests
|
|
- command-not-found
|
|
- fonts-powerline
|
|
|
|
# Packages installed only on non-Kali hosts (legacy packages_non_kali).
|
|
packages_non_kali:
|
|
- latencytop
|
|
- cockpit-tests
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Feature toggles — set false to skip a phase.
|
|
# ---------------------------------------------------------------------------
|
|
run_packages: true
|
|
run_system_config: true
|
|
run_oam: true
|
|
run_security_ssh: true
|
|
run_security_wazuh: true
|
|
run_security_2fa: true
|
|
run_security_scap_stig: true
|
|
run_security_audit: false # was commented out in the legacy runner
|