feat(cmdb): seed tooling — inventory→CSV converter + 87-CI seed v0 [#705]

P0 of the CMDB/change-control plan (design: Discourse t/319). Regenerates
the GLPI seed dataset from the #307 inventory raw; re-runnable whenever
#307 changes. AGENTS.md: cmdb/ layout entry + Key Scripts row.

Meat + plan: https://projects.knownelement.com/issues/705#note-4004

AGENTS.md

@@ -363,6 +363,7 @@ oam/                OAM platform tooling (oxidized, unpoller, smokeping, netdisc
                     librenms-agent: check_mk agent + snmp-extend scripts ported from KNELServerBuild [#474])
 proxmox/            Proxmox fleet docs (hardware audit, capacity, storage) + perf tuning (perf/)
 awx/                Ansible AWX deployment (k3s + AWX Operator)
+cmdb/               GLPI/CMDB seed tooling (inventory→CSV converter; design: Discourse t/319, #705)
 tests/              Test suite + VM validation harness + remote.sh SSH chokepoint
 scripts/            Framework: git hooks, rule engine (check-rules.sh), shared lib
 docs/               Server-build docs, docmap index, and archive
@@ -612,6 +613,7 @@ live in the centralized store at `~/.creds/discourse.env`.
 | [`netinfra/dns-cluster-setup/remote-dns.sh`](netinfra/dns-cluster-setup/remote-dns.sh) | SSH chokepoint for DNS infra hosts (netinfra-01/02, netboot) |
 | [`netinfra/dns/technitium/zone-snapshot.sh`](netinfra/dns/technitium/zone-snapshot.sh) | Refresh git SoR Technitium zone snapshots from the primary — **required after every DNS change** |
 | [`netinfra/dns/drift-check.sh`](netinfra/dns/drift-check.sh) | Live-vs-git drift audit for DHCP/DNS/NTP/zones — must be green before any DNS-adjacent push |
+| [`cmdb/seed/from-inventory.sh`](cmdb/seed/from-inventory.sh) | Regenerate the CMDB seed CSV from the Discourse #307 inventory raw (re-run when #307 changes) |
 | `redmine-cli` container | Redmine CLI (ticket read/write via `docker run`; see `tooling-cli/redmine/`) |
 | `discourse-cli` container | Discourse CLI (wiki topic read/write via `docker run`; see `tooling-cli/discourse/`) |
 | `dns-cli` container | Technitium DNS CLI (zones, list, add, delete, search, flush; see `tooling-cli/dns/`) |

cmdb/seed/from-inventory.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/bash
+#
+# from-inventory.sh — convert the Discourse #307 system inventory (raw
+# markdown of its wiki post) into the CMDB seed CSV [#705]
+#
+# Input:  raw markdown of https://community.turnsys.com/t/307 (post 385),
+#         fetched e.g. via the discourse-cli raw-API escape hatch
+# Output: cmdb/seed/systems.csv (normalized CI rows; v0 schema)
+#
+# Re-run whenever #307 changes; the CSV is the GLPI import candidate, the
+# markdown topic stays the human-readable inventory.
+#
+set -euo pipefail
+
+if [ $# -ne 1 ] || [ ! -r "$1" ]; then
+  echo "usage: $0 <inv307-raw.md  >systems.csv" >&2
+  exit 2
+fi
+
+echo 'category,ci_name,host_node,vmid,specs,ts_ip,extra_ip,tuned,access,extra,status,source_section'
+
+awk -F'|' '
+  function trim(s) { gsub(/^[ \t]+|[ \t]+$/, "", s); return s }
+  function csv(s) { gsub(/"/, "", s); return "\"" trim(s) "\"" }
+  /^## / {
+    sec = substr($0, 4)
+    sub(/\(.*/, "", sec)
+    gsub(/^[ \t]+|[ \t]+$/, "", sec)
+    next
+  }
+  /^\|/ {
+    if (sec !~ /^[1-6]\./) next
+    for (i = 1; i <= NF; i++) f[i] = trim($i)
+    if (f[2] == "" || f[2] ~ /^-+$/) next
+    if (f[2] == "Host" || f[2] == "VMID" || f[2] == "Name" || f[2] == "DNS Name") next
+    status = (index($0, "RETIRED") > 0) ? "retired" : "active"
+    if (sec ~ /^1\./)
+      printf "%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s\n",
+        "hypervisor", csv(f[2]), "", "",
+        csv(f[3] "; CPU " f[4] "; RAM " f[5]), csv(f[6]), csv(f[8]),
+        csv(f[9]), csv(f[10]), csv("mgmt " f[7]), status, csv("307 s1")
+    else if (sec ~ /^2\./)
+      printf "%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s\n",
+        "vm-prod", csv(f[3]), csv(f[4]), csv(f[2]),
+        csv("CPU " f[5] "; RAM " f[6] "; TS? " f[7]), csv(f[8]), "",
+        csv(f[10]), csv(f[9]), "", status, csv("307 s2")
+    else if (sec ~ /^3\./)
+      printf "%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s\n",
+        "vm-sectestbed", csv(f[3]), "pfv-tsys5", csv(f[2]), "", csv(f[5]),
+        "", csv(f[7]), csv(f[6]), "", status, csv("307 s3")
+    else if (sec ~ /^4\./)
+      printf "%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s\n",
+        "vm-preprod", csv(f[3]), "pfv-tsys5", csv(f[2]), "", csv(f[5]),
+        "", csv(f[7]), csv(f[6]), "", status, csv("307 s4")
+    else if (sec ~ /^5\./)
+      printf "%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s\n",
+        "physical-sbc", csv(f[2]), "", "", "", csv(f[3]), "",
+        "", csv(f[5]), csv("dns " f[4]), status, csv("307 s5")
+    else if (sec ~ /^6\./)
+      printf "%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s\n",
+        "stale-dns-record", csv(f[2]), "", "", "", "", "",
+        "", "", "", "retired", csv("307 s6: " f[4])
+  }
+' "$1"

cmdb/seed/systems.csv

@@ -0,0 +1,88 @@
+category,ci_name,host_node,vmid,specs,ts_ip,extra_ip,tuned,access,extra,status,source_section
+hypervisor,"pfv-tsys1",,,"OptiPlex 9020; CPU 8c; RAM 31Gi","100.121.189.98","10.100.100.1","virtual-host","root","mgmt 192.168.3.11",active,"307 s1"
+hypervisor,"pfv-tsys3",,,"Precision 7510; CPU 8c; RAM 31Gi","100.66.186.10","10.100.100.3","virtual-host","root","mgmt 192.168.2.5",active,"307 s1"
+hypervisor,"pfv-tsys4",,,"Precision T1700; CPU 8c; RAM 15Gi","100.70.77.93","10.100.100.4","virtual-host","root","mgmt 192.168.3.251",active,"307 s1"
+hypervisor,"pfv-tsys5",,,"Precision T7500; CPU 8c; RAM 94Gi","100.87.135.12","10.100.100.5","virtual-host","root","mgmt 192.168.3.250",active,"307 s1"
+hypervisor,"pfv-tsys6",,,"PowerEdge R610; CPU 16c; RAM 125Gi","100.73.35.111","(bond)","virtual-host","root","mgmt 192.168.3.169",active,"307 s1"
+hypervisor,"pfv-tsys7",,,"PowerEdge R620; CPU 24c; RAM 188Gi","100.110.146.27","10.100.100.7","virtual-host","root","mgmt 192.168.0.250",active,"307 s1"
+hypervisor,"pfv-tsys9",,,"OptiPlex 7080; CPU 12c; RAM 23Gi","100.101.158.76","10.100.100.9","virtual-host","root","mgmt 192.168.3.58",active,"307 s1"
+vm-prod,"pfv-bms","tsys1","100","CPU 4c; RAM 6GB; TS? Yes","100.67.108.125",,"-","SSH 22222 (LAN: pfv-bms-lan.knel.net)",,active,"307 s2"
+vm-prod,"tsys-ca","tsys1","101","CPU 2c; RAM 4GB; TS? No (DNS: 100.102.96.24)","-",,"-","NO",,active,"307 s2"
+vm-prod,"pfv-k8s-cnode1","tsys1","102","CPU 2c; RAM 4GB; TS? Yes","100.125.134.53",,"network-latency","localuser",,active,"307 s2"
+vm-prod,"pfv-netinfra-01","tsys1","103","CPU 2c; RAM 4GB; TS? Yes","100.70.181.72",,"network-latency","localuser",,active,"307 s2"
+vm-prod,"tsys-librenms","tsys1","104","CPU 2c; RAM 4GB; TS? No (DNS: 100.86.204.77)","-",,"-","NO",,active,"307 s2"
+vm-prod,"tsys-proxmox-datacenter","tsys1","105","CPU 2c; RAM 2GB; TS? No (DNS: 100.125.183.68)","-",,"-","NO",,active,"307 s2"
+vm-prod,"tsys-ucs-01","tsys1","108","CPU 2c; RAM 6GB; TS? No (DNS: 100.109.13.110)","-",,"-","NO",,active,"307 s2"
+vm-prod,"pfv-k8s-wnode-tsys3","tsys3","313","CPU 8c; RAM 28GB; TS? Yes","100.126.9.112",,"-","localuser",,active,"307 s2"
+vm-prod,"pfv-k8s-wnode-tsys5","tsys5","500","CPU 2c; RAM 12GB; TS? Yes","100.122.252.116",,"-","localuser",,active,"307 s2"
+vm-prod,"devbox-cloudron","tsys5","501","CPU 2c; RAM 4GB; TS? Yes","100.119.72.25",,"-","NO",,active,"307 s2"
+vm-prod,"hfnoc-uisp-preprod","tsys5","515","CPU 2c; RAM 2GB; TS? No","-",,"-","NO",,active,"307 s2"
+vm-prod,"ultix-streaming","tsys5","5111","CPU 4c; RAM 25GB; TS? Yes","100.101.187.119",,"-","NO (do-not-reboot)",,active,"307 s2"
+vm-prod,"ultix-offstage","tsys5","5112","CPU 4c; RAM 22GB; TS? Yes","100.70.119.59",,"-","localuser (do-not-reboot)",,retired,"307 s2"
+vm-prod,"tsys-awx","tsys6","600","CPU 2c; RAM 12GB; TS? No (DNS: 100.91.39.53)","-",,"-","NO",,active,"307 s2"
+vm-prod,"pfv-k8s-wnode-tsys6","tsys6","601","CPU 2c; RAM 98GB; TS? Yes","100.83.49.75",,"-","localuser",,active,"307 s2"
+vm-prod,"pfv-rr-middleware-02","tsys6","602","CPU 2c; RAM 6GB; TS? Yes","100.93.47.4",,"-","NO",,active,"307 s2"
+vm-prod,"pfv-k8s-cnode3","tsys6","603","CPU 4c; RAM 4GB; TS? Yes","100.106.222.18",,"network-latency","localuser",,active,"307 s2"
+vm-prod,"tsys-proxmox-mailgw-01","tsys6","604","CPU 2c; RAM 4GB; TS? No (DNS: 100.68.129.71)","-",,"-","NO",,active,"307 s2"
+vm-prod,"pfv-k8s-wnode-tsys7","tsys7","701","CPU 2c; RAM 98GB; TS? Yes","100.119.240.11",,"-","localuser",,active,"307 s2"
+vm-prod,"hfnoc-uisp","tsys7","702","CPU 2c; RAM 8GB; TS? Yes","100.94.188.89",,"-","NO",,active,"307 s2"
+vm-prod,"rr-middleware-01","tsys7","703","CPU 2c; RAM 6GB; TS? Yes","100.106.54.59",,"-","NO",,active,"307 s2"
+vm-prod,"pfv-k8s-cnode2","tsys7","705","CPU 4c; RAM 4GB; TS? Yes","100.109.34.72",,"network-latency","localuser",,active,"307 s2"
+vm-prod,"kali-rd","tsys7","706","CPU 2c; RAM 6GB; TS? Yes","100.105.136.23",,"-","NO",,active,"307 s2"
+vm-prod,"tsys-siem","tsys7","707","CPU 2c; RAM 8GB; TS? No (DNS: 100.72.35.113)","-",,"-","NO",,active,"307 s2"
+vm-prod,"kali-tsys","tsys7","708","CPU 4c; RAM 6GB; TS? Yes","100.82.30.115",,"-","NO",,active,"307 s2"
+vm-prod,"tsys-voip","tsys7","709","CPU 4c; RAM 4GB; TS? No (DNS: 100.83.126.67)","-",,"-","NO",,active,"307 s2"
+vm-prod,"tsys-umbrel","tsys7","710","CPU 2c; RAM 26GB; TS? No (DNS: 100.66.182.14)","-",,"-","NO",,active,"307 s2"
+vm-prod,"tsys-proxmox-mailgw-02","tsys7","711","CPU 2c; RAM 4GB; TS? No (DNS: 100.126.29.88)","-",,"-","NO",,active,"307 s2"
+vm-prod,"tsys-ucs-02","tsys9","902","CPU 2c; RAM 4GB; TS? No (DNS: 100.68.10.17)","-",,"-","NO",,active,"307 s2"
+vm-prod,"pfv-netinfra-02","tsys9","904","CPU 2c; RAM 4GB; TS? Yes","100.71.171.20",,"network-latency","localuser",,active,"307 s2"
+vm-prod,"pfv-k8s-wnode-tsys9","tsys9","905","CPU 4c; RAM 14GB; TS? Yes","100.95.201.66",,"-","localuser",,active,"307 s2"
+vm-sectestbed,"sectestbed-sandbox",pfv-tsys5,"5000",,"100.64.20.60",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-siem",pfv-tsys5,"5101",,"100.108.121.18",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-proxmox-pve",pfv-tsys5,"5102",,"100.80.72.71",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-proxmox-datacenter",pfv-tsys5,"5103",,"100.94.1.34",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-proxmox-pbs",pfv-tsys5,"5104",,"100.127.238.29",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-awx",pfv-tsys5,"5105",,"100.64.56.24",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-k8s-cnode",pfv-tsys5,"5106",,"100.68.155.111",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-k8s-wnode",pfv-tsys5,"5107",,"100.107.110.89",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-librenms",pfv-tsys5,"5108",,"100.92.94.87",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-netinfra",pfv-tsys5,"5109",,"100.100.220.117",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-cloudron",pfv-tsys5,"51011",,"100.97.140.105",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-hfnoc-uisp",pfv-tsys5,"51012",,"100.101.168.80",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-rancherplatform",pfv-tsys5,"51013",,"100.88.171.10",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-proxmox-mailgw",pfv-tsys5,"51014",,"100.117.24.21",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-ca",pfv-tsys5,"51015",,"100.113.245.124",,"-","NO",,active,"307 s3"
+vm-sectestbed,"sectestbed-voip",pfv-tsys5,"51016",,"100.86.176.105",,"-","NO",,active,"307 s3"
+vm-preprod,"preprod-awx",pfv-tsys5,"53100",,"100.77.216.36",,"-","NO",,active,"307 s4"
+vm-preprod,"preprod-siem",pfv-tsys5,"53101",,"100.98.162.14",,"-","NO",,active,"307 s4"
+vm-preprod,"preprod-rancherplatform",pfv-tsys5,"53102",,"100.126.231.121",,"-","NO",,active,"307 s4"
+vm-preprod,"preprod-proxmoxmailgw",pfv-tsys5,"53103",,"100.114.9.49",,"-","NO",,active,"307 s4"
+vm-preprod,"preprod-ca",pfv-tsys5,"53104",,"100.94.119.5",,"-","NO",,active,"307 s4"
+vm-preprod,"preprod-proxmox-datacenter",pfv-tsys5,"53105",,"100.101.250.10",,"-","NO",,active,"307 s4"
+vm-preprod,"preprod-librenms",pfv-tsys5,"53106",,"100.79.52.34",,"-","NO",,active,"307 s4"
+vm-preprod,"preprod-voip",pfv-tsys5,"53107",,"100.109.99.109",,"-","NO",,active,"307 s4"
+vm-preprod,"preprod-cloudron",pfv-tsys5,"53108",,"100.95.69.89",,"-","NO",,active,"307 s4"
+physical-sbc,"pfvsvrpi",,,,"100.91.151.113",,,"Raspberry Pi","dns pfvsvrki.knel.net",active,"307 s5"
+physical-sbc,"pfv-jetson-nano-1",,,,"100.82.230.119",,,"NVIDIA Jetson","dns pfv-jetson-nano-1.knel.net",active,"307 s5"
+physical-sbc,"subopi-dev-3",,,,"100.64.231.65",,,"SBC (Pi?)","dns subopi-dev-3.knel.net",active,"307 s5"
+physical-sbc,"subopi-dev-4",,,,"-",,,"SBC","dns subopi-dev-4.knel.net (100.65.224.85)",active,"307 s5"
+physical-sbc,"subopi3",,,,"-",,,"SBC","dns subopi3.knel.net (100.93.17.77)",active,"307 s5"
+physical-sbc,"stlpc-artroom",,,,"100.120.77.113",,,"Linux PC","dns stlpc-artroom.knel.net",active,"307 s5"
+physical-sbc,"stlpc-garage",,,,"100.72.192.22",,,"Linux PC","dns stlpc-garage.knel.net",active,"307 s5"
+physical-sbc,"stlp-3dscanner",,,,"100.125.14.37",,,"OFFLINE 184d","dns stlp-3dscanner.knel.net",active,"307 s5"
+physical-sbc,"tailscale-router",,,,"-",,,"**RETIRED 2026-09-02** — subnet-router role replaced by pfv-netinfra-01/02; host removed from tailnet; no DNS records remain","dns ~~tailscale-router.knel.net (100.103.48.57)~~",retired,"307 s5"
+physical-sbc,"netbird",,,,"100.123.45.23",,,"NetBird VPN","dns -",active,"307 s5"
+physical-sbc,"pfv-proxmox-backup-server",,,,"100.114.81.107",,,"PBS","dns pfv-proxmox-backup-server.knel.net",active,"307 s5"
+physical-sbc,"siter-bizoffice",,,,"100.96.130.53",,,"WINDOWS (not Linux)","dns stlpc-bizoffice.knel.net",active,"307 s5"
+stale-dns-record,"pfv-tsys2",,,,,,,,,retired,"307 s6: Host does not exist in fleet"
+stale-dns-record,"tsys-cloudron",,,,,,,,,retired,"307 s6: No VM with this name (use devbox-cloudron?)"
+stale-dns-record,"knelai-highassurance",,,,,,,,,retired,"307 s6: Not in Tailscale status"
+stale-dns-record,"knelai-prod",,,,,,,,,retired,"307 s6: Not in Tailscale status"
+stale-dns-record,"cnw-worker",,,,,,,,,retired,"307 s6: Not in Tailscale status"
+stale-dns-record,"fastdata",,,,,,,,,retired,"307 s6: Not in Tailscale status"
+stale-dns-record,"mpi-01 through mpi-04",,,,,,,,,retired,"307 s6: Not in Tailscale status"
+stale-dns-record,"peertube-01 through peertube-04",,,,,,,,,retired,"307 s6: Not in Tailscale status"
+stale-dns-record,"ultix",,,,,,,,,retired,"307 s6: Not in Tailscale status"
+stale-dns-record,"ultix-field",,,,,,,,,retired,"307 s6: Not in Tailscale status"
+stale-dns-record,"ultix-highside",,,,,,,,,retired,"307 s6: Not in Tailscale status"
+stale-dns-record,"tailscale-router",,,,,,,,,retired,"307 s6: **RETIRED 2026-09-02** — host removed from tailnet; subnet-router role replaced by pfv-netinfra-01/02"