From 81291ccc6d88a36cc9cab31f6df231d76b93efd3 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 10:16:28 +0200 Subject: [PATCH 01/16] chore(ci): add CI workflow and Dependabot hardening - CI runs inside containerised Debian/Python/Node images (not bare ubuntu-latest) - Dependabot enabled for package ecosystem + github-actions --- .github/dependabot.yml | 12 ++++++++++++ .github/workflows/ci.yml | 18 ++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/ci.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..8d1b0a07 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +version: 2 +updates: + - package-ecosystem: pip + directory: / + schedule: + interval: weekly + labels: [dependencies] + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + labels: [dependencies, ci] diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 00000000..5903aca8 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,18 @@ +name: CI +on: + push: + branches: [main, dev, 'feature/**', 'feat/**'] + pull_request: + branches: [main, dev] +jobs: + lint-and-test: + name: Ruff + Pytest + runs-on: ubuntu-latest + container: + image: python:3.13-slim + steps: + - run: apt-get update && apt-get install -y --no-install-recommends git + - uses: actions/checkout@v4 + - run: pip install --no-cache-dir -e ".[dev]" + - run: ruff check . + - run: pytest tests/ --tb=short -q From 707e99b626216c9792a9907d92ed15f333ee45ae Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 10:23:45 +0200 Subject: [PATCH 02/16] fix(ci): split workflow into ansible-lint + conditional python jobs dev branch has no pyproject.toml (Python package lives on feat/r42playbooks-generator). The previous single job failed with "does not appear to be a Python project". Now: - ansible-lint always runs on bundles/ - ruff+pytest only run when pyproject.toml exists (hashFiles guard) --- .github/workflows/ci.yml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5903aca8..050a0bd6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,11 +5,23 @@ on: pull_request: branches: [main, dev] jobs: - lint-and-test: + ansible-lint: + name: Ansible Lint + runs-on: ubuntu-latest + container: + image: python:3.13-slim + steps: + - run: apt-get update && apt-get install -y --no-install-recommends git + - uses: actions/checkout@v4 + - run: pip install --no-cache-dir ansible-lint + - run: ansible-lint bundles/ --profile=production + + python: name: Ruff + Pytest runs-on: ubuntu-latest container: image: python:3.13-slim + if: hashFiles('pyproject.toml') != '' steps: - run: apt-get update && apt-get install -y --no-install-recommends git - uses: actions/checkout@v4 From 443de076f431e5a79f2f5299b000d997e030b4e2 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 10:39:11 +0200 Subject: [PATCH 03/16] fix(ci): fix python job condition and relax ansible-lint profile Job-level hashFiles() evaluates before checkout so the workspace is always empty; replace with a step-level shell test writing to GITHUB_OUTPUT. Also drop --profile=production (incompatible with org conventions) and add .ansible-lint config with profile:basic. --- .ansible-lint | 11 +++++++++++ .github/workflows/ci.yml | 14 +++++++++----- 2 files changed, 20 insertions(+), 5 deletions(-) create mode 100644 .ansible-lint diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 00000000..7fe9cac0 --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,11 @@ +profile: basic + +skip_list: + # SCREAMING_SNAKE is the documented convention for infrastructure-wide vars + - var-naming[pattern] + # noun.verb role naming is the documented convention + - role-name + +warn_list: + - yaml[line-length] + - risky-shell-pipe diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 050a0bd6..38c2e093 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,17 +14,21 @@ jobs: - run: apt-get update && apt-get install -y --no-install-recommends git - uses: actions/checkout@v4 - run: pip install --no-cache-dir ansible-lint - - run: ansible-lint bundles/ --profile=production + - run: ansible-lint bundles/ python: name: Ruff + Pytest runs-on: ubuntu-latest container: image: python:3.13-slim - if: hashFiles('pyproject.toml') != '' steps: - run: apt-get update && apt-get install -y --no-install-recommends git - uses: actions/checkout@v4 - - run: pip install --no-cache-dir -e ".[dev]" - - run: ruff check . - - run: pytest tests/ --tb=short -q + - id: pycheck + run: test -f pyproject.toml && echo "exists=true" >> "$GITHUB_OUTPUT" || echo "exists=false" >> "$GITHUB_OUTPUT" + - if: "steps.pycheck.outputs.exists == 'true'" + run: pip install --no-cache-dir -e ".[dev]" + - if: "steps.pycheck.outputs.exists == 'true'" + run: ruff check . + - if: "steps.pycheck.outputs.exists == 'true'" + run: pytest tests/ --tb=short -q From 55e6c928a17e0c3c21abbd376612d5cfb35e5a17 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 10:48:27 +0200 Subject: [PATCH 04/16] fix(ci): expand ansible-lint skip_list for bundles (syntax-check, name rules) --- .ansible-lint | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.ansible-lint b/.ansible-lint index 7fe9cac0..06c352b9 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -5,7 +5,19 @@ skip_list: - var-naming[pattern] # noun.verb role naming is the documented convention - role-name + # bundles reference roles from range42-catalog, which is not checked out in CI + - syntax-check + # generated scenario playbooks do not require play-level names + - name[play] + # pre-existing task naming convention: lowercase names throughout bundles + - name[casing] + # generated bundles include tasks without explicit names + - name[missing] + # Jinja template syntax in task names is intentional (loop items, vars) + - name[template] warn_list: - yaml[line-length] + - yaml[empty-lines] + - yaml[trailing-spaces] - risky-shell-pipe From 413fa3d80b3fe3a32902ece6eebb75bf1b9a44b4 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 11:00:52 +0200 Subject: [PATCH 05/16] fix(ci): replace unskippable syntax-check with mock_roles for cross-repo stubs ansible-lint 6.x rejects syntax-check in skip_list; stub the catalog and proxmox-controller roles with mock_roles so syntax-check passes without cross-repo checkouts. --- .ansible-lint | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.ansible-lint b/.ansible-lint index 06c352b9..f929f97b 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -5,8 +5,6 @@ skip_list: - var-naming[pattern] # noun.verb role naming is the documented convention - role-name - # bundles reference roles from range42-catalog, which is not checked out in CI - - syntax-check # generated scenario playbooks do not require play-level names - name[play] # pre-existing task naming convention: lowercase names throughout bundles @@ -21,3 +19,15 @@ warn_list: - yaml[empty-lines] - yaml[trailing-spaces] - risky-shell-pipe + +# catalog and cross-repo roles not checked out in CI — stub so syntax-check passes +mock_roles: + - range42-ansible_roles-proxmox_controller + - ansible.utils + - indexer + - software.configure.tailscale_disable_nftables + - software.install.tailscale + - software.install.wazuh-dashboard + - software.install.wazuh-filebeat-oss + - software.install.wazuh-indexer + - software.install.wazuh-manager From 18e15f918e2622041608c0ed01c0f4ef2917439b Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 11:11:00 +0200 Subject: [PATCH 06/16] fix(ci): add missing catalog roles to mock_roles + skip jinja[spacing] + stub global_vm_ssh_name --- .ansible-lint | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.ansible-lint b/.ansible-lint index f929f97b..e25c0521 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -13,6 +13,8 @@ skip_list: - name[missing] # Jinja template syntax in task names is intentional (loop items, vars) - name[template] + # pre-existing {{ item.ID}} spacing in generated bundles — cosmetic only + - jinja[spacing] warn_list: - yaml[line-length] @@ -25,9 +27,20 @@ mock_roles: - range42-ansible_roles-proxmox_controller - ansible.utils - indexer + - software.configure.docker-compose + - software.configure.firewalls - software.configure.tailscale_disable_nftables + - software.install.nodejs_app_systemd + - software.install.symlinks_farm - software.install.tailscale + - software.install.warmup.basic_packages + - software.install.warmup.dot_files - software.install.wazuh-dashboard - software.install.wazuh-filebeat-oss - software.install.wazuh-indexer - software.install.wazuh-manager + - systems.configure.add_user + +# vars defined at runtime via inventory/group_vars — stub for CI syntax-check +extra_vars: + global_vm_ssh_name: ci_mock From 05824201ac635327ec9f816cfa8fc695d75f0615 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 11:19:48 +0200 Subject: [PATCH 07/16] fix(ci): add software.install.wazuh-agent to mock_roles Role lives in range42-catalog which is not checked out in CI; stub it so ansible-lint syntax-check passes. --- .ansible-lint | 1 + 1 file changed, 1 insertion(+) diff --git a/.ansible-lint b/.ansible-lint index e25c0521..2ff7ff37 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -40,6 +40,7 @@ mock_roles: - software.install.wazuh-indexer - software.install.wazuh-manager - systems.configure.add_user + - software.install.wazuh-agent # vars defined at runtime via inventory/group_vars — stub for CI syntax-check extra_vars: From 4d7d9736260390e0e471e986ea3b660e7c32a555 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 11:56:55 +0200 Subject: [PATCH 08/16] =?UTF-8?q?ci(workflow):=20fix=20push=20branch=20tri?= =?UTF-8?q?ggers=20=E2=80=94=20feat/**=20+=20fix/**=20replace=20feature/**?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 38c2e093..2802da8b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,7 +1,7 @@ name: CI on: push: - branches: [main, dev, 'feature/**', 'feat/**'] + branches: [main, dev, 'feat/**', 'fix/**'] pull_request: branches: [main, dev] jobs: From f9f5f5171c9cee9ecc020d4d116406180a0fe2c3 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 12:16:56 +0200 Subject: [PATCH 09/16] chore(ci): bump actions/checkout to v6 --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2802da8b..6aa3390f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ jobs: image: python:3.13-slim steps: - run: apt-get update && apt-get install -y --no-install-recommends git - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - run: pip install --no-cache-dir ansible-lint - run: ansible-lint bundles/ @@ -23,7 +23,7 @@ jobs: image: python:3.13-slim steps: - run: apt-get update && apt-get install -y --no-install-recommends git - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - id: pycheck run: test -f pyproject.toml && echo "exists=true" >> "$GITHUB_OUTPUT" || echo "exists=false" >> "$GITHUB_OUTPUT" - if: "steps.pycheck.outputs.exists == 'true'" From cde14404e1872c860239c4c93aee60108d041fa5 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 12:35:06 +0200 Subject: [PATCH 10/16] chore(ci): upgrade ruff check to --select ALL --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6aa3390f..899f926c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,6 +29,6 @@ jobs: - if: "steps.pycheck.outputs.exists == 'true'" run: pip install --no-cache-dir -e ".[dev]" - if: "steps.pycheck.outputs.exists == 'true'" - run: ruff check . + run: ruff check --select ALL . - if: "steps.pycheck.outputs.exists == 'true'" run: pytest tests/ --tb=short -q From 90d37d8675a268848c8ea9d6efadf2b33c01cb88 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 9 Jun 2026 12:39:16 +0200 Subject: [PATCH 11/16] =?UTF-8?q?chore(ci):=20scope=20ruff=20to=20r42playb?= =?UTF-8?q?ooks/=20=E2=80=94=20exclude=20tests=20from=20--select=20ALL?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 899f926c..fa4a423e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,6 +29,6 @@ jobs: - if: "steps.pycheck.outputs.exists == 'true'" run: pip install --no-cache-dir -e ".[dev]" - if: "steps.pycheck.outputs.exists == 'true'" - run: ruff check --select ALL . + run: ruff check --select ALL r42playbooks/ - if: "steps.pycheck.outputs.exists == 'true'" run: pytest tests/ --tb=short -q From 8811eb2c61de2feb0d82c40ea9d1a17703b80cf5 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 11 Aug 2026 16:06:42 +0200 Subject: [PATCH 12/16] fix(lint): normalize bundle YAML to pass ansible-lint basic profile Behavior-preserving: null vars: becomes vars: {}, when: moves above block: (key-order), empty play name: keys removed, vars_files indentation normalized. Verified: ansible-lint bundles/ exits 0 on profile basic (0 failures, 21 warnings) with ansible-lint 26.6.0. --- .../vms/create-vms-admin/stage_00/builder_api_devkit.yml | 2 +- .../create-vms-admin/stage_00/builder_docker_registry.yml | 2 +- .../create-vms-admin/stage_00/deployer_api_backend.yml | 2 +- .../create-vms-admin/stage_00/deployer_api_gateway.yml | 2 +- .../default/vms/create-vms-admin/stage_00/deployer_ui.yml | 2 +- .../default/vms/create-vms-admin/stage_00/mon_wazuh.yml | 4 ++-- .../default/vms/create-vms-admin/stage_01/_r42_admin.yml | 5 ++--- .../default/vms/create-vms-admin/stage_01/deployer_ui.yml | 3 +-- .../default/vms/create-vms-admin/stage_01/mon_wazuh.yml | 8 ++++---- .../vms/create-vms-student/stage_00/student_box_01.yml | 2 +- .../stage_01/_r42_student_box_group.yml | 5 ++--- .../default/vms/create-vms-vuln/stage_00/vuln_box_00.yml | 2 +- .../default/vms/create-vms-vuln/stage_00/vuln_box_01.yml | 2 +- .../default/vms/create-vms-vuln/stage_00/vuln_box_02.yml | 2 +- .../default/vms/create-vms-vuln/stage_00/vuln_box_03.yml | 2 +- .../default/vms/create-vms-vuln/stage_00/vuln_box_04.yml | 2 +- .../vms/create-vms-vuln/stage_01/_r42_vuln_box_group.yml | 5 ++--- 17 files changed, 24 insertions(+), 28 deletions(-) diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_api_devkit.yml b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_api_devkit.yml index 6cc3d41e..59a43c0d 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_api_devkit.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_api_devkit.yml @@ -21,7 +21,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml # diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_docker_registry.yml b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_docker_registry.yml index 0b0e4a98..3e6505f6 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_docker_registry.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_docker_registry.yml @@ -21,7 +21,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml # diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_backend.yml b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_backend.yml index b4e7d901..a70e6f3d 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_backend.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_backend.yml @@ -21,7 +21,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml # diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_gateway.yml b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_gateway.yml index 61f0342c..342bbc92 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_gateway.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_gateway.yml @@ -21,7 +21,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml # diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_ui.yml b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_ui.yml index a0b92918..5d7562c1 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_ui.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_ui.yml @@ -21,7 +21,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml # diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/mon_wazuh.yml b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/mon_wazuh.yml index e4f71374..405dfd49 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/mon_wazuh.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/mon_wazuh.yml @@ -19,9 +19,9 @@ - hosts: proxmox gather_facts: false vars_files: - - "../../secrets/default_vault.yml" + - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml # diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/_r42_admin.yml b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/_r42_admin.yml index 313de6fe..46f5c5a9 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/_r42_admin.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/_r42_admin.yml @@ -112,10 +112,9 @@ INSTALL_TAILSCALE: "YES" # variables defined in main tasks: - - block: + - when: INSTALL_TAILSCALE == "YES" + block: - include_role: name: software.install.tailscale - include_role: name: software.configure.tailscale_disable_nftables - - when: INSTALL_TAILSCALE == "YES" diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/deployer_ui.yml b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/deployer_ui.yml index 45fc3a10..3b9d30e7 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/deployer_ui.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/deployer_ui.yml @@ -2,8 +2,7 @@ # # -- name: - become: true +- become: true hosts: r42.admin-deployer-ui roles: - software.install.nodejs_app_systemd diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/mon_wazuh.yml b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/mon_wazuh.yml index 8da7f4da..f86bacb8 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/mon_wazuh.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_01/mon_wazuh.yml @@ -35,7 +35,7 @@ # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### - hosts: r42.admin-wazuh - become: yes + become: true become_user: root roles: - role: software.install.wazuh-indexer @@ -63,7 +63,7 @@ # # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### - hosts: r42.admin-wazuh - become: yes + become: true vars_files: - "../../secrets/default_vault.yml" vars: @@ -81,7 +81,7 @@ - name: EXEC wazuh-passwords-tool.sh - if CHANGE_WAZUH_PASSWORD is true hosts: r42.admin-wazuh - become: yes + become: true become_user: root vars_files: - "../../secrets/default_vault.yml" @@ -110,7 +110,7 @@ # wazuh deploy agent - hosts: r42_admin_wazuh_clients - become: yes + become: true become_user: root roles: - software.install.wazuh-agent diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-student/stage_00/student_box_01.yml b/bundles/core/proxmox/configure/default/vms/create-vms-student/stage_00/student_box_01.yml index 33be476f..ea1c0684 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-student/stage_00/student_box_01.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-student/stage_00/student_box_01.yml @@ -18,7 +18,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml # diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-student/stage_01/_r42_student_box_group.yml b/bundles/core/proxmox/configure/default/vms/create-vms-student/stage_01/_r42_student_box_group.yml index 85f02823..9720484f 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-student/stage_01/_r42_student_box_group.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-student/stage_01/_r42_student_box_group.yml @@ -98,10 +98,9 @@ INSTALL_TAILSCALE: "YES" # variables defined in main tasks: - - block: + - when: INSTALL_TAILSCALE == "YES" + block: - include_role: name: software.install.tailscale - include_role: name: software.configure.tailscale_disable_nftables - - when: INSTALL_TAILSCALE == "YES" diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_00.yml b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_00.yml index 0b59797a..ee37f64c 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_00.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_00.yml @@ -19,7 +19,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_01.yml b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_01.yml index aa71b41c..470cc2dd 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_01.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_01.yml @@ -20,7 +20,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_02.yml b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_02.yml index aa71b41c..470cc2dd 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_02.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_02.yml @@ -20,7 +20,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_03.yml b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_03.yml index aa71b41c..470cc2dd 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_03.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_03.yml @@ -20,7 +20,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_04.yml b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_04.yml index aa71b41c..470cc2dd 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_04.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_00/vuln_box_04.yml @@ -20,7 +20,7 @@ vars_files: - "../../secrets/default_vault.yml" - vars: + vars: {} # # variables will be overwrited by values in _main.yml diff --git a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_01/_r42_vuln_box_group.yml b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_01/_r42_vuln_box_group.yml index a6edaab8..768cdc71 100644 --- a/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_01/_r42_vuln_box_group.yml +++ b/bundles/core/proxmox/configure/default/vms/create-vms-vuln/stage_01/_r42_vuln_box_group.yml @@ -102,10 +102,9 @@ INSTALL_TAILSCALE: "NO" # variables defined in main tasks: - - block: + - when: INSTALL_TAILSCALE == "YES" + block: - include_role: name: software.install.tailscale - include_role: name: software.configure.tailscale_disable_nftables - - when: INSTALL_TAILSCALE == "YES" From 3ac2d683faff00da8e3111f24885ffaafb75a6ea Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 11 Aug 2026 16:06:43 +0200 Subject: [PATCH 13/16] chore(ci): pin ansible-lint, default ruff rule set, document mock_roles - pin ansible-lint==26.6.0 so a lint release cannot turn the gate red without a repo change - drop ruff --select ALL (not recommended upstream) in favor of an E9,F baseline defined in .ruff.toml, same as the range42 repo - note on mock_roles that the list is hand-maintained and belongs on the catalog role-rename checklist - ignore .ansible/ (ansible-lint mock-role cache) --- .ansible-lint | 5 ++++- .github/workflows/ci.yml | 4 ++-- .gitignore | 3 +++ .ruff.toml | 6 ++++++ 4 files changed, 15 insertions(+), 3 deletions(-) create mode 100644 .ruff.toml diff --git a/.ansible-lint b/.ansible-lint index 2ff7ff37..ece2484e 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -22,7 +22,10 @@ warn_list: - yaml[trailing-spaces] - risky-shell-pipe -# catalog and cross-repo roles not checked out in CI — stub so syntax-check passes +# catalog and cross-repo roles not checked out in CI — stub so syntax-check passes. +# Hand-maintained: when a bundle starts using a new catalog role, add it here, +# and when a catalog role is renamed, update it here too — otherwise CI fails +# with an unresolved-role error. mock_roles: - range42-ansible_roles-proxmox_controller - ansible.utils diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fa4a423e..63e895a3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,7 +13,7 @@ jobs: steps: - run: apt-get update && apt-get install -y --no-install-recommends git - uses: actions/checkout@v6 - - run: pip install --no-cache-dir ansible-lint + - run: pip install --no-cache-dir ansible-lint==26.6.0 - run: ansible-lint bundles/ python: @@ -29,6 +29,6 @@ jobs: - if: "steps.pycheck.outputs.exists == 'true'" run: pip install --no-cache-dir -e ".[dev]" - if: "steps.pycheck.outputs.exists == 'true'" - run: ruff check --select ALL r42playbooks/ + run: ruff check r42playbooks/ - if: "steps.pycheck.outputs.exists == 'true'" run: pytest tests/ --tb=short -q diff --git a/.gitignore b/.gitignore index 9b718e0c..f2befc67 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,6 @@ **/secret/ CLAUDE.md **/CLAUDE.md + +# ansible-lint runtime cache (mock roles) +.ansible/ diff --git a/.ruff.toml b/.ruff.toml new file mode 100644 index 00000000..59f31441 --- /dev/null +++ b/.ruff.toml @@ -0,0 +1,6 @@ +# CI gate: syntax errors (E9) and pyflakes (F) — undefined names, unused +# imports, broken f-strings. Same baseline as the range42 bootstrapper repo. +# Tighten (or move into pyproject.toml [tool.ruff]) when the r42playbooks +# package lands and owns its own lint policy. +[lint] +select = ["E9", "F"] From beb2f386417603186615d0d07d999979cec2c1e0 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 11 Aug 2026 16:25:34 +0200 Subject: [PATCH 14/16] fix(lint): normalize new admin/generic/ctf bundle YAML via ansible-lint --fix Style-only: colon/comma spacing, quote style, key-order (when above block), long-line folds. dev's new bundle trees (admin_services_lab, generic baselines, ctf CVEs) had never been linted. --- .../bundle_parameters.src.yml | 3 +- .../main.yml | 9 ++-- .../bundle_parameters.src.yml | 7 ++-- .../software.install.deployer_ui/main.yml | 9 ++-- .../bundle_parameters.src.yml | 1 - bundles/admin/software.install.gitea/main.yml | 35 ++++++++-------- .../bundle_parameters.src.yml | 1 - bundles/admin/software.install.kong/main.yml | 1 + .../software.install.mattermost/main.yml | 35 ++++++++-------- .../software.install.misp_standalone/main.yml | 33 ++++++++------- .../admin/software.install.nextcloud/main.yml | 35 ++++++++-------- .../software.install.rocketchat/main.yml | 35 ++++++++-------- .../bundle_parameters.src.yml | 1 - bundles/admin/software.install.wazuh/main.yml | 17 ++++---- .../software.install.wazuh_agent/main.yml | 5 +-- .../cve/crypto/openssl/CVE-2014-0160/main.yml | 1 + .../cve/crypto/openssl/CVE-2022-0778/main.yml | 1 + .../erlang-ssh/CVE-2025-32433/main.yml | 1 + .../network/openssh/CVE-2018-15473/main.yml | 1 + .../network/openssh/CVE-2024-6387/main.yml | 1 + .../cve/system/sudo/CVE-2023-22809/main.yml | 1 + .../cve/system/sudo/CVE-2025-32462/main.yml | 1 + .../cve/system/sudo/CVE-2025-32463/main.yml | 1 + .../cve/web/apache/CVE-2021-42013/main.yml | 1 + .../ctf/cve/web/pdfjs/CVE-2024-4367/main.yml | 1 + .../ctf/cve/web/php/CVE-2019-11043/main.yml | 1 + .../cve/web/tomcat/CVE-2025-24813/main.yml | 1 + .../cve/web/uwsg_php/CVE-2018-7490/main.yml | 1 + .../ctf/cve/web/vite/CVE-2025-30208/main.yml | 1 + .../network/vsftpd/ftp_anon_server/main.yml | 1 + .../misconfiguration/system/lpe-01/main.yml | 1 + .../main.yml | 3 +- .../network.baseline.deployer_ui/main.yml | 3 +- .../generic/network.baseline.kong/main.yml | 3 +- bundles/generic/network.baseline.ssh/main.yml | 1 + .../bundle_parameters.src.yml | 1 - .../network.baseline.ssh_http/main.yml | 5 ++- .../main.yml | 5 ++- .../bundle_parameters.src.yml | 1 - .../network.configure.ufw_rules/main.yml | 1 + .../repo.clone.kunai_workshop/main.yml | 13 +++--- .../repo.clone/bundle_parameters.src.yml | 1 - bundles/generic/repo.clone/main.yml | 22 +++++----- .../generic/systems.baseline.default/main.yml | 1 + .../systems.baseline.docker_host/main.yml | 1 + .../systems.baseline.with_utils/main.yml | 1 + bundles/generic/systems.checks.ping/main.yml | 3 +- .../bundle_parameters.src.yml | 1 - .../systems.configure.terminfo/main.yml | 11 ++--- .../cloud_init_image.download.all/main.yml | 1 + .../cloud_init_image.download.alpine/main.yml | 1 + .../cloud_init_image.download.debian/main.yml | 1 + .../main.yml | 1 + .../main.yml | 1 + .../00-template-vm-alpine-nano.yml | 5 ++- .../bundle_parameters.src.yml | 1 - .../proxmox/template.build.alpine/main.yml | 6 +-- .../00-template-vm-debian-nano.yml | 5 ++- .../bundle_parameters.src.yml | 1 - .../proxmox/template.build.debian/main.yml | 6 +-- .../00-template-vm-nano.yml | 5 ++- .../01-template-vm-micro-01-2g-24g.yml | 5 ++- .../01-template-vm-micro-02-2g-24g.yml | 5 ++- .../02-template-vm-small-01-4g-32g.yml | 5 ++- .../02-template-vm-small-02-4g-32g.yml | 5 ++- .../02-template-vm-small-04-4g-32g.yml | 5 ++- .../03-template-vm-medium-02-8g-64g.yml | 5 ++- .../03-template-vm-medium-04-8g-64g.yml | 5 ++- .../03-template-vm-medium-06-8g-64g.yml | 5 ++- .../04-template-vm-large-04-8g-64g.yml | 5 ++- .../04-template-vm-large-06-8g-64g.yml | 5 ++- .../04-template-vm-large-08-8g-64g.yml | 5 ++- .../_apply_apt_proxy.yml | 29 ++++++------- .../_update_templates.yml | 4 +- .../template.build.ubuntu_noble/main.yml | 41 ++++++------------- .../test_setup_templates.yml | 1 + .../vm.bootstrap/bundle_parameters.src.yml | 1 - bundles/proxmox/vm.bootstrap/main.yml | 5 +-- 78 files changed, 253 insertions(+), 237 deletions(-) diff --git a/bundles/admin/software.install.deployer_api_backend/bundle_parameters.src.yml b/bundles/admin/software.install.deployer_api_backend/bundle_parameters.src.yml index 987c0c0f..b2831c6d 100644 --- a/bundles/admin/software.install.deployer_api_backend/bundle_parameters.src.yml +++ b/bundles/admin/software.install.deployer_api_backend/bundle_parameters.src.yml @@ -8,7 +8,6 @@ optional: true install_flag: INSTALL_DEPLOYER_API_BACKEND params: - - name: global_vm_ssh_name target: true type: string @@ -61,7 +60,7 @@ params: type: string required: false default_where: bundle-inline - default: '^https?://r42\.admin-deployer-ui(:\d+)?$' + default: "^https?://r42\\.admin-deployer-ui(:\\d+)?$" description: Anchored CORS origin regex written to the backend .env so the deployer-ui browser Origin is accepted. - name: INSTALL_TAILSCALE diff --git a/bundles/admin/software.install.deployer_api_backend/main.yml b/bundles/admin/software.install.deployer_api_backend/main.yml index 4edc305b..efe30094 100644 --- a/bundles/admin/software.install.deployer_api_backend/main.yml +++ b/bundles/admin/software.install.deployer_api_backend/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.deployer_api_backend/main.yml # ============================================================================ @@ -164,15 +165,15 @@ tailscale_authkey: "{{ infrastructure_tailscale_authkey }}" tasks: - name: Install + configure tailscale on the backend VM (opt-in via INSTALL_TAILSCALE=YES) + when: INSTALL_TAILSCALE | default('NO') | upper == "YES" + +# ============================================================================ + block: - include_role: name: software.install.tailscale - include_role: name: software.configure.tailscale_disable_nftables - when: INSTALL_TAILSCALE | default('NO') | upper == "YES" - -# ============================================================================ - - name: install deployer-api-backend - workspace + playbooks + source sync + .env + compose up hosts: "{{ global_vm_ssh_name }}" become: true diff --git a/bundles/admin/software.install.deployer_ui/bundle_parameters.src.yml b/bundles/admin/software.install.deployer_ui/bundle_parameters.src.yml index 77d3584c..7f9f548d 100644 --- a/bundles/admin/software.install.deployer_ui/bundle_parameters.src.yml +++ b/bundles/admin/software.install.deployer_ui/bundle_parameters.src.yml @@ -1,14 +1,14 @@ --- bundle: admin/software.install.deployer_ui -description: Deploy range42-deployer-ui as a Docker container (multi-stage build then nginx SPA on UI_PORT) with firewall, optional tailscale, and a /health probe. +description: Deploy range42-deployer-ui as a Docker container (multi-stage build then nginx SPA on UI_PORT) with firewall, optional tailscale, and a /health + probe. optional: true install_flag: INSTALL_DEPLOYER_UI params: - - name: global_vm_ssh_name target: true type: string @@ -47,7 +47,8 @@ params: type: string required: false default_where: none - description: Backend-api base URL rendered into public/config.json before the Docker build, so the SPA registers this deployment's backend on first launch. Unset means no config.json is rendered and the operator sets the backend by hand in the Settings modal. + description: Backend-api base URL rendered into public/config.json before the Docker build, so the SPA registers this deployment's backend on first launch. + Unset means no config.json is rendered and the operator sets the backend by hand in the Settings modal. - name: PROXMOX_NODE_NAME type: string diff --git a/bundles/admin/software.install.deployer_ui/main.yml b/bundles/admin/software.install.deployer_ui/main.yml index 4722f3ce..7ff3bdb6 100644 --- a/bundles/admin/software.install.deployer_ui/main.yml +++ b/bundles/admin/software.install.deployer_ui/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.deployer_ui/main.yml # ============================================================================ @@ -121,15 +122,15 @@ tailscale_authkey: "{{ infrastructure_tailscale_authkey }}" tasks: - name: Install + configure tailscale on the UI VM (opt-in via INSTALL_TAILSCALE=YES) + when: INSTALL_TAILSCALE | default('NO') | upper == "YES" + +# ============================================================================ + block: - include_role: name: software.install.tailscale - include_role: name: software.configure.tailscale_disable_nftables - when: INSTALL_TAILSCALE | default('NO') | upper == "YES" - -# ============================================================================ - - name: install deployer-ui - sync source + .env + docker compose up hosts: "{{ global_vm_ssh_name }}" become: true diff --git a/bundles/admin/software.install.gitea/bundle_parameters.src.yml b/bundles/admin/software.install.gitea/bundle_parameters.src.yml index 42c4ccb5..a4677737 100644 --- a/bundles/admin/software.install.gitea/bundle_parameters.src.yml +++ b/bundles/admin/software.install.gitea/bundle_parameters.src.yml @@ -5,7 +5,6 @@ optional: true install_flag: INSTALL_GITEA params: - - name: global_vm_ssh_name target: true type: string diff --git a/bundles/admin/software.install.gitea/main.yml b/bundles/admin/software.install.gitea/main.yml index c3d2f7cd..dea3c3f6 100644 --- a/bundles/admin/software.install.gitea/main.yml +++ b/bundles/admin/software.install.gitea/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.gitea/main.yml # ============================================================================ @@ -34,15 +35,13 @@ # global_vm_ci_ip: "192.168.142.183" # # ============================================================================ - - - name: gitea - ensure catalog .env exists (cp .env.example -> .env if missing) hosts: proxmox gather_facts: false tasks: - name: cp .env.example -> .env if .env absent (force=false respects an existing customized .env) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/gitea/.env.example" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/gitea/.env.example" dest: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/gitea/.env" force: false remote_src: true @@ -56,10 +55,10 @@ roles: - software.install.warmup.basic_packages vars: - INSTALL_PACKAGES_BASICS: "YES" - INSTALL_PACKAGES_DOCKER: "YES" - INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" - INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" + INSTALL_PACKAGES_BASICS: "YES" + INSTALL_PACKAGES_DOCKER: "YES" + INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" + INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### @@ -71,7 +70,7 @@ - software.configure.firewalls vars: firewall_rules: - - { ip: "all", port: 22, protocol: "tcp" } + - { ip: "all", port: 22, protocol: "tcp" } - { ip: "all", port: 3000, protocol: "tcp" } - { ip: "all", port: 2222, protocol: "tcp" } @@ -99,19 +98,19 @@ - name: push .env on the VM (cp .env.example -> .env if .env absent on the VM) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/gitea/.env.example" - dest: "/home/alice/gitea/.env" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/gitea/.env.example" + dest: "/home/alice/gitea/.env" owner: "alice" group: "alice" - mode: "0600" + mode: "0600" force: false roles: - software.configure.docker-compose vars: - LABEL_PROJECT_TYPE: "admin" - LABEL_PROJET_NAME: "gitea" - LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/gitea" - REMOTE_PROJECT_DIR: "/home/alice/gitea" - OPERATOR_USER: "alice" - CLEAN_UP_DEPLOY_DIR: "NO" - SEND_POC_DIR: "NO" + LABEL_PROJECT_TYPE: "admin" + LABEL_PROJET_NAME: "gitea" + LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/gitea" + REMOTE_PROJECT_DIR: "/home/alice/gitea" + OPERATOR_USER: "alice" + CLEAN_UP_DEPLOY_DIR: "NO" + SEND_POC_DIR: "NO" diff --git a/bundles/admin/software.install.kong/bundle_parameters.src.yml b/bundles/admin/software.install.kong/bundle_parameters.src.yml index 35f24b92..3f7fc588 100644 --- a/bundles/admin/software.install.kong/bundle_parameters.src.yml +++ b/bundles/admin/software.install.kong/bundle_parameters.src.yml @@ -7,7 +7,6 @@ optional: true install_flag: INSTALL_KONG params: - - name: global_vm_ssh_name target: true type: string diff --git a/bundles/admin/software.install.kong/main.yml b/bundles/admin/software.install.kong/main.yml index 3fc8a79f..56e4b1bc 100644 --- a/bundles/admin/software.install.kong/main.yml +++ b/bundles/admin/software.install.kong/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.kong/main.yml # ============================================================================ diff --git a/bundles/admin/software.install.mattermost/main.yml b/bundles/admin/software.install.mattermost/main.yml index 3534d159..6a2b5e97 100644 --- a/bundles/admin/software.install.mattermost/main.yml +++ b/bundles/admin/software.install.mattermost/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.mattermost/main.yml # ============================================================================ @@ -34,15 +35,13 @@ # global_vm_ci_ip: "192.168.142.182" # # ============================================================================ - - - name: mattermost - ensure catalog .env exists (cp .env.example -> .env if missing) hosts: proxmox gather_facts: false tasks: - name: cp .env.example -> .env if .env absent (force=false respects an existing customized .env) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/mattermost/.env.example" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/mattermost/.env.example" dest: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/mattermost/.env" force: false remote_src: true @@ -56,10 +55,10 @@ roles: - software.install.warmup.basic_packages vars: - INSTALL_PACKAGES_BASICS: "YES" - INSTALL_PACKAGES_DOCKER: "YES" - INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" - INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" + INSTALL_PACKAGES_BASICS: "YES" + INSTALL_PACKAGES_DOCKER: "YES" + INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" + INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### @@ -71,7 +70,7 @@ - software.configure.firewalls vars: firewall_rules: - - { ip: "all", port: 22, protocol: "tcp" } + - { ip: "all", port: 22, protocol: "tcp" } - { ip: "all", port: 8065, protocol: "tcp" } # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### @@ -98,19 +97,19 @@ - name: push .env on the VM (cp .env.example -> .env if .env absent on the VM) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/mattermost/.env.example" - dest: "/home/alice/mattermost/.env" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/mattermost/.env.example" + dest: "/home/alice/mattermost/.env" owner: "alice" group: "alice" - mode: "0600" + mode: "0600" force: false roles: - software.configure.docker-compose vars: - LABEL_PROJECT_TYPE: "admin" - LABEL_PROJET_NAME: "mattermost" - LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/mattermost" - REMOTE_PROJECT_DIR: "/home/alice/mattermost" - OPERATOR_USER: "alice" - CLEAN_UP_DEPLOY_DIR: "NO" - SEND_POC_DIR: "NO" + LABEL_PROJECT_TYPE: "admin" + LABEL_PROJET_NAME: "mattermost" + LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/mattermost" + REMOTE_PROJECT_DIR: "/home/alice/mattermost" + OPERATOR_USER: "alice" + CLEAN_UP_DEPLOY_DIR: "NO" + SEND_POC_DIR: "NO" diff --git a/bundles/admin/software.install.misp_standalone/main.yml b/bundles/admin/software.install.misp_standalone/main.yml index d61f1739..5003d740 100644 --- a/bundles/admin/software.install.misp_standalone/main.yml +++ b/bundles/admin/software.install.misp_standalone/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.misp_standalone/main.yml # ============================================================================ @@ -27,15 +28,13 @@ # global_vm_ci_ip: "192.168.142.111" # # ============================================================================ - - - name: misp - ensure catalog .env exists (cp .env.example -> .env if missing) hosts: proxmox gather_facts: false tasks: - name: cp .env.example -> .env if .env absent (force=false respects an existing customized .env) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/misp-standalone/.env.example" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/misp-standalone/.env.example" dest: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/misp-standalone/.env" force: false remote_src: true @@ -49,10 +48,10 @@ roles: - software.install.warmup.basic_packages vars: - INSTALL_PACKAGES_BASICS: "YES" - INSTALL_PACKAGES_DOCKER: "YES" - INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" - INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" + INSTALL_PACKAGES_BASICS: "YES" + INSTALL_PACKAGES_DOCKER: "YES" + INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" + INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### @@ -83,19 +82,19 @@ - name: push .env on the VM (cp .env.example -> .env if .env absent on the VM) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/misp-standalone/.env.example" - dest: "/home/alice/misp-standalone/.env" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/misp-standalone/.env.example" + dest: "/home/alice/misp-standalone/.env" owner: "alice" group: "alice" - mode: "0600" + mode: "0600" force: false roles: - software.configure.docker-compose vars: - LABEL_PROJECT_TYPE: "ADMIN" - LABEL_PROJET_NAME: "misp-standalone" - LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/misp-standalone" - REMOTE_PROJECT_DIR: "/home/alice/misp-standalone" - OPERATOR_USER: "alice" - CLEAN_UP_DEPLOY_DIR: "NO" - SEND_POC_DIR: "NO" + LABEL_PROJECT_TYPE: "ADMIN" + LABEL_PROJET_NAME: "misp-standalone" + LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/misp-standalone" + REMOTE_PROJECT_DIR: "/home/alice/misp-standalone" + OPERATOR_USER: "alice" + CLEAN_UP_DEPLOY_DIR: "NO" + SEND_POC_DIR: "NO" diff --git a/bundles/admin/software.install.nextcloud/main.yml b/bundles/admin/software.install.nextcloud/main.yml index f6e3af4b..7574bb81 100644 --- a/bundles/admin/software.install.nextcloud/main.yml +++ b/bundles/admin/software.install.nextcloud/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.nextcloud/main.yml # ============================================================================ @@ -46,15 +47,13 @@ # global_vm_ci_ip: "192.168.142.181" # # ============================================================================ - - - name: nextcloud - ensure catalog .env exists (cp .env.example -> .env if missing) hosts: proxmox gather_facts: false tasks: - name: cp .env.example -> .env if .env absent (force=false respects an existing customized .env) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/nextcloud/.env.example" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/nextcloud/.env.example" dest: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/nextcloud/.env" force: false remote_src: true @@ -68,10 +67,10 @@ roles: - software.install.warmup.basic_packages vars: - INSTALL_PACKAGES_BASICS: "YES" - INSTALL_PACKAGES_DOCKER: "YES" - INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" - INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" + INSTALL_PACKAGES_BASICS: "YES" + INSTALL_PACKAGES_DOCKER: "YES" + INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" + INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### @@ -83,7 +82,7 @@ - software.configure.firewalls vars: firewall_rules: - - { ip: "all", port: 22, protocol: "tcp" } + - { ip: "all", port: 22, protocol: "tcp" } - { ip: "all", port: 8080, protocol: "tcp" } # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### @@ -110,19 +109,19 @@ - name: push .env on the VM (cp .env.example -> .env if .env absent on the VM) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/nextcloud/.env.example" - dest: "/home/alice/nextcloud/.env" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/nextcloud/.env.example" + dest: "/home/alice/nextcloud/.env" owner: "alice" group: "alice" - mode: "0600" + mode: "0600" force: false roles: - software.configure.docker-compose vars: - LABEL_PROJECT_TYPE: "admin" - LABEL_PROJET_NAME: "nextcloud" - LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/nextcloud" - REMOTE_PROJECT_DIR: "/home/alice/nextcloud" - OPERATOR_USER: "alice" - CLEAN_UP_DEPLOY_DIR: "NO" - SEND_POC_DIR: "NO" + LABEL_PROJECT_TYPE: "admin" + LABEL_PROJET_NAME: "nextcloud" + LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/nextcloud" + REMOTE_PROJECT_DIR: "/home/alice/nextcloud" + OPERATOR_USER: "alice" + CLEAN_UP_DEPLOY_DIR: "NO" + SEND_POC_DIR: "NO" diff --git a/bundles/admin/software.install.rocketchat/main.yml b/bundles/admin/software.install.rocketchat/main.yml index f663de25..0cdee932 100644 --- a/bundles/admin/software.install.rocketchat/main.yml +++ b/bundles/admin/software.install.rocketchat/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.rocketchat/main.yml # ============================================================================ @@ -39,15 +40,13 @@ # global_vm_ci_ip: "192.168.142.185" # # ============================================================================ - - - name: rocketchat - ensure catalog .env exists (cp .env.example -> .env if missing) hosts: proxmox gather_facts: false tasks: - name: cp .env.example -> .env if .env absent (force=false respects an existing customized .env) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/rocketchat/.env.example" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/rocketchat/.env.example" dest: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/rocketchat/.env" force: false remote_src: true @@ -61,10 +60,10 @@ roles: - software.install.warmup.basic_packages vars: - INSTALL_PACKAGES_BASICS: "YES" - INSTALL_PACKAGES_DOCKER: "YES" - INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" - INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" + INSTALL_PACKAGES_BASICS: "YES" + INSTALL_PACKAGES_DOCKER: "YES" + INSTALL_PACKAGES_DOCKER_COMPOSE: "YES" + INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES" # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### @@ -76,7 +75,7 @@ - software.configure.firewalls vars: firewall_rules: - - { ip: "all", port: 22, protocol: "tcp" } + - { ip: "all", port: 22, protocol: "tcp" } - { ip: "all", port: 3000, protocol: "tcp" } # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### @@ -103,19 +102,19 @@ - name: push .env on the VM (cp .env.example -> .env if .env absent on the VM) ansible.builtin.copy: - src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/rocketchat/.env.example" - dest: "/home/alice/rocketchat/.env" + src: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/rocketchat/.env.example" + dest: "/home/alice/rocketchat/.env" owner: "alice" group: "alice" - mode: "0600" + mode: "0600" force: false roles: - software.configure.docker-compose vars: - LABEL_PROJECT_TYPE: "admin" - LABEL_PROJET_NAME: "rocketchat" - LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/rocketchat" - REMOTE_PROJECT_DIR: "/home/alice/rocketchat" - OPERATOR_USER: "alice" - CLEAN_UP_DEPLOY_DIR: "NO" - SEND_POC_DIR: "NO" + LABEL_PROJECT_TYPE: "admin" + LABEL_PROJET_NAME: "rocketchat" + LOCAL__PROJECT_DIR: "{{ lookup('env', 'RANGE42_INVENTORY') }}/03_container_layer/docker/admin/rocketchat" + REMOTE_PROJECT_DIR: "/home/alice/rocketchat" + OPERATOR_USER: "alice" + CLEAN_UP_DEPLOY_DIR: "NO" + SEND_POC_DIR: "NO" diff --git a/bundles/admin/software.install.wazuh/bundle_parameters.src.yml b/bundles/admin/software.install.wazuh/bundle_parameters.src.yml index c9f6f245..a7def2cc 100644 --- a/bundles/admin/software.install.wazuh/bundle_parameters.src.yml +++ b/bundles/admin/software.install.wazuh/bundle_parameters.src.yml @@ -5,7 +5,6 @@ optional: true install_flag: INSTALL_WAZUH params: - - name: global_vm_ssh_name target: true type: string diff --git a/bundles/admin/software.install.wazuh/main.yml b/bundles/admin/software.install.wazuh/main.yml index d4a1e0a6..18545b38 100644 --- a/bundles/admin/software.install.wazuh/main.yml +++ b/bundles/admin/software.install.wazuh/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.wazuh/main.yml # ============================================================================ @@ -25,8 +26,6 @@ # global_vm_ci_ip: "192.168.142.100" # # ============================================================================ - - - name: configure firewall - wazuh server become: true hosts: "{{ global_vm_ssh_name }}" @@ -53,7 +52,7 @@ - name: Install wazuh-indexer hosts: "{{ global_vm_ssh_name }}" - become: yes + become: true become_user: root roles: - role: software.install.wazuh-indexer @@ -80,7 +79,7 @@ - name: Wait for wazuh-indexer to be ready hosts: "{{ global_vm_ssh_name }}" - become: yes + become: true tasks: - name: Wait for wazuh-indexer API on port 9200 ansible.builtin.wait_for: @@ -93,7 +92,7 @@ - name: Install wazuh-dashboard hosts: "{{ global_vm_ssh_name }}" - become: yes + become: true become_user: root roles: - role: software.install.wazuh-dashboard @@ -118,7 +117,7 @@ # # #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### - hosts: "{{ global_vm_ssh_name }}" - become: yes + become: true vars_files: - "{{ lookup('env', 'RANGE42_ACTIVE_CONFIG_DIR') }}/secrets/default_vault.yml" vars: @@ -136,7 +135,7 @@ - name: Wait for wazuh-manager API before password change hosts: "{{ global_vm_ssh_name }}" - become: yes + become: true tasks: - name: Wait for wazuh-manager API on port 55000 ansible.builtin.wait_for: @@ -158,14 +157,14 @@ - name: EXEC wazuh-passwords-tool.sh - if CHANGE_WAZUH_PASSWORD is true hosts: "{{ global_vm_ssh_name }}" - become: yes + become: true become_user: root vars_files: - "{{ lookup('env', 'RANGE42_ACTIVE_CONFIG_DIR') }}/secrets/default_vault.yml" vars: CHANGE_WAZUH_PASSWORD: true - WAZUH_ANSIBLE_HOSTNAME: "{{ global_vm_ssh_name }}" # not via tailscale + WAZUH_ANSIBLE_HOSTNAME: "{{ global_vm_ssh_name }}" # not via tailscale # WAZUH_ANSIBLE_HOSTNAME: "xxx.yyyy.zzzz.edge.wazuh" # if tailscale tasks: diff --git a/bundles/admin/software.install.wazuh_agent/main.yml b/bundles/admin/software.install.wazuh_agent/main.yml index 4dc30599..93841d69 100644 --- a/bundles/admin/software.install.wazuh_agent/main.yml +++ b/bundles/admin/software.install.wazuh_agent/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/admin/software.install.wazuh_agent/main.yml # ============================================================================ @@ -20,10 +21,8 @@ # global_vm_ci_ip: "192.168.142.100" # # ============================================================================ - - - hosts: "{{ wazuh_clients_group }}" - become: yes + become: true become_user: root roles: - software.install.wazuh-agent diff --git a/bundles/ctf/cve/crypto/openssl/CVE-2014-0160/main.yml b/bundles/ctf/cve/crypto/openssl/CVE-2014-0160/main.yml index e6f0a018..59e82c8b 100644 --- a/bundles/ctf/cve/crypto/openssl/CVE-2014-0160/main.yml +++ b/bundles/ctf/cve/crypto/openssl/CVE-2014-0160/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/crypto/openssl/CVE-2014-0160/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/crypto/openssl/CVE-2022-0778/main.yml b/bundles/ctf/cve/crypto/openssl/CVE-2022-0778/main.yml index 1e2217df..0968e210 100644 --- a/bundles/ctf/cve/crypto/openssl/CVE-2022-0778/main.yml +++ b/bundles/ctf/cve/crypto/openssl/CVE-2022-0778/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/crypto/openssl/CVE-2022-0778/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/network/erlang-ssh/CVE-2025-32433/main.yml b/bundles/ctf/cve/network/erlang-ssh/CVE-2025-32433/main.yml index bcb1c7c7..7d32ab10 100644 --- a/bundles/ctf/cve/network/erlang-ssh/CVE-2025-32433/main.yml +++ b/bundles/ctf/cve/network/erlang-ssh/CVE-2025-32433/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/network/erlang-ssh/CVE-2025-32433/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/network/openssh/CVE-2018-15473/main.yml b/bundles/ctf/cve/network/openssh/CVE-2018-15473/main.yml index f24c16fe..e2d70774 100644 --- a/bundles/ctf/cve/network/openssh/CVE-2018-15473/main.yml +++ b/bundles/ctf/cve/network/openssh/CVE-2018-15473/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/network/openssh/CVE-2018-15473/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/network/openssh/CVE-2024-6387/main.yml b/bundles/ctf/cve/network/openssh/CVE-2024-6387/main.yml index a28cd844..e703c458 100644 --- a/bundles/ctf/cve/network/openssh/CVE-2024-6387/main.yml +++ b/bundles/ctf/cve/network/openssh/CVE-2024-6387/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/network/openssh/CVE-2024-6387/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/system/sudo/CVE-2023-22809/main.yml b/bundles/ctf/cve/system/sudo/CVE-2023-22809/main.yml index fb096432..718c38d3 100644 --- a/bundles/ctf/cve/system/sudo/CVE-2023-22809/main.yml +++ b/bundles/ctf/cve/system/sudo/CVE-2023-22809/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/system/sudo/CVE-2023-22809/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/system/sudo/CVE-2025-32462/main.yml b/bundles/ctf/cve/system/sudo/CVE-2025-32462/main.yml index 1108e35f..8209479d 100644 --- a/bundles/ctf/cve/system/sudo/CVE-2025-32462/main.yml +++ b/bundles/ctf/cve/system/sudo/CVE-2025-32462/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/system/sudo/CVE-2025-32462/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/system/sudo/CVE-2025-32463/main.yml b/bundles/ctf/cve/system/sudo/CVE-2025-32463/main.yml index ab824961..9ecf9bfe 100644 --- a/bundles/ctf/cve/system/sudo/CVE-2025-32463/main.yml +++ b/bundles/ctf/cve/system/sudo/CVE-2025-32463/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/system/sudo/CVE-2025-32463/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/web/apache/CVE-2021-42013/main.yml b/bundles/ctf/cve/web/apache/CVE-2021-42013/main.yml index 0ac16c73..18bf135f 100644 --- a/bundles/ctf/cve/web/apache/CVE-2021-42013/main.yml +++ b/bundles/ctf/cve/web/apache/CVE-2021-42013/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/web/apache/CVE-2021-42013/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/web/pdfjs/CVE-2024-4367/main.yml b/bundles/ctf/cve/web/pdfjs/CVE-2024-4367/main.yml index bea72f01..69c1e045 100644 --- a/bundles/ctf/cve/web/pdfjs/CVE-2024-4367/main.yml +++ b/bundles/ctf/cve/web/pdfjs/CVE-2024-4367/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/web/pdfjs/CVE-2024-4367/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/web/php/CVE-2019-11043/main.yml b/bundles/ctf/cve/web/php/CVE-2019-11043/main.yml index c58d9813..b045b724 100644 --- a/bundles/ctf/cve/web/php/CVE-2019-11043/main.yml +++ b/bundles/ctf/cve/web/php/CVE-2019-11043/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/web/php/CVE-2019-11043/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/web/tomcat/CVE-2025-24813/main.yml b/bundles/ctf/cve/web/tomcat/CVE-2025-24813/main.yml index 7269e18e..a39f8e2d 100644 --- a/bundles/ctf/cve/web/tomcat/CVE-2025-24813/main.yml +++ b/bundles/ctf/cve/web/tomcat/CVE-2025-24813/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/web/tomcat/CVE-2025-24813/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/web/uwsg_php/CVE-2018-7490/main.yml b/bundles/ctf/cve/web/uwsg_php/CVE-2018-7490/main.yml index ced742fa..91d4aac7 100644 --- a/bundles/ctf/cve/web/uwsg_php/CVE-2018-7490/main.yml +++ b/bundles/ctf/cve/web/uwsg_php/CVE-2018-7490/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/web/uwsg_php/CVE-2018-7490/main.yml # ============================================================================ diff --git a/bundles/ctf/cve/web/vite/CVE-2025-30208/main.yml b/bundles/ctf/cve/web/vite/CVE-2025-30208/main.yml index 15d217fe..b227ea89 100644 --- a/bundles/ctf/cve/web/vite/CVE-2025-30208/main.yml +++ b/bundles/ctf/cve/web/vite/CVE-2025-30208/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/cve/web/vite/CVE-2025-30208/main.yml # ============================================================================ diff --git a/bundles/ctf/misconfiguration/network/vsftpd/ftp_anon_server/main.yml b/bundles/ctf/misconfiguration/network/vsftpd/ftp_anon_server/main.yml index 4d4f9c7b..b09c9b64 100644 --- a/bundles/ctf/misconfiguration/network/vsftpd/ftp_anon_server/main.yml +++ b/bundles/ctf/misconfiguration/network/vsftpd/ftp_anon_server/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/misconfiguration/network/vsftpd/ftp_anon_server/main.yml # ============================================================================ diff --git a/bundles/ctf/misconfiguration/system/lpe-01/main.yml b/bundles/ctf/misconfiguration/system/lpe-01/main.yml index 0300fc5f..e7cdd1ba 100644 --- a/bundles/ctf/misconfiguration/system/lpe-01/main.yml +++ b/bundles/ctf/misconfiguration/system/lpe-01/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/ctf/misconfiguration/system/lpe-01/main.yml # ============================================================================ diff --git a/bundles/generic/network.baseline.deployer_backend_api/main.yml b/bundles/generic/network.baseline.deployer_backend_api/main.yml index 39908216..74cfe11e 100644 --- a/bundles/generic/network.baseline.deployer_backend_api/main.yml +++ b/bundles/generic/network.baseline.deployer_backend_api/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/network.baseline.deployer_backend_api/main.yml # ============================================================================ @@ -21,5 +22,5 @@ - software.configure.firewalls vars: firewall_rules: - - { ip: "all", port: 22, protocol: "tcp" } + - { ip: "all", port: 22, protocol: "tcp" } - { ip: "all", port: 8000, protocol: "tcp" } diff --git a/bundles/generic/network.baseline.deployer_ui/main.yml b/bundles/generic/network.baseline.deployer_ui/main.yml index c730464d..52fa34d8 100644 --- a/bundles/generic/network.baseline.deployer_ui/main.yml +++ b/bundles/generic/network.baseline.deployer_ui/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/network.baseline.deployer_ui/main.yml # ============================================================================ @@ -21,5 +22,5 @@ - software.configure.firewalls vars: firewall_rules: - - { ip: "all", port: 22, protocol: "tcp" } + - { ip: "all", port: 22, protocol: "tcp" } - { ip: "all", port: 3000, protocol: "tcp" } diff --git a/bundles/generic/network.baseline.kong/main.yml b/bundles/generic/network.baseline.kong/main.yml index 50a55463..83263282 100644 --- a/bundles/generic/network.baseline.kong/main.yml +++ b/bundles/generic/network.baseline.kong/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/network.baseline.kong/main.yml # ============================================================================ @@ -22,6 +23,6 @@ - software.configure.firewalls vars: firewall_rules: - - { ip: "all", port: 22, protocol: "tcp" } + - { ip: "all", port: 22, protocol: "tcp" } - { ip: "all", port: 8000, protocol: "tcp" } - { ip: "all", port: 8443, protocol: "tcp" } diff --git a/bundles/generic/network.baseline.ssh/main.yml b/bundles/generic/network.baseline.ssh/main.yml index 8096d7c8..367c8ff5 100644 --- a/bundles/generic/network.baseline.ssh/main.yml +++ b/bundles/generic/network.baseline.ssh/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/network.baseline.ssh/main.yml # ============================================================================ diff --git a/bundles/generic/network.baseline.ssh_http/bundle_parameters.src.yml b/bundles/generic/network.baseline.ssh_http/bundle_parameters.src.yml index d3660b1f..8a2c3517 100644 --- a/bundles/generic/network.baseline.ssh_http/bundle_parameters.src.yml +++ b/bundles/generic/network.baseline.ssh_http/bundle_parameters.src.yml @@ -4,7 +4,6 @@ description: Open the standard web-facing firewall profile (ports 22, 80, 443 tc optional: false params: - - name: target_group target: true type: string diff --git a/bundles/generic/network.baseline.ssh_http/main.yml b/bundles/generic/network.baseline.ssh_http/main.yml index 306014fa..8ffffcad 100644 --- a/bundles/generic/network.baseline.ssh_http/main.yml +++ b/bundles/generic/network.baseline.ssh_http/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/network.baseline.ssh_http/main.yml # ============================================================================ @@ -20,6 +21,6 @@ - software.configure.firewalls vars: firewall_rules: - - { ip: "all", port: 22, protocol: "tcp" } - - { ip: "all", port: 80, protocol: "tcp" } + - { ip: "all", port: 22, protocol: "tcp" } + - { ip: "all", port: 80, protocol: "tcp" } - { ip: "all", port: 443, protocol: "tcp" } diff --git a/bundles/generic/network.configure.tailscale_client/main.yml b/bundles/generic/network.configure.tailscale_client/main.yml index 872d4cfc..9a9063c8 100644 --- a/bundles/generic/network.configure.tailscale_client/main.yml +++ b/bundles/generic/network.configure.tailscale_client/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/network.configure.tailscale_client/main.yml # ============================================================================ @@ -64,9 +65,9 @@ vars: tailscale_authkey: "{{ infrastructure_tailscale_authkey }}" tasks: - - block: + - when: INSTALL_TAILSCALE | default('NO') | upper == "YES" + block: - include_role: name: software.install.tailscale - include_role: name: software.configure.tailscale_disable_nftables - when: INSTALL_TAILSCALE | default('NO') | upper == "YES" diff --git a/bundles/generic/network.configure.ufw_rules/bundle_parameters.src.yml b/bundles/generic/network.configure.ufw_rules/bundle_parameters.src.yml index b43ead09..bd069a36 100644 --- a/bundles/generic/network.configure.ufw_rules/bundle_parameters.src.yml +++ b/bundles/generic/network.configure.ufw_rules/bundle_parameters.src.yml @@ -4,7 +4,6 @@ description: Apply a caller-provided list of UFW allow-rules on a target group ( optional: false params: - - name: target_group target: true type: string diff --git a/bundles/generic/network.configure.ufw_rules/main.yml b/bundles/generic/network.configure.ufw_rules/main.yml index 3120b6e6..7a77190c 100644 --- a/bundles/generic/network.configure.ufw_rules/main.yml +++ b/bundles/generic/network.configure.ufw_rules/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/network.configure.ufw_rules/main.yml # ============================================================================ diff --git a/bundles/generic/repo.clone.kunai_workshop/main.yml b/bundles/generic/repo.clone.kunai_workshop/main.yml index e4517c38..4b2990f3 100644 --- a/bundles/generic/repo.clone.kunai_workshop/main.yml +++ b/bundles/generic/repo.clone.kunai_workshop/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/repo.clone.kunai_workshop/main.yml # ============================================================================ @@ -35,12 +36,12 @@ - import_playbook: "{{ lookup('env', 'RANGE42_BUNDLE_DIR') }}/generic/repo.clone/main.yml" vars: - target_group: "{{ GITCLONE_KUNAI_TARGET_GROUP }}" + target_group: "{{ GITCLONE_KUNAI_TARGET_GROUP }}" GITCLONE_OPERATOR_USER: "{{ GITCLONE_KUNAI_OPERATOR_USER | default('alice') }}" - GITCLONE_REPOS_DIR: "{{ GITCLONE_KUNAI_REPOS_DIR | default('/home/' + (GITCLONE_KUNAI_OPERATOR_USER | default('alice')) + '/kunai-project') }}" + GITCLONE_REPOS_DIR: "{{ GITCLONE_KUNAI_REPOS_DIR | default('/home/' + (GITCLONE_KUNAI_OPERATOR_USER | default('alice')) + '/kunai-project') }}" GITCLONE_REPOS: - - { name: "workshops", url: "https://github.com/kunai-project/workshops.git" } - - { name: "kunai-doc", url: "https://github.com/kunai-project/kunai-doc.git" } + - { name: "workshops", url: "https://github.com/kunai-project/workshops.git" } + - { name: "kunai-doc", url: "https://github.com/kunai-project/kunai-doc.git" } - { name: "kunai-build-docker", url: "https://github.com/kunai-project/kunai-build-docker.git" } - - { name: "community-rules", url: "https://github.com/kunai-project/community-rules.git" } - - { name: "pykunai", url: "https://github.com/kunai-project/pykunai.git" } + - { name: "community-rules", url: "https://github.com/kunai-project/community-rules.git" } + - { name: "pykunai", url: "https://github.com/kunai-project/pykunai.git" } diff --git a/bundles/generic/repo.clone/bundle_parameters.src.yml b/bundles/generic/repo.clone/bundle_parameters.src.yml index 85cab65b..ee0c43be 100644 --- a/bundles/generic/repo.clone/bundle_parameters.src.yml +++ b/bundles/generic/repo.clone/bundle_parameters.src.yml @@ -6,7 +6,6 @@ description: Clone a caller-provided list of git repositories on a target group optional: false params: - - name: target_group target: true type: string diff --git a/bundles/generic/repo.clone/main.yml b/bundles/generic/repo.clone/main.yml index a5764353..0a2293fd 100644 --- a/bundles/generic/repo.clone/main.yml +++ b/bundles/generic/repo.clone/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/repo.clone/main.yml # ============================================================================ @@ -31,18 +32,18 @@ become: true gather_facts: false -# ============================================================================ -# Variable propagation : caller passes GITCLONE_* (uppercase prefix), bundle -# resolves into private _gitclone_* play-vars (lowercase) with default() -# fallbacks. The prefix split is intentional (consistent with the project's -# BASELINE_*-style bundles + future-proof against role-level mappings if the -# bundle ever wraps a role with the same expected var names). -# ============================================================================ + # ============================================================================ + # Variable propagation : caller passes GITCLONE_* (uppercase prefix), bundle + # resolves into private _gitclone_* play-vars (lowercase) with default() + # fallbacks. The prefix split is intentional (consistent with the project's + # BASELINE_*-style bundles + future-proof against role-level mappings if the + # bundle ever wraps a role with the same expected var names). + # ============================================================================ vars: _gitclone_operator_user: "{{ GITCLONE_OPERATOR_USER | default('alice') }}" - _gitclone_repos_dir: "{{ GITCLONE_REPOS_DIR | default('/home/' + _gitclone_operator_user + '/repos') }}" - _gitclone_repos: "{{ GITCLONE_REPOS | default([]) }}" - _gitclone_depth: "{{ GITCLONE_DEPTH | default(1) }}" + _gitclone_repos_dir: "{{ GITCLONE_REPOS_DIR | default('/home/' + _gitclone_operator_user + '/repos') }}" + _gitclone_repos: "{{ GITCLONE_REPOS | default([]) }}" + _gitclone_depth: "{{ GITCLONE_DEPTH | default(1) }}" tasks: - name: repo.clone - ensure parent directory exists ({{ _gitclone_repos_dir }}) @@ -60,6 +61,7 @@ depth: "{{ _gitclone_depth }}" update: true accept_hostkey: true + become: true become_user: "{{ _gitclone_operator_user }}" loop: "{{ _gitclone_repos }}" loop_control: diff --git a/bundles/generic/systems.baseline.default/main.yml b/bundles/generic/systems.baseline.default/main.yml index 5dded3cc..87e217d4 100644 --- a/bundles/generic/systems.baseline.default/main.yml +++ b/bundles/generic/systems.baseline.default/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/systems.baseline.default/main.yml # ============================================================================ diff --git a/bundles/generic/systems.baseline.docker_host/main.yml b/bundles/generic/systems.baseline.docker_host/main.yml index d72ba19a..8e897204 100644 --- a/bundles/generic/systems.baseline.docker_host/main.yml +++ b/bundles/generic/systems.baseline.docker_host/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/systems.baseline.docker_host/main.yml # ============================================================================ diff --git a/bundles/generic/systems.baseline.with_utils/main.yml b/bundles/generic/systems.baseline.with_utils/main.yml index aacb2ceb..9e79a7c2 100644 --- a/bundles/generic/systems.baseline.with_utils/main.yml +++ b/bundles/generic/systems.baseline.with_utils/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/generic/systems.baseline.with_utils/main.yml # ============================================================================ diff --git a/bundles/generic/systems.checks.ping/main.yml b/bundles/generic/systems.checks.ping/main.yml index 0975111e..ecf6868d 100644 --- a/bundles/generic/systems.checks.ping/main.yml +++ b/bundles/generic/systems.checks.ping/main.yml @@ -1,7 +1,6 @@ - +--- - name: debug - ping targeted host/group hosts: all gather_facts: false tasks: - ansible.builtin.ping: - diff --git a/bundles/generic/systems.configure.sudo/bundle_parameters.src.yml b/bundles/generic/systems.configure.sudo/bundle_parameters.src.yml index 808ee7b7..48887621 100644 --- a/bundles/generic/systems.configure.sudo/bundle_parameters.src.yml +++ b/bundles/generic/systems.configure.sudo/bundle_parameters.src.yml @@ -4,7 +4,6 @@ description: Grant or revoke sudo for a user on a target group, via a validated optional: false params: - - name: TARGET_GROUP target: true type: string diff --git a/bundles/generic/systems.configure.terminfo/main.yml b/bundles/generic/systems.configure.terminfo/main.yml index 6554f0fb..c54eefff 100644 --- a/bundles/generic/systems.configure.terminfo/main.yml +++ b/bundles/generic/systems.configure.terminfo/main.yml @@ -1,3 +1,4 @@ +--- ## ## generic/systems.configure.terminfo — install alacritty terminfo on remote hosts ## @@ -27,22 +28,22 @@ - name: allow SSH client to forward TERM environment variable ansible.builtin.lineinfile: path: /etc/ssh/sshd_config - regexp: '^AcceptEnv TERM' - insertafter: '^AcceptEnv LANG LC_\*' - line: 'AcceptEnv TERM' + regexp: "^AcceptEnv TERM" + insertafter: "^AcceptEnv LANG LC_\\*" + line: "AcceptEnv TERM" notify: reload sshd - name: ensure /etc/terminfo/a directory exists ansible.builtin.file: path: /etc/terminfo/a state: directory - mode: '0755' + mode: "0755" - name: install alacritty terminfo so TERM=alacritty works over SSH ansible.builtin.copy: src: /usr/share/terminfo/a/alacritty dest: /etc/terminfo/a/alacritty - mode: '0644' + mode: "0644" ignore_errors: true handlers: diff --git a/bundles/proxmox/cloud_init_image.download.all/main.yml b/bundles/proxmox/cloud_init_image.download.all/main.yml index 135127ec..ddb5da65 100644 --- a/bundles/proxmox/cloud_init_image.download.all/main.yml +++ b/bundles/proxmox/cloud_init_image.download.all/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/proxmox/cloud_init_image.download.all/main.yml # ============================================================================ diff --git a/bundles/proxmox/cloud_init_image.download.alpine/main.yml b/bundles/proxmox/cloud_init_image.download.alpine/main.yml index 2cb00ad1..a8cc518c 100644 --- a/bundles/proxmox/cloud_init_image.download.alpine/main.yml +++ b/bundles/proxmox/cloud_init_image.download.alpine/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/proxmox/cloud_init_image.download.alpine/main.yml # ============================================================================ diff --git a/bundles/proxmox/cloud_init_image.download.debian/main.yml b/bundles/proxmox/cloud_init_image.download.debian/main.yml index fc920d34..c88e8310 100644 --- a/bundles/proxmox/cloud_init_image.download.debian/main.yml +++ b/bundles/proxmox/cloud_init_image.download.debian/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/proxmox/cloud_init_image.download.debian/main.yml # ============================================================================ diff --git a/bundles/proxmox/cloud_init_image.download.ubuntu_lts_minimal/main.yml b/bundles/proxmox/cloud_init_image.download.ubuntu_lts_minimal/main.yml index f86a3c80..847b4f7a 100644 --- a/bundles/proxmox/cloud_init_image.download.ubuntu_lts_minimal/main.yml +++ b/bundles/proxmox/cloud_init_image.download.ubuntu_lts_minimal/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/proxmox/cloud_init_image.download.ubuntu_lts_minimal/main.yml # ============================================================================ diff --git a/bundles/proxmox/cloud_init_image.download.ubuntu_lts_server/main.yml b/bundles/proxmox/cloud_init_image.download.ubuntu_lts_server/main.yml index 96fb9982..391edfd5 100644 --- a/bundles/proxmox/cloud_init_image.download.ubuntu_lts_server/main.yml +++ b/bundles/proxmox/cloud_init_image.download.ubuntu_lts_server/main.yml @@ -1,3 +1,4 @@ +--- # ============================================================================ # bundles/proxmox/cloud_init_image.download.ubuntu_lts_server/main.yml # ============================================================================ diff --git a/bundles/proxmox/template.build.alpine/00-template-vm-alpine-nano.yml b/bundles/proxmox/template.build.alpine/00-template-vm-alpine-nano.yml index 56744248..fb107357 100644 --- a/bundles/proxmox/template.build.alpine/00-template-vm-alpine-nano.yml +++ b/bundles/proxmox/template.build.alpine/00-template-vm-alpine-nano.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create alpine 3.21 template : @@ -77,7 +78,7 @@ ansible.builtin.shell: qm config 9903 | grep -q '^lock:' register: tpl_9903_post_create_lock until: tpl_9903_post_create_lock.rc != 0 - retries: 60 # 60 x 5s = 5 min max safety + retries: 60 # 60 x 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -85,7 +86,7 @@ when: - tpl_9903_is_template.rc != 0 - tpl_9903_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.alpine/bundle_parameters.src.yml b/bundles/proxmox/template.build.alpine/bundle_parameters.src.yml index 1f429c77..03e00fd3 100644 --- a/bundles/proxmox/template.build.alpine/bundle_parameters.src.yml +++ b/bundles/proxmox/template.build.alpine/bundle_parameters.src.yml @@ -6,7 +6,6 @@ description: >- optional: false params: - - name: templates_whitelist type: list required: false diff --git a/bundles/proxmox/template.build.alpine/main.yml b/bundles/proxmox/template.build.alpine/main.yml index ea1619bf..6b8aaf99 100644 --- a/bundles/proxmox/template.build.alpine/main.yml +++ b/bundles/proxmox/template.build.alpine/main.yml @@ -1,3 +1,4 @@ +--- ## ## bundles/proxmox/template.build.alpine/main.yml ## @@ -21,10 +22,7 @@ ## Vault loading uses `$RANGE42_ACTIVE_CONFIG_DIR/secrets/default_vault.yml` ## (env var exported by `range42-context use`). ## - - # ---- alpine template family ---- - import_playbook: ./00-template-vm-alpine-nano.yml - when: (templates_whitelist | default([])) | length == 0 - or "alpine-nano" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "alpine-nano" in (templates_whitelist | default([])) diff --git a/bundles/proxmox/template.build.debian/00-template-vm-debian-nano.yml b/bundles/proxmox/template.build.debian/00-template-vm-debian-nano.yml index 56b03ae9..e15cf984 100644 --- a/bundles/proxmox/template.build.debian/00-template-vm-debian-nano.yml +++ b/bundles/proxmox/template.build.debian/00-template-vm-debian-nano.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create debian 12 bookworm template : @@ -77,7 +78,7 @@ ansible.builtin.shell: qm config 9902 | grep -q '^lock:' register: tpl_9902_post_create_lock until: tpl_9902_post_create_lock.rc != 0 - retries: 60 # 60 x 5s = 5 min max safety + retries: 60 # 60 x 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -85,7 +86,7 @@ when: - tpl_9902_is_template.rc != 0 - tpl_9902_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.debian/bundle_parameters.src.yml b/bundles/proxmox/template.build.debian/bundle_parameters.src.yml index d7aa7a99..991d82fe 100644 --- a/bundles/proxmox/template.build.debian/bundle_parameters.src.yml +++ b/bundles/proxmox/template.build.debian/bundle_parameters.src.yml @@ -6,7 +6,6 @@ description: >- optional: false params: - - name: templates_whitelist type: list required: false diff --git a/bundles/proxmox/template.build.debian/main.yml b/bundles/proxmox/template.build.debian/main.yml index 8b9a6823..7d5e9f1c 100644 --- a/bundles/proxmox/template.build.debian/main.yml +++ b/bundles/proxmox/template.build.debian/main.yml @@ -1,3 +1,4 @@ +--- ## ## bundles/proxmox/template.build.debian/main.yml ## @@ -21,10 +22,7 @@ ## Vault loading uses `$RANGE42_ACTIVE_CONFIG_DIR/secrets/default_vault.yml` ## (env var exported by `range42-context use`). ## - - # ---- debian template family ---- - import_playbook: ./00-template-vm-debian-nano.yml - when: (templates_whitelist | default([])) | length == 0 - or "debian-nano" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "debian-nano" in (templates_whitelist | default([])) diff --git a/bundles/proxmox/template.build.ubuntu_noble/00-template-vm-nano.yml b/bundles/proxmox/template.build.ubuntu_noble/00-template-vm-nano.yml index 55460206..4a744077 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/00-template-vm-nano.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/00-template-vm-nano.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9901 | grep -q '^lock:' register: tpl_9901_post_create_lock until: tpl_9901_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9901_is_template.rc != 0 - tpl_9901_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/01-template-vm-micro-01-2g-24g.yml b/bundles/proxmox/template.build.ubuntu_noble/01-template-vm-micro-01-2g-24g.yml index ed7ae49f..1187d06e 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/01-template-vm-micro-01-2g-24g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/01-template-vm-micro-01-2g-24g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9211 | grep -q '^lock:' register: tpl_9211_post_create_lock until: tpl_9211_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9211_is_template.rc != 0 - tpl_9211_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/01-template-vm-micro-02-2g-24g.yml b/bundles/proxmox/template.build.ubuntu_noble/01-template-vm-micro-02-2g-24g.yml index cf10243b..57efdedb 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/01-template-vm-micro-02-2g-24g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/01-template-vm-micro-02-2g-24g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9212 | grep -q '^lock:' register: tpl_9212_post_create_lock until: tpl_9212_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9212_is_template.rc != 0 - tpl_9212_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-01-4g-32g.yml b/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-01-4g-32g.yml index 32fb7f9d..af2322ba 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-01-4g-32g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-01-4g-32g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9221 | grep -q '^lock:' register: tpl_9221_post_create_lock until: tpl_9221_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9221_is_template.rc != 0 - tpl_9221_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-02-4g-32g.yml b/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-02-4g-32g.yml index 274fa72e..17861200 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-02-4g-32g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-02-4g-32g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9222 | grep -q '^lock:' register: tpl_9222_post_create_lock until: tpl_9222_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9222_is_template.rc != 0 - tpl_9222_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-04-4g-32g.yml b/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-04-4g-32g.yml index 08924d33..91be6c85 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-04-4g-32g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/02-template-vm-small-04-4g-32g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9224 | grep -q '^lock:' register: tpl_9224_post_create_lock until: tpl_9224_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9224_is_template.rc != 0 - tpl_9224_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-02-8g-64g.yml b/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-02-8g-64g.yml index 9bb7c245..54c61344 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-02-8g-64g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-02-8g-64g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9232 | grep -q '^lock:' register: tpl_9232_post_create_lock until: tpl_9232_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9232_is_template.rc != 0 - tpl_9232_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-04-8g-64g.yml b/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-04-8g-64g.yml index 9424b70c..33548657 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-04-8g-64g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-04-8g-64g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9234 | grep -q '^lock:' register: tpl_9234_post_create_lock until: tpl_9234_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9234_is_template.rc != 0 - tpl_9234_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-06-8g-64g.yml b/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-06-8g-64g.yml index c72f1d68..3934415d 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-06-8g-64g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/03-template-vm-medium-06-8g-64g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9236 | grep -q '^lock:' register: tpl_9236_post_create_lock until: tpl_9236_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9236_is_template.rc != 0 - tpl_9236_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-04-8g-64g.yml b/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-04-8g-64g.yml index 347060fd..8861449e 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-04-8g-64g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-04-8g-64g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9244 | grep -q '^lock:' register: tpl_9244_post_create_lock until: tpl_9244_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9244_is_template.rc != 0 - tpl_9244_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-06-8g-64g.yml b/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-06-8g-64g.yml index 60aef669..2cd4cf36 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-06-8g-64g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-06-8g-64g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9246 | grep -q '^lock:' register: tpl_9246_post_create_lock until: tpl_9246_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9246_is_template.rc != 0 - tpl_9246_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-08-8g-64g.yml b/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-08-8g-64g.yml index b718bf3a..d6c2e071 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-08-8g-64g.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/04-template-vm-large-08-8g-64g.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : @@ -74,7 +75,7 @@ ansible.builtin.shell: qm config 9248 | grep -q '^lock:' register: tpl_9248_post_create_lock until: tpl_9248_post_create_lock.rc != 0 - retries: 60 # 60 × 5s = 5 min max safety + retries: 60 # 60 × 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -82,7 +83,7 @@ when: - tpl_9248_is_template.rc != 0 - tpl_9248_exists.rc != 0 - #### +#### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### diff --git a/bundles/proxmox/template.build.ubuntu_noble/_apply_apt_proxy.yml b/bundles/proxmox/template.build.ubuntu_noble/_apply_apt_proxy.yml index 2e40a413..f3e003f6 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/_apply_apt_proxy.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/_apply_apt_proxy.yml @@ -1,3 +1,4 @@ +--- ## ## bundles/proxmox/template.build.ubuntu_noble/_apply_apt_proxy.yml ## apt proxy via cloud-init cicustom (optional) @@ -20,18 +21,18 @@ vars: template_vm_ids: - - 9901 # nano - - 9211 # micro-01-2g-24g - - 9212 # micro-02-2g-24g - - 9221 # small-01-4g-32g (used by admin-deployer-api-gateway / api-backend / ui) - - 9222 # small-02-4g-32g - - 9224 # small-04-4g-32g - - 9232 # medium-02-8g-64g (used by admin-wazuh) - - 9234 # medium-04-8g-64g - - 9236 # medium-06-8g-64g - - 9244 # large-04-8g-64g - - 9246 # large-06-8g-64g - - 9248 # large-08-8g-64g + - 9901 # nano + - 9211 # micro-01-2g-24g + - 9212 # micro-02-2g-24g + - 9221 # small-01-4g-32g (used by admin-deployer-api-gateway / api-backend / ui) + - 9222 # small-02-4g-32g + - 9224 # small-04-4g-32g + - 9232 # medium-02-8g-64g (used by admin-wazuh) + - 9234 # medium-04-8g-64g + - 9236 # medium-06-8g-64g + - 9244 # large-04-8g-64g + - 9246 # large-06-8g-64g + - 9248 # large-08-8g-64g tasks: - name: APT-PROXY - SKIP (apt_proxy_url is empty) @@ -47,7 +48,7 @@ changed_when: qm_result.rc == 0 failed_when: - qm_result.rc != 0 - - "'does not exist' not in qm_result.stderr" # skip silently if template doesn't exist yet + - "'does not exist' not in qm_result.stderr" # skip silently if template doesn't exist yet when: apt_proxy_url is defined and (apt_proxy_url | length) > 0 - name: APT-PROXY - DETACH cicustom vendor FROM TEMPLATES (apt_proxy_url unset) @@ -56,7 +57,7 @@ loop: "{{ template_vm_ids }}" register: qm_unset changed_when: qm_unset.rc == 0 - failed_when: false # idempotent : VM may be missing or cicustom may already be absent ; both are non-fatal here + failed_when: false # idempotent : VM may be missing or cicustom may already be absent ; both are non-fatal here when: apt_proxy_url is not defined or (apt_proxy_url | length) == 0 - name: APT-PROXY - DISPLAY STATUS diff --git a/bundles/proxmox/template.build.ubuntu_noble/_update_templates.yml b/bundles/proxmox/template.build.ubuntu_noble/_update_templates.yml index f9bc00fd..ee6fea32 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/_update_templates.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/_update_templates.yml @@ -1,3 +1,4 @@ +--- ## ## bundles/proxmox/template.build.ubuntu_noble/_update_templates.yml ## pre-update + finalize ubuntu_noble templates @@ -25,7 +26,6 @@ bootstrap_snippet_path: "/var/lib/vz/snippets/range42-template-bootstrap.yaml" tasks: - #### #### #### required-var check #### #### #### # The calling scenario must pass `manifest_path` and `template_bundle_dir` # via the `import_playbook vars:` block. Both are scenario-relative so the @@ -171,7 +171,7 @@ ansible.builtin.shell: | qm status {{ item.vm_id }} | grep -q 'status: stopped' register: stop_check - retries: 360 # safety cap : 360 × 5s = 30 min max per VM + retries: 360 # safety cap : 360 × 5s = 30 min max per VM delay: 5 until: stop_check.rc == 0 loop: "{{ templates_started }}" diff --git a/bundles/proxmox/template.build.ubuntu_noble/main.yml b/bundles/proxmox/template.build.ubuntu_noble/main.yml index 6a9e7396..f19bea14 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/main.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/main.yml @@ -1,3 +1,4 @@ +--- ## ## bundles/proxmox/template.build.ubuntu_noble/main.yml ## @@ -37,64 +38,48 @@ ## Vault loading uses `$RANGE42_ACTIVE_CONFIG_DIR/secrets/default_vault.yml` ## (env var exported by `range42-context use`). ## - - # ---- ubuntu_noble template family ---- - import_playbook: ./00-template-vm-nano.yml - when: (templates_whitelist | default([])) | length == 0 - or "nano" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "nano" in (templates_whitelist | default([])) - import_playbook: ./01-template-vm-micro-01-2g-24g.yml - when: (templates_whitelist | default([])) | length == 0 - or "micro-01" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "micro-01" in (templates_whitelist | default([])) - import_playbook: ./01-template-vm-micro-02-2g-24g.yml - when: (templates_whitelist | default([])) | length == 0 - or "micro-02" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "micro-02" in (templates_whitelist | default([])) - import_playbook: ./02-template-vm-small-01-4g-32g.yml - when: (templates_whitelist | default([])) | length == 0 - or "small-01" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "small-01" in (templates_whitelist | default([])) - import_playbook: ./02-template-vm-small-02-4g-32g.yml - when: (templates_whitelist | default([])) | length == 0 - or "small-02" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "small-02" in (templates_whitelist | default([])) - import_playbook: ./02-template-vm-small-04-4g-32g.yml - when: (templates_whitelist | default([])) | length == 0 - or "small-04" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "small-04" in (templates_whitelist | default([])) - import_playbook: ./03-template-vm-medium-02-8g-64g.yml - when: (templates_whitelist | default([])) | length == 0 - or "medium-02" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "medium-02" in (templates_whitelist | default([])) - import_playbook: ./03-template-vm-medium-04-8g-64g.yml - when: (templates_whitelist | default([])) | length == 0 - or "medium-04" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "medium-04" in (templates_whitelist | default([])) - import_playbook: ./03-template-vm-medium-06-8g-64g.yml - when: (templates_whitelist | default([])) | length == 0 - or "medium-06" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "medium-06" in (templates_whitelist | default([])) - import_playbook: ./04-template-vm-large-04-8g-64g.yml - when: (templates_whitelist | default([])) | length == 0 - or "large-04" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "large-04" in (templates_whitelist | default([])) - import_playbook: ./04-template-vm-large-06-8g-64g.yml - when: (templates_whitelist | default([])) | length == 0 - or "large-06" in (templates_whitelist | default([])) + when: (templates_whitelist | default([])) | length == 0 or "large-06" in (templates_whitelist | default([])) - import_playbook: ./04-template-vm-large-08-8g-64g.yml - when: (templates_whitelist | default([])) | length == 0 - or "large-08" in (templates_whitelist | default([])) - + when: (templates_whitelist | default([])) | length == 0 or "large-08" in (templates_whitelist | default([])) # ---- apt-proxy cicustom (attach if apt_proxy_url set, detach otherwise) ---- - import_playbook: ./_apply_apt_proxy.yml - # ---- update + finalize templates (idempotent : early-exits if all templates # are already finalized ; otherwise starts VMs, runs apt update via # cloud-init bootstrap snippet, auto-poweroff, then converts to template) diff --git a/bundles/proxmox/template.build.ubuntu_noble/test_setup_templates.yml b/bundles/proxmox/template.build.ubuntu_noble/test_setup_templates.yml index 4ffb3372..12ace76d 100644 --- a/bundles/proxmox/template.build.ubuntu_noble/test_setup_templates.yml +++ b/bundles/proxmox/template.build.ubuntu_noble/test_setup_templates.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # PROMOX INIT - create ubuntu noble template : diff --git a/bundles/proxmox/vm.bootstrap/bundle_parameters.src.yml b/bundles/proxmox/vm.bootstrap/bundle_parameters.src.yml index 761e25ca..d798a3a5 100644 --- a/bundles/proxmox/vm.bootstrap/bundle_parameters.src.yml +++ b/bundles/proxmox/vm.bootstrap/bundle_parameters.src.yml @@ -6,7 +6,6 @@ description: >- optional: false params: - - name: global_vm_ssh_name target: true type: string diff --git a/bundles/proxmox/vm.bootstrap/main.yml b/bundles/proxmox/vm.bootstrap/main.yml index 36b95e82..1366958c 100644 --- a/bundles/proxmox/vm.bootstrap/main.yml +++ b/bundles/proxmox/vm.bootstrap/main.yml @@ -1,3 +1,4 @@ +--- #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### # # vm.bootstrap - shared per-VM stage_00 playbook @@ -33,7 +34,6 @@ - "{{ lookup('env', 'RANGE42_ACTIVE_CONFIG_DIR') }}/secrets/default_vault.yml" tasks: - - name: VM BOOTSTRAP - "{{ global_vm_name }}" - CLONE TEMPLATE - "{{ global_template_name | default(global_template_vm_id) }}" include_role: name: range42-ansible_roles-proxmox_controller @@ -48,7 +48,7 @@ ansible.builtin.shell: qm config {{ global_vm_id }} | grep -q '^lock:' register: vm_bootstrap_clone_lock until: vm_bootstrap_clone_lock.rc != 0 - retries: 60 # 60 x 5s = 5 min max safety + retries: 60 # 60 x 5s = 5 min max safety delay: 5 failed_when: false changed_when: false @@ -100,7 +100,6 @@ - wait/cloudinit/is_boot_finished.yml tasks: - - name: VM BOOTSTRAP - "{{ global_vm_ssh_name }}" - WAIT openssh + cloud-init (via ansible.utils) include_role: name: ansible.utils From eaf5271512845455457753b44e5d5813e149afb0 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 11 Aug 2026 16:25:35 +0200 Subject: [PATCH 15/16] chore(ci): stub new runtime vars and catalog roles for the lint gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - extra_vars: target_group/TARGET_GROUP/wazuh_clients_group and the kunai wrapper group vars are inventory-provided at runtime - mock_roles: five new catalog roles referenced by bundles/generic - RANGE42_BUNDLE_DIR env on the lint step — the kunai_workshop wrapper resolves its inner import_playbook path from it Verified: ansible-lint bundles/ exits 0 (0 failures, 1 warning) with ansible-lint 26.6.0 on the dev-merged tree. --- .ansible-lint | 10 ++++++++++ .github/workflows/ci.yml | 4 ++++ 2 files changed, 14 insertions(+) diff --git a/.ansible-lint b/.ansible-lint index ece2484e..bb7b9d49 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -44,7 +44,17 @@ mock_roles: - software.install.wazuh-manager - systems.configure.add_user - software.install.wazuh-agent + - software.install.kunai_official_workshop + - systems.configure.authorized_keys + - systems.configure.os_auto_updates + - systems.configure.ssh_keypair + - systems.configure.sudo # vars defined at runtime via inventory/group_vars — stub for CI syntax-check extra_vars: global_vm_ssh_name: ci_mock + target_group: ci_mock_group + TARGET_GROUP: ci_mock_group + wazuh_clients_group: ci_mock_group + GITCLONE_KUNAI_TARGET_GROUP: ci_mock_group + KUNAI_TARGET_GROUP: ci_mock_group diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 63e895a3..5d54983e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,6 +15,10 @@ jobs: - uses: actions/checkout@v6 - run: pip install --no-cache-dir ansible-lint==26.6.0 - run: ansible-lint bundles/ + env: + # bundles/generic/repo.clone.kunai_workshop resolves its inner + # import_playbook path from this env var + RANGE42_BUNDLE_DIR: ${{ github.workspace }}/bundles python: name: Ruff + Pytest From 8812e45a8330239e403dd570837fa33e5c55b388 Mon Sep 17 00:00:00 2001 From: t0kubetsu Date: Tue, 11 Aug 2026 16:30:23 +0200 Subject: [PATCH 16/16] fix(ci): install ansible.posix collection before lint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bundles/admin uses ansible.posix.synchronize, which is not bundled with ansible-core on the CI image — syntax-check[unknown-module] was CI-only because local ~/.ansible/collections masked it. --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5d54983e..74e12980 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,6 +14,8 @@ jobs: - run: apt-get update && apt-get install -y --no-install-recommends git - uses: actions/checkout@v6 - run: pip install --no-cache-dir ansible-lint==26.6.0 + # bundles use ansible.posix (synchronize) — not shipped with ansible-core + - run: ansible-galaxy collection install ansible.posix - run: ansible-lint bundles/ env: # bundles/generic/repo.clone.kunai_workshop resolves its inner