refactor(schema): rename nested dict keys and simplify validation

roles/global_defaults/tasks/system.yml

@@ -11,17 +11,6 @@
     fail_msg: "system must be a dictionary"
     quiet: true
 
-- name: Reject deprecated top-level system selectors
-  ansible.builtin.assert:
-    that:
-      - os is not defined
-      - os_version is not defined
-      - hostname is not defined
-    fail_msg: >-
-      Top-level `os`, `os_version`, and `hostname` are not supported.
-      Define these values under `system` (`system.os`, `system.os_version`, `system.name`).
-    quiet: true
-
 - name: Build normalized system configuration
   vars:
     system_raw: "{{ system_defaults | combine(system, recursive=True) }}"
@@ -41,6 +30,7 @@
     system_user_raw: "{{ system_raw.user if system_raw.user is mapping else {} }}"
     system_root_raw: "{{ system_raw.root if system_raw.root is mapping else {} }}"
     system_luks_raw: "{{ system_raw.luks if system_raw.luks is mapping else {} }}"
+    system_luks_tpm2_raw: "{{ system_luks_raw.tpm2 if system_luks_raw.tpm2 is mapping else {} }}"
     system_features_raw: "{{ system_raw.features if system_raw.features is mapping else {} }}"
 
     system_feature_cis_raw: >-
@@ -97,7 +87,7 @@
     system_cfg:
       type: "{{ system_type }}"
       os: "{{ system_os_input if system_os_input | length > 0 else ('archlinux' if system_type == 'physical' else '') }}"
-      os_version: "{{ system_raw.os_version | default('') | string }}"
+      version: "{{ system_raw.version | default('') | string }}"
       name: "{{ system_name }}"
       id: "{{ system_raw.id | default('') | string }}"
       cpus: "{{ [system_raw.cpus | default(0) | int, 0] | max }}"
@@ -152,27 +142,28 @@
       user:
         name: "{{ system_user_raw.name | default('') | string }}"
         password: "{{ system_user_raw.password | default('') | string }}"
-        public_key: "{{ system_user_raw.public_key | default('') | string }}"
+        key: "{{ system_user_raw.key | default('') | string }}"
       root:
         password: "{{ system_root_raw.password | default('') | string }}"
       luks:
         enabled: "{{ system_luks_raw.enabled | default(system_defaults.luks.enabled) | bool }}"
         passphrase: "{{ system_luks_raw.passphrase | default(system_defaults.luks.passphrase) | string }}"
-        mapper_name: "{{ system_luks_raw.mapper_name | default(system_defaults.luks.mapper_name) | string }}"
-        auto_decrypt: "{{ system_luks_raw.auto_decrypt | default(system_defaults.luks.auto_decrypt) | bool }}"
-        auto_decrypt_method: "{{ system_luks_raw.auto_decrypt_method | default(system_defaults.luks.auto_decrypt_method) | string | lower }}"
-        tpm2_device: "{{ system_luks_raw.tpm2_device | default(system_defaults.luks.tpm2_device) | string }}"
-        tpm2_pcrs: "{{ system_luks_raw.tpm2_pcrs | default(system_defaults.luks.tpm2_pcrs) | string }}"
-        keyfile_size: "{{ system_luks_raw.keyfile_size | default(system_defaults.luks.keyfile_size) | int }}"
+        mapper: "{{ system_luks_raw.mapper | default(system_defaults.luks.mapper) | string }}"
+        auto: "{{ system_luks_raw.auto | default(system_defaults.luks.auto) | bool }}"
+        method: "{{ system_luks_raw.method | default(system_defaults.luks.method) | string | lower }}"
+        tpm2:
+          device: "{{ system_luks_tpm2_raw.device | default(system_defaults.luks.tpm2.device) | string }}"
+          pcrs: "{{ system_luks_tpm2_raw.pcrs | default(system_defaults.luks.tpm2.pcrs) | string }}"
+        keysize: "{{ system_luks_raw.keysize | default(system_defaults.luks.keysize) | int }}"
         options: "{{ system_luks_raw.options | default(system_defaults.luks.options) | string }}"
         type: "{{ system_luks_raw.type | default(system_defaults.luks.type) | string }}"
         cipher: "{{ system_luks_raw.cipher | default(system_defaults.luks.cipher) | string }}"
         hash: "{{ system_luks_raw.hash | default(system_defaults.luks.hash) | string }}"
-        iter_time: "{{ system_luks_raw.iter_time | default(system_defaults.luks.iter_time) | int }}"
-        key_size: "{{ system_luks_raw.key_size | default(system_defaults.luks.key_size) | int }}"
+        iter: "{{ system_luks_raw.iter | default(system_defaults.luks.iter) | int }}"
+        bits: "{{ system_luks_raw.bits | default(system_defaults.luks.bits) | int }}"
         pbkdf: "{{ system_luks_raw.pbkdf | default(system_defaults.luks.pbkdf) | string }}"
-        use_urandom: "{{ system_luks_raw.use_urandom | default(system_defaults.luks.use_urandom) | bool }}"
-        verify_passphrase: "{{ system_luks_raw.verify_passphrase | default(system_defaults.luks.verify_passphrase) | bool }}"
+        urandom: "{{ system_luks_raw.urandom | default(system_defaults.luks.urandom) | bool }}"
+        verify: "{{ system_luks_raw.verify | default(system_defaults.luks.verify) | bool }}"
       features:
         cis:
           enabled: "{{ system_feature_cis_raw.enabled | default(system_defaults.features.cis.enabled) | bool }}"
@@ -195,7 +186,7 @@
           tool: "{{ system_feature_chroot_raw.tool | default(system_defaults.features.chroot.tool) | string }}"
     hostname: "{{ system_name }}"
     os: "{{ system_os_input if system_os_input | length > 0 else ('archlinux' if system_type == 'physical' else '') }}"
-    os_version: "{{ system_raw.os_version | default('') | string }}"
+    os_version: "{{ system_raw.version | default('') | string }}"
   changed_when: false
 
 - name: Normalize system disks input

roles/global_defaults/tasks/validation.yml

@@ -37,7 +37,7 @@
       - storage
       - datacenter
       - cluster
-      - validate_certs
+      - certs
       - ssh
     hypervisor_keys: "{{ (hypervisor | default({})) | dict2items | map(attribute='key') | list }}"
     hypervisor_unknown_keys: "{{ hypervisor_keys | difference(hypervisor_allowed_keys) }}"
@@ -52,7 +52,7 @@
     system_allowed_keys:
       - type
       - os
-      - os_version
+      - version
       - name
       - id
       - cpus
@@ -79,85 +79,28 @@
     fail_msg: "Unsupported system keys: {{ system_unknown_keys | join(', ') }}"
     quiet: true
 
-- name: Reject deprecated top-level input keys
-  vars:
-    deprecated_input_keys:
-      - install_type
-      - vm_ip
-      - vm_id
-      - vm_name
-      - vm_cpus
-      - memory_mb
-      - balloon_mb
-      - dns_servers
-      - dns_search
-      - extra_packages
-      - user_name
-      - user_password
-      - user_public_key
-      - root_password
-      - luks_enabled
-      - luks_passphrase
-      - luks_mapper_name
-      - luks_auto_decrypt
-      - luks_auto_decrypt_method
-      - luks_tpm2_device
-      - luks_tpm2_pcrs
-      - luks_keyfile_size
-      - firewall_enabled
-      - firewall_backend
-      - firewall_toolkit
-      - ssh_enabled
-      - cis
-      - selinux_enabled
-      - zstd_enabled
-      - swap_enabled
-      - motd_enabled
-      - sudo_banner_enabled
-      - chroot_tool
-      - hypervisor_url
-      - hypervisor_username
-      - hypervisor_password
-      - hypervisor_node
-      - hypervisor_storage
-      - hypervisor_datacenter
-      - hypervisor_cluster
-      - hypervisor_validate_certs
-      - hypervisor_ssh
-      - hypervisor_path
-    top_level_input_keys: "{{ (hostvars[inventory_hostname] | dict2items | map(attribute='key') | list) }}"
-    deprecated_input_keys_present: "{{ top_level_input_keys | intersect(deprecated_input_keys) }}"
-  ansible.builtin.assert:
-    that:
-      - deprecated_input_keys_present | length == 0
-    fail_msg: >-
-      Unsupported top-level keys found: {{ deprecated_input_keys_present | join(', ') }}.
-      Use only the `system` and `hypervisor` dictionaries for runtime configuration.
-    quiet: true
-
 - name: Validate nested system schema
   vars:
     dns_allowed_keys: [servers, search]
-    user_allowed_keys: [name, password, public_key]
+    user_allowed_keys: [name, password, key]
     root_allowed_keys: [password]
     luks_allowed_keys:
       - enabled
       - passphrase
-      - mapper_name
-      - auto_decrypt
-      - auto_decrypt_method
-      - tpm2_device
-      - tpm2_pcrs
-      - keyfile_size
+      - mapper
+      - auto
+      - method
+      - tpm2
+      - keysize
       - options
       - type
       - cipher
       - hash
-      - iter_time
-      - key_size
+      - iter
+      - bits
       - pbkdf
-      - use_urandom
-      - verify_passphrase
+      - urandom
+      - verify
     features_allowed_keys:
       - cis
       - selinux
@@ -180,11 +123,20 @@
     user_keys: "{{ (system.user | default({})) | dict2items | map(attribute='key') | list }}"
     root_keys: "{{ (system.root | default({})) | dict2items | map(attribute='key') | list }}"
     luks_keys: "{{ (system.luks | default({})) | dict2items | map(attribute='key') | list }}"
+    tpm2_keys: >-
+      {{
+        (
+          (system.luks if (system.luks is defined and system.luks is mapping) else {}).tpm2
+          | default({})
+        ) | dict2items | map(attribute='key') | list
+      }}
+    tpm2_allowed_keys: [device, pcrs]
     features_keys: "{{ (system.features | default({})) | dict2items | map(attribute='key') | list }}"
     dns_unknown: "{{ dns_keys | difference(dns_allowed_keys) }}"
     user_unknown: "{{ user_keys | difference(user_allowed_keys) }}"
     root_unknown: "{{ root_keys | difference(root_allowed_keys) }}"
     luks_unknown: "{{ luks_keys | difference(luks_allowed_keys) }}"
+    tpm2_unknown: "{{ tpm2_keys | difference(tpm2_allowed_keys) }}"
     features_unknown: "{{ features_keys | difference(features_allowed_keys) }}"
   ansible.builtin.assert:
     that:
@@ -192,11 +144,13 @@
       - system.user is not defined or system.user is mapping
       - system.root is not defined or system.root is mapping
       - system.luks is not defined or system.luks is mapping
+      - system.luks is not defined or system.luks.tpm2 is not defined or system.luks.tpm2 is mapping
       - system.features is not defined or system.features is mapping
       - dns_unknown | length == 0
       - user_unknown | length == 0
       - root_unknown | length == 0
       - luks_unknown | length == 0
+      - tpm2_unknown | length == 0
       - features_unknown | length == 0
     fail_msg: >-
       Invalid nested system schema.
@@ -204,6 +158,7 @@
       user_unknown={{ user_unknown | join(',') }},
       root_unknown={{ root_unknown | join(',') }},
       luks_unknown={{ luks_unknown | join(',') }},
+      tpm2_unknown={{ tpm2_unknown | join(',') }},
       features_unknown={{ features_unknown | join(',') }}
     quiet: true
 
@@ -305,7 +260,7 @@
         ) or (
           os in ["alpine", "archlinux", "opensuse", "ubuntu", "ubuntu-lts", "void"]
         )
-    fail_msg: "Invalid os/os_version specified. Please check README.md for supported values."
+    fail_msg: "Invalid os/version specified. Please check README.md for supported values."
     quiet: true
 
 - name: Validate RHEL ISO requirement