sandwich
30f74fa4bd
fix(bootstrap): remove --asexplicit from pacstrap to preserve dependency metadata
2026-02-21 13:26:59 +01:00
sandwich
19372db27e
fix(bootstrap): add kernel package to rocky and almalinux extra packages
2026-02-21 12:06:09 +01:00
sandwich
d55fc5799d
fix(bootstrap): detect kernel package name for dnf family reinstall step
2026-02-21 11:46:57 +01:00
sandwich
98231be0bd
fix(bootstrap): ensure chroot DNS resolution before installing extra packages
2026-02-21 11:30:28 +01:00
sandwich
c46a4a5a0a
fix(environment): align repo IDs in rocky and almalinux templates with bootstrap config
2026-02-21 11:18:34 +01:00
sandwich
b84688f1d6
fix(configuration): omit interface-name when not explicitly provided to avoid predictable naming mismatch
2026-02-21 08:29:24 +01:00
sandwich
b1d2294d63
refactor(configuration): rename _uid to configuration_uid for role prefix convention
2026-02-21 05:14:33 +01:00
sandwich
ac339b54c4
fix(configuration): handle boolean sudo values in sudoers deployment
2026-02-21 05:14:29 +01:00
sandwich
cb46a6989f
fix(configuration): use full path for chpasswd in chroot
2026-02-21 05:03:36 +01:00
sandwich
73ea7a177b
fix(global_defaults): enrich pre-computed system_cfg with bootstrap defaults
2026-02-21 04:24:23 +01:00
sandwich
0f8faf0a22
chore(lint): suppress var-naming for user-facing API dicts
2026-02-21 02:58:10 +01:00
sandwich
b520126253
fix(configuration): remove unnecessary changed_when on set_fact tasks
2026-02-21 02:56:58 +01:00
sandwich
a4ca4c4ff4
refactor(cis): align normalization with main project activation gate pattern
2026-02-21 02:56:39 +01:00
sandwich
d9efb54bec
fix(global_defaults): remove dead /swap and make pacman cache arch-only in reserved mounts
2026-02-21 02:56:20 +01:00
sandwich
e7a0cc4f62
fix(global_defaults): set filesystem default to ext4 instead of empty string
2026-02-21 02:56:08 +01:00
sandwich
a76f317f8f
refactor(bootstrap): restructure package lists to self-contained per-OS dicts with base/extra/conditional
2026-02-21 02:39:06 +01:00
sandwich
e5bd152fb3
refactor(environment): split main.yml into focused sub-task files
2026-02-21 02:39:05 +01:00
sandwich
6d1c3577df
refactor(global_defaults): add idempotency guards to normalization tasks
2026-02-21 02:39:03 +01:00
sandwich
86f0284acb
fix(global_defaults): default interface name to eth0 instead of empty string
2026-02-21 02:38:59 +01:00
sandwich
221bb4d517
docs(cis): add comment explaining squashfs/snap Ubuntu exclusion
2026-02-21 02:38:58 +01:00
sandwich
e81ba76446
chore(bootstrap): pin collection versions in requirements.yml
2026-02-21 02:38:57 +01:00
sandwich
54bbb9d15c
fix(bootstrap): move Jinja to end of task name and rename registers to bootstrap_dnf_*
2026-02-21 02:38:27 +01:00
sandwich
f94b220020
docs: update README with cis dict API, execution pipeline, and cleanup defaults
2026-02-21 01:30:36 +01:00
sandwich
3fd470d63e
fix(validation): align btrfs disk size check with new 2GB swap minimum
2026-02-21 01:28:32 +01:00
sandwich
a3cd507b2a
refactor(bootstrap): unify rocky, almalinux, and fedora into shared _dnf_family.yml
2026-02-21 01:27:33 +01:00
sandwich
f74ec325ea
refactor(cis): extract hardcoded values to cis_defaults and add _normalize.yml
2026-02-21 01:26:31 +01:00
sandwich
bef15af69f
refactor(cleanup): prioritize source-match over target-match in libvirt media removal
2026-02-21 01:22:44 +01:00
sandwich
7970d933e8
docs(cis): explain Fedora exclusion from crypto-policy configuration
2026-02-21 01:22:41 +01:00
sandwich
a123a32feb
fix(bootstrap): replace brittle sed with ansible.builtin.replace for ubuntu universe repo
2026-02-21 01:22:37 +01:00
sandwich
54c704de4e
refactor(virtualization): simplify cloud-user-data sudo to unconditional NOPASSWD
2026-02-21 01:22:34 +01:00
sandwich
9308d09d7b
fix(bootstrap): remove duplicate lrzsz and gate dbus-daemon on version in almalinux
2026-02-21 01:20:34 +01:00
sandwich
f367844239
fix(virtualization): fix cloud-user-data sudo logic to respect sudo: false
2026-02-21 01:20:31 +01:00
sandwich
53e4499d2b
fix(partitioning): lower swap minimum from 4GB to 2GB for small VMs
2026-02-21 01:19:23 +01:00
sandwich
eb63a4fa83
fix(partitioning): add wipefs before mkfs on extra disk partitions
2026-02-21 01:19:19 +01:00
sandwich
9e3688ae2b
fix(cis): strengthen kernel module blacklist and sysctl hardening
2026-02-21 01:18:52 +01:00
sandwich
dea01cc8a0
refactor(partitioning): split monolithic main.yml into focused task files
2026-02-21 00:39:03 +01:00
sandwich
92c9702e1d
fix(validation): add CIDR prefix range check and Ubuntu version validation
2026-02-21 00:38:57 +01:00
sandwich
c837a52a24
refactor(cis): remove redundant AllowUsers/AllowGroups/DenyUsers/DenyGroups from sshd
2026-02-21 00:38:52 +01:00
sandwich
fbd57e0603
fix(cis): skip squashfs blacklist on Ubuntu to preserve snap functionality
2026-02-21 00:38:47 +01:00
sandwich
40a9ee9882
fix(partitioning): correct changed_when on btrfs quota and qgroup commands
2026-02-21 00:38:43 +01:00
sandwich
3448e95e5c
fix(cis): add regexp to all lineinfile entries in security_lines.yml for idempotency
2026-02-21 00:38:36 +01:00
sandwich
074831833f
fix: add no_log to credential-handling pre_tasks and post_tasks in main.yml
2026-02-21 00:38:32 +01:00
sandwich
d1a5217e88
fix(virtualization): add no_log and secure temp file handling to libvirt cloud-init
2026-02-21 00:38:28 +01:00
sandwich
07492b5b57
refactor(cleanup): add configurable verify_boot, boot_timeout, and remove_on_failure defaults
2026-02-20 23:02:24 +01:00
sandwich
14913bcd3d
refactor: move playbook-root templates into their respective roles
2026-02-20 23:01:38 +01:00
sandwich
041650c287
refactor: add loop_control labels to dict-based loops across all roles
2026-02-20 23:00:53 +01:00
sandwich
a63ffbc731
refactor(partitioning): move btrfs home quota to configurable default
2026-02-20 22:55:37 +01:00
sandwich
9d2f1cc5bd
fix(environment): detect RHEL ISO device dynamically instead of hardcoded /dev/sr paths
2026-02-20 22:54:42 +01:00
sandwich
f72f9feb9a
refactor(global_defaults): split system.yml into composable normalization stages
2026-02-20 22:54:05 +01:00
sandwich
417737f904
refactor(global_defaults): extract OS family lists to single source of truth
2026-02-20 22:52:55 +01:00
sandwich
a06c2ebdcf
fix(partitioning): add failed_when to all blkid commands to catch empty UUIDs
2026-02-20 22:52:18 +01:00
sandwich
e174ecda42
fix(partitioning): add default fallbacks for is_rhel, os, os_version in defaults
2026-02-20 22:51:37 +01:00
sandwich
5246a905bb
fix(virtualization): use hostname variable instead of hardcoded archiso in cloud-user-data
2026-02-20 22:51:32 +01:00
sandwich
d00d84b69c
fix(virtualization): avoid no-handler lint finding in xen VM created tracking
2026-02-20 22:29:03 +01:00
sandwich
4dafa8c596
fix(partitioning): fix line length violation in home size calculation
2026-02-20 22:28:58 +01:00
sandwich
53584b8730
fix(configuration): add pipefail to root password shell pipe
2026-02-20 22:28:54 +01:00
sandwich
ce40468b77
fix(bootstrap): use release map for ubuntu version detection
2026-02-20 22:27:46 +01:00
sandwich
4b4fab3c33
chore: add .yamllint matching main project conventions
2026-02-20 22:27:31 +01:00
sandwich
db2fab5e7d
fix(configuration): use chpasswd for root password and separate shell setting
2026-02-20 22:27:17 +01:00
sandwich
42be0a5919
fix(configuration): add explicit LUKS auto-decrypt fallback state tracking and logging
2026-02-20 22:26:47 +01:00
sandwich
17400fa6ff
refactor(partitioning): externalize hardcoded LVM and disk sizing constants to defaults
2026-02-20 22:26:23 +01:00
sandwich
deb14d2c94
fix(virtualization): add xen VM existence check and improve changed_when
2026-02-20 22:25:10 +01:00
sandwich
65c5b1029b
fix(cis): add pipefail to sshd version detection and define binary defaults
2026-02-20 22:24:14 +01:00
sandwich
a1fbb7c21d
feat(cleanup): gate RHEL ISO disk and fstab handling on rhel_repo.source
2026-02-20 21:51:20 +01:00
sandwich
d076ac8fef
feat(global_defaults): add system.features.rhel_repo option (iso|satellite|none)
2026-02-20 21:51:16 +01:00
sandwich
c82e4afc4d
fix(encryption): add warning before silent TPM2-to-keyfile fallback
2026-02-20 21:51:12 +01:00
sandwich
ac72fdc4a6
fix(partitioning): correct wipefs changed_when to report actual disk modification
2026-02-20 21:51:09 +01:00
sandwich
b2e050c467
fix(validation): require password for primary user in system.users[0]
2026-02-20 21:51:06 +01:00
sandwich
914d7dd9d1
fix(system_check): move no_log from block to individual API tasks
2026-02-20 21:51:02 +01:00
sandwich
21bf8f79e2
fix(cis): make mlkem768x25519-sha256 KexAlgorithm conditional on OpenSSH 9.9+
2026-02-20 21:50:58 +01:00
sandwich
38feff4369
fix(cis): use is_rhel for journald config path instead of fedora-only check
2026-02-20 21:50:55 +01:00
sandwich
404529e8a4
refactor(configuration): add conditional dispatch to task includes
2026-02-20 21:16:52 +01:00
sandwich
3db18858c3
refactor(cis): move OS-specific binary resolution to vars/main.yml
2026-02-20 21:16:48 +01:00
sandwich
72a9576abe
refactor(configuration): split network.yml into per-init-system dispatch files
2026-02-20 21:16:45 +01:00
sandwich
462c2c7dfe
refactor(bootstrap): restructure conditional package lists to list concatenation
2026-02-20 21:16:40 +01:00
sandwich
ef8bfeaf84
refactor(configuration): convert services.yml to list-based loop
2026-02-20 21:16:37 +01:00
sandwich
ba6be037ac
refactor(virt): adopt module_defaults for hypervisor credentials
2026-02-20 21:16:33 +01:00
sandwich
5ca1c7f570
refactor(cleanup): restructure dispatch to use hypervisor_type include
2026-02-20 21:16:28 +01:00
sandwich
cd8e477534
refactor(partitioning): extract VG name to defaults variable
2026-02-20 21:16:25 +01:00
sandwich
c439e9741e
fix(configuration): remove trailing blank line from extras.yml
2026-02-20 20:20:33 +01:00
sandwich
0a5c70e49f
docs(environment): document RPM GPG policy relaxation
2026-02-20 20:19:57 +01:00
sandwich
19f2c9efe2
chore(bootstrap): align ansible.cfg with main project settings
2026-02-20 20:19:46 +01:00
sandwich
230c74fd9b
feat(system_check): add safety check for physical installs
2026-02-20 20:19:37 +01:00
sandwich
a2c19e2e49
fix(cleanup): fix vmware CD-ROM omit fragility and add cross-role defaults
2026-02-20 20:19:25 +01:00
sandwich
9f9a4b38b8
fix(virtualization): add XML safety attributes and switch xen to virtio
2026-02-20 20:18:49 +01:00
sandwich
524356cf8d
fix(cis): remove deprecated sshd options and update hardening values
2026-02-20 20:17:52 +01:00
sandwich
a2993212ca
fix(configuration): disambiguate BLS task names and clean up misc noise
2026-02-20 20:17:05 +01:00
sandwich
fba2e5fc94
refactor(configuration): relocate login banner and fix blockinfile markers
2026-02-20 20:16:19 +01:00
sandwich
cf68a93b45
fix(configuration): use short hostname and allow per-user shell
2026-02-20 20:15:49 +01:00
sandwich
3000268a0e
fix(partitioning): mount extra disks by UUID instead of device path
2026-02-20 20:15:25 +01:00
sandwich
196c5be67a
fix(partitioning): correct LVM swap sizing and harden UUID fallbacks
2026-02-20 20:15:00 +01:00
sandwich
33bad193b4
fix(configuration): add trailing semicolons to NM keyfile DNS fields
2026-02-20 20:14:06 +01:00
sandwich
d5277802f7
fix(bootstrap): add missing packages and remove duplicates
2026-02-20 20:13:53 +01:00
sandwich
28e6cf50d1
fix(bootstrap): add devpts mount and use ephemeral state for RHEL DVD
2026-02-20 20:12:59 +01:00
sandwich
42cb5071c2
fix(bootstrap): unify resolv.conf to live environment DNS symlink
2026-02-20 20:12:42 +01:00
sandwich
23a798a63a
fix(global_defaults): add no_log to hypervisor tasks and expand validation
2026-02-20 20:11:37 +01:00
sandwich
5dd84c6b39
fix: configurable OVMF/machine type, routes syntax, package lists, interface names
2026-02-20 18:47:12 +01:00
sandwich
d0ae20911b
fix(cleanup): keep RHEL ISO ide1 attached as local repo
2026-02-20 18:41:40 +01:00
sandwich
b6d06dd96d
fix: deep analysis audit — no_log, resolv.conf, service conflicts, lint
2026-02-20 18:34:59 +01:00
sandwich
09b3ed44ba
fix(bootstrap): RHEL 9 bootstrap from Arch ISO compatibility
...
- Generate resolv.conf from inventory DNS settings instead of copying
host file (Arch ISO has systemd-resolved stub 127.0.0.53)
- Add XFS compat options for GRUB 2.06 and kernel 5.14 across LVM
volumes, /boot partition, and data disks
- Mount API filesystems (proc, sys, dev) into chroot for RPM scriptlets
- Bypass GPG Sequoia validation with _pkgverify_level none
- Tolerate grub2-common scriptlet warnings
- Handle libvirt VM destroy gracefully during cleanup
2026-02-20 16:58:59 +01:00
sandwich