 sandwich
|
5b66df7e7b
|
feat(configuration): auto-bind PCR 7 when Secure Boot and FDE are both enabled
|
2026-04-16 15:37:13 +02:00 |
|
|
sandwich
|
aef1375392
|
feat(configuration): add Secure Boot tasks for shim and sbctl
|
2026-04-16 15:37:13 +02:00 |
|
|
sandwich
|
1d3a0817cb
|
feat(configuration): override EFI loader to shim when Secure Boot enabled
|
2026-04-02 04:34:47 +02:00 |
|
|
sandwich
|
c2dcbe418e
|
feat(bootstrap): add Secure Boot conditional packages for Debian, Ubuntu, and Arch
|
2026-04-02 04:34:16 +02:00 |
|
|
sandwich
|
224ce47e26
|
feat(global_defaults): add secure_boot feature toggle with normalization
|
2026-04-02 04:33:07 +02:00 |
|
|
sandwich
|
5c727797b9
|
docs(bootstrap): document desktop, initramfs, and FDE features with SSH keepalive config
|
2026-04-01 15:07:58 +02:00 |
|
|
sandwich
|
c2269d7443
|
feat(configuration): generic FDE with systemd-cryptenroll, clevis fallback, and configurable initramfs
|
2026-04-01 15:07:58 +02:00 |
|
|
sandwich
|
de75466d89
|
fix(configuration): RedHat EFI grub wrapper with btrfs subvol prefix and boot order
|
2026-04-01 15:07:58 +02:00 |
|
|
sandwich
|
a498b879a4
|
fix(partitioning): set btrfs default subvolume and restrict @pkg to Arch
|
2026-04-01 15:07:58 +02:00 |
|
|
sandwich
|
8664a26e89
|
fix(bootstrap): resolve interface-only network, sshd penalties, dnf scriptlets, and EFI cleanup
|
2026-04-01 15:07:58 +02:00 |
|
|
sandwich
|
2c2f7161e9
|
feat(bootstrap): add desktop environment support with configurable DE, DM, and display target
|
2026-04-01 15:07:58 +02:00 |
|
|
sandwich
|
1d4b335414
|
fix(configuration): use /boot/grub2/grub.cfg for RedHat EFI grub config
|
2026-03-25 16:03:39 +01:00 |
|
|
sandwich
|
a6136520d5
|
feat(packages): add needrestart to Debian and Ubuntu package lists
|
2026-03-20 18:06:14 +01:00 |
|
|
sandwich
|
dd819ec8b5
|
feat(bootstrap): add full package upgrade step for Debian and Ubuntu
|
2026-03-20 18:05:04 +01:00 |
|
|
sandwich
|
fdd9e60970
|
fix(vim): use vimscript comment syntax for blockinfile markers in vimrc
|
2026-03-20 18:00:12 +01:00 |
|
|
sandwich
|
bb1e42b0e3
|
fix(sudo): use explicit string check instead of bool conditional for sudo field
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
9e6d7b75be
|
fix(connection): set ansible_port explicitly at every connection transition
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
4e381435d1
|
fix(vmware): use primary ansible_* vars for vmware_tools connection plugin precedence
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
e5f9bd8ad3
|
fix(vmware): use empty password for vmware_tools during live ISO bootstrap
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
4f4ce8cd71
|
fix(users): update cloud-init template and input validation for dict users
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
8c0e7e6dd3
|
refactor(prompts): remove vars_prompt, require users defined in inventory
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
b542d30900
|
fix(prompts): add default values to vars_prompt to skip in non-interactive mode
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
b7eb9222b0
|
refactor(users): change system.users from list to dict keyed by username
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
505b087ec5
|
fix(configuration): make root password, user keys, and sudo all optional
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
37b94172af
|
fix(cloud-init): handle missing keys and make sudo conditional
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
1282ef0a76
|
fix(cleanup): remove ansible_become override that blocks swapoff/umount
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
6bfc5f6eb5
|
feat(global_defaults): add system.features.aur schema for validation passthrough
|
2026-03-20 17:31:49 +01:00 |
|
|
sandwich
|
af06eb10ae
|
refactor(virtualization): extract shared Xen disk definitions
|
2026-03-12 12:27:18 +01:00 |
|
|
sandwich
|
aad8bb3bbd
|
refactor: remove unnecessary changed_when from set_fact tasks
|
2026-03-12 12:25:45 +01:00 |
|
|
sandwich
|
ca76f4445e
|
refactor(partitioning): remove redundant blockdev --rereadpt calls
|
2026-03-12 12:25:15 +01:00 |
|
|
sandwich
|
0be7bf4aba
|
refactor(partitioning): remove unused register variables
|
2026-03-12 12:24:59 +01:00 |
|
|
sandwich
|
20d7dcbc5f
|
chore: suppress args[module] false positives from variable-based module_defaults
|
2026-03-12 12:12:27 +01:00 |
|
|
sandwich
|
c1266d0daa
|
fix(cleanup): add no_log to Proxmox VM restart task
|
2026-03-12 12:12:27 +01:00 |
|
|
sandwich
|
f047be119d
|
fix(virtualization): add missing changed_when to Xen VM stop task
|
2026-03-12 12:12:27 +01:00 |
|
|
sandwich
|
a76573ff21
|
fix(configuration): replace fail+ignore_errors with debug for TPM2 fallback warning
|
2026-03-12 12:12:27 +01:00 |
|
|
sandwich
|
81d26eb715
|
refactor(configuration): split encryption.yml into crypttab, dracut, grub, and initramfs subtasks
|
2026-03-12 09:40:40 +01:00 |
|
|
sandwich
|
41691fcf0a
|
feat(bootstrap): add rescue block with VM cleanup on failure
|
2026-03-12 07:43:51 +01:00 |
|
|
sandwich
|
601f8a1ef9
|
feat(environment): VMware network config, DNS resolvers, and SSH switchover
|
2026-03-12 07:43:46 +01:00 |
|
|
sandwich
|
49d362c860
|
fix(global_defaults): populate flat network fields from interfaces in pre-computed path
|
2026-03-12 07:43:39 +01:00 |
|
|
sandwich
|
f9656cfbf5
|
feat(vmware): add VMware hypervisor support (node field, connection vars, validation)
|
2026-03-12 07:43:34 +01:00 |
|
|
sandwich
|
c99daa3dbc
|
fix(bootstrap): exclude tldr from Ubuntu rolling extra packages
|
2026-02-22 20:40:46 +01:00 |
|
|
sandwich
|
d35976635c
|
fix(global_defaults): use archive.ubuntu.com instead of mirror redirector
|
2026-02-22 16:26:35 +01:00 |
|
|
sandwich
|
b13f89a250
|
fix(global_defaults): apply mirror default in pre-computed system_cfg path
|
2026-02-22 14:20:12 +01:00 |
|
|
sandwich
|
b3b634f915
|
feat(configuration): add Debian/Ubuntu repository and apt configuration
|
2026-02-22 10:47:47 +01:00 |
|
|
sandwich
|
b8dd400aea
|
feat(bootstrap): use configurable mirror and write proper sources.list
|
2026-02-22 10:47:43 +01:00 |
|
|
sandwich
|
f38e0a628f
|
feat(global_defaults): add system.mirror to schema and normalization
|
2026-02-22 10:47:40 +01:00 |
|
|
sandwich
|
3242d5a895
|
chore(bootstrap): update ubuntu non-lts codename to questing (25.10)
|
2026-02-22 03:08:54 +01:00 |
|
|
sandwich
|
7e812dd74c
|
fix(global_defaults): add missing ssh.enabled validation assertion
|
2026-02-22 03:08:31 +01:00 |
|
|
sandwich
|
785eaab9a7
|
fix(global_defaults): correct fedora version upper bound to 43
|
2026-02-22 03:08:23 +01:00 |
|
|
sandwich
|
81ff2b2b87
|
feat(global_defaults): add root.shell to system schema and normalization
|
2026-02-22 03:07:30 +01:00 |
|
|
sandwich
|
2265e346b0
|
refactor(cleanup): remove duplicated libvirt path vars, reuse virtualization defaults
|
2026-02-22 03:07:04 +01:00 |
|
|
sandwich
|
d9ae4ee809
|
refactor(bootstrap,configuration): rename validation-only _normalize.yml files
|
2026-02-22 03:06:34 +01:00 |
|
|
sandwich
|
931d65df04
|
fix(partitioning): add | bool to all system_cfg.features.cis.enabled checks
|
2026-02-22 03:06:13 +01:00 |
|
|
sandwich
|
59670e876a
|
fix(partitioning): add partition separator for NVMe/mmcblk device paths
|
2026-02-22 02:39:36 +01:00 |
|
|
sandwich
|
f7070343b9
|
refactor(configuration): centralize DNS list variables in network dispatch
|
2026-02-22 02:39:32 +01:00 |
|
|
sandwich
|
1cce81366c
|
refactor(configuration): extract shared BLS update task to reduce duplication
|
2026-02-22 02:39:28 +01:00 |
|
|
sandwich
|
f6cb7bf78d
|
fix(bootstrap): add missing --best flag to RHEL dnf commands
|
2026-02-22 02:39:23 +01:00 |
|
|
sandwich
|
2c80c01b1a
|
refactor(global_defaults): consolidate hypervisor auth into shared credential dicts
|
2026-02-22 02:35:04 +01:00 |
|
|
sandwich
|
1b58a20c45
|
refactor(bootstrap,configuration,environment): add defaults/main.yml and extract hardcoded values
|
2026-02-22 02:32:36 +01:00 |
|
|
sandwich
|
6b1686e652
|
refactor(bootstrap,configuration): add per-role _normalize.yml for platform resolution
|
2026-02-22 02:27:46 +01:00 |
|
|
sandwich
|
a460584c5d
|
refactor(configuration): add platform_config dict and replace is_rhel/is_debian with os_family lookups
|
2026-02-22 02:26:54 +01:00 |
|
|
sandwich
|
9c0f00f1ec
|
feat(global_defaults): add os_family_map and os_family fact for platform config lookups
|
2026-02-22 02:23:05 +01:00 |
|
|
sandwich
|
6ebceb8ee2
|
fix(virtualization): add vTPM2 result validation before VMware power-on
|
2026-02-22 02:22:37 +01:00 |
|
|
sandwich
|
5e72394bf8
|
feat(global_defaults): add semantic validations for IP, hostname, LUKS method, and interface prefix
|
2026-02-22 02:22:05 +01:00 |
|
|
sandwich
|
5abdc76c86
|
refactor(global_defaults): extract physical_default_os to configurable default
|
2026-02-22 02:21:34 +01:00 |
|
|
sandwich
|
bcfd5d5a89
|
fix(global_defaults): normalize system.type 'vm' to 'virtual' for main project compatibility
|
2026-02-22 02:21:22 +01:00 |
|
|
sandwich
|
c91e049378
|
docs(bootstrap): add section comments, role boundary docs, and pipeline overview
|
2026-02-22 01:59:12 +01:00 |
|
|
sandwich
|
b9e8aa283b
|
refactor(global_defaults): data-driven hypervisor validation and shared constants
|
2026-02-22 01:59:09 +01:00 |
|
|
sandwich
|
734ed822d6
|
refactor(extras): convert custom.sh from template to static copy
|
2026-02-22 01:59:04 +01:00 |
|
|
sandwich
|
3f2f4055f0
|
fix(cleanup,config): xen tmp cleanup, tpm2 fallback warning, add code comments
|
2026-02-22 01:59:01 +01:00 |
|
|
sandwich
|
a2b206127f
|
fix(partitioning,network): swapon idempotency, DNS search domains, tune2fs changed_when
|
2026-02-22 01:58:56 +01:00 |
|
|
sandwich
|
6985235e70
|
fix(encryption): add no_log to LUKS configuration block
|
2026-02-22 01:58:52 +01:00 |
|
|
sandwich
|
25b1eeec45
|
fix(network): bind NM connections to detected interface names for multi-NIC
|
2026-02-21 16:51:15 +01:00 |
|
|
sandwich
|
3f65585e5c
|
fix(bootstrap): make dhcp-client conditional for EL < 10 (removed in EL 10)
|
2026-02-21 13:43:41 +01:00 |
|
|
sandwich
|
74f1365a06
|
fix(bootstrap): remove --asexplicit from pacstrap to preserve dependency metadata
|
2026-02-21 13:26:59 +01:00 |
|
|
sandwich
|
9d19f628aa
|
fix(bootstrap): add kernel package to rocky and almalinux extra packages
|
2026-02-21 12:06:09 +01:00 |
|
|
sandwich
|
ced0da7bd1
|
fix(bootstrap): detect kernel package name for dnf family reinstall step
|
2026-02-21 11:46:57 +01:00 |
|
|
sandwich
|
cf49d30916
|
fix(bootstrap): ensure chroot DNS resolution before installing extra packages
|
2026-02-21 11:30:28 +01:00 |
|
|
sandwich
|
46b5223da5
|
fix(environment): align repo IDs in rocky and almalinux templates with bootstrap config
|
2026-02-21 11:18:34 +01:00 |
|
|
sandwich
|
494f0b58b2
|
fix(configuration): omit interface-name when not explicitly provided to avoid predictable naming mismatch
|
2026-02-21 08:29:24 +01:00 |
|
|
sandwich
|
d84b867cef
|
refactor(configuration): rename _uid to configuration_uid for role prefix convention
|
2026-02-21 05:14:33 +01:00 |
|
|
sandwich
|
39c786305f
|
fix(configuration): handle boolean sudo values in sudoers deployment
|
2026-02-21 05:14:29 +01:00 |
|
|
sandwich
|
72e2263f5c
|
fix(configuration): use full path for chpasswd in chroot
|
2026-02-21 05:03:36 +01:00 |
|
|
sandwich
|
ac532578b8
|
fix(global_defaults): enrich pre-computed system_cfg with bootstrap defaults
|
2026-02-21 04:24:23 +01:00 |
|
|
sandwich
|
34f35bb5ac
|
chore(lint): suppress var-naming for user-facing API dicts
|
2026-02-21 02:58:10 +01:00 |
|
|
sandwich
|
6de88a911a
|
fix(configuration): remove unnecessary changed_when on set_fact tasks
|
2026-02-21 02:56:58 +01:00 |
|
|
sandwich
|
fa78edf2e2
|
refactor(cis): align normalization with main project activation gate pattern
|
2026-02-21 02:56:39 +01:00 |
|
|
sandwich
|
a1c8b5e2dd
|
fix(global_defaults): remove dead /swap and make pacman cache arch-only in reserved mounts
|
2026-02-21 02:56:20 +01:00 |
|
|
sandwich
|
19da8c0e68
|
fix(global_defaults): set filesystem default to ext4 instead of empty string
|
2026-02-21 02:56:08 +01:00 |
|
|
sandwich
|
ff1a4df960
|
refactor(bootstrap): restructure package lists to self-contained per-OS dicts with base/extra/conditional
|
2026-02-21 02:39:06 +01:00 |
|
|
sandwich
|
f0c0b54e7f
|
refactor(environment): split main.yml into focused sub-task files
|
2026-02-21 02:39:05 +01:00 |
|
|
sandwich
|
a868c6bb47
|
refactor(global_defaults): add idempotency guards to normalization tasks
|
2026-02-21 02:39:03 +01:00 |
|
|
sandwich
|
dd0d70f4fd
|
fix(global_defaults): default interface name to eth0 instead of empty string
|
2026-02-21 02:38:59 +01:00 |
|
|
sandwich
|
c08e1fe4e0
|
docs(cis): add comment explaining squashfs/snap Ubuntu exclusion
|
2026-02-21 02:38:58 +01:00 |
|
|
sandwich
|
c3ccce97ae
|
chore(bootstrap): pin collection versions in requirements.yml
|
2026-02-21 02:38:57 +01:00 |
|
|
sandwich
|
d9ca905b73
|
fix(bootstrap): move Jinja to end of task name and rename registers to bootstrap_dnf_*
|
2026-02-21 02:38:27 +01:00 |
|
|
sandwich
|
6085336f96
|
docs: update README with cis dict API, execution pipeline, and cleanup defaults
|
2026-02-21 01:30:36 +01:00 |
|
|
sandwich
|
2831479e77
|
fix(validation): align btrfs disk size check with new 2GB swap minimum
|
2026-02-21 01:28:32 +01:00 |
|
|
sandwich
|
608cbf3196
|
refactor(bootstrap): unify rocky, almalinux, and fedora into shared _dnf_family.yml
|
2026-02-21 01:27:33 +01:00 |
|
|
sandwich
|
382e48176d
|
refactor(cis): extract hardcoded values to cis_defaults and add _normalize.yml
|
2026-02-21 01:26:31 +01:00 |
|