MORAWSKI Norbert
5a3f55b8de
fix(configuration): skip grub-mkconfig for RedHat EFI systems
2026-03-25 15:46:01 +01:00
d982e0af83
feat(packages): add needrestart to Debian and Ubuntu package lists
2026-03-20 18:06:14 +01:00
535e831f4e
feat(bootstrap): add full package upgrade step for Debian and Ubuntu
2026-03-20 18:05:04 +01:00
5ea7ef3c70
fix(vim): use vimscript comment syntax for blockinfile markers in vimrc
2026-03-20 18:00:12 +01:00
a1f223eb62
fix(sudo): use explicit string check instead of bool conditional for sudo field
2026-03-20 17:31:49 +01:00
4c9adb4ddc
fix(connection): set ansible_port explicitly at every connection transition
2026-03-20 17:31:49 +01:00
019ad9734a
fix(vmware): use primary ansible_* vars for vmware_tools connection plugin precedence
2026-03-20 17:31:49 +01:00
48ed7acb38
fix(vmware): use empty password for vmware_tools during live ISO bootstrap
2026-03-20 17:31:49 +01:00
93aa27c1fd
fix(users): update cloud-init template and input validation for dict users
2026-03-20 17:31:49 +01:00
6afe9dbd1c
refactor(prompts): remove vars_prompt, require users defined in inventory
2026-03-20 17:31:49 +01:00
fc53b6c786
fix(prompts): add default values to vars_prompt to skip in non-interactive mode
2026-03-20 17:31:49 +01:00
1232484b40
refactor(users): change system.users from list to dict keyed by username
2026-03-20 17:31:49 +01:00
d03179844a
fix(configuration): make root password, user keys, and sudo all optional
2026-03-20 17:31:49 +01:00
321fc79467
fix(cloud-init): handle missing keys and make sudo conditional
2026-03-20 17:31:49 +01:00
17c55c7c5c
fix(cleanup): remove ansible_become override that blocks swapoff/umount
2026-03-20 17:31:49 +01:00
21a31795aa
feat(global_defaults): add system.features.aur schema for validation passthrough
2026-03-20 17:31:49 +01:00
4336d864b3
refactor(virtualization): extract shared Xen disk definitions
2026-03-12 12:27:18 +01:00
62e50c19ff
refactor: remove unnecessary changed_when from set_fact tasks
2026-03-12 12:25:45 +01:00
b7cf1b10a9
refactor(partitioning): remove redundant blockdev --rereadpt calls
2026-03-12 12:25:15 +01:00
fc2d924349
refactor(partitioning): remove unused register variables
2026-03-12 12:24:59 +01:00
67e3753ece
chore: suppress args[module] false positives from variable-based module_defaults
2026-03-12 12:12:27 +01:00
da9e287e56
fix(cleanup): add no_log to Proxmox VM restart task
2026-03-12 12:12:27 +01:00
a8ea4f0962
fix(virtualization): add missing changed_when to Xen VM stop task
2026-03-12 12:12:27 +01:00
754668b734
fix(configuration): replace fail+ignore_errors with debug for TPM2 fallback warning
2026-03-12 12:12:27 +01:00
5b3076d9e1
refactor(configuration): split encryption.yml into crypttab, dracut, grub, and initramfs subtasks
2026-03-12 09:40:40 +01:00
1f778a7aaa
feat(bootstrap): add rescue block with VM cleanup on failure
2026-03-12 07:43:51 +01:00
54ffe5ff91
feat(environment): VMware network config, DNS resolvers, and SSH switchover
2026-03-12 07:43:46 +01:00
335534176f
fix(global_defaults): populate flat network fields from interfaces in pre-computed path
2026-03-12 07:43:39 +01:00
79227b4391
feat(vmware): add VMware hypervisor support (node field, connection vars, validation)
2026-03-12 07:43:34 +01:00
13faf33296
fix(bootstrap): exclude tldr from Ubuntu rolling extra packages
2026-02-22 20:40:46 +01:00
de451be77b
fix(global_defaults): use archive.ubuntu.com instead of mirror redirector
2026-02-22 16:26:35 +01:00
af9f264cd3
fix(global_defaults): apply mirror default in pre-computed system_cfg path
2026-02-22 14:20:12 +01:00
750a085e19
feat(configuration): add Debian/Ubuntu repository and apt configuration
2026-02-22 10:47:47 +01:00
f2eb9f2c8e
feat(bootstrap): use configurable mirror and write proper sources.list
2026-02-22 10:47:43 +01:00
79988619c6
feat(global_defaults): add system.mirror to schema and normalization
2026-02-22 10:47:40 +01:00
fb69c96e4a
chore(bootstrap): update ubuntu non-lts codename to questing (25.10)
2026-02-22 03:08:54 +01:00
d586c087f8
fix(global_defaults): add missing ssh.enabled validation assertion
2026-02-22 03:08:31 +01:00
9dd71b2559
fix(global_defaults): correct fedora version upper bound to 43
2026-02-22 03:08:23 +01:00
35f1702447
feat(global_defaults): add root.shell to system schema and normalization
2026-02-22 03:07:30 +01:00
8b18fbdb4c
refactor(cleanup): remove duplicated libvirt path vars, reuse virtualization defaults
2026-02-22 03:07:04 +01:00
909a0a6021
refactor(bootstrap,configuration): rename validation-only _normalize.yml files
2026-02-22 03:06:34 +01:00
2f3fce42b5
fix(partitioning): add | bool to all system_cfg.features.cis.enabled checks
2026-02-22 03:06:13 +01:00
b72816e985
fix(partitioning): add partition separator for NVMe/mmcblk device paths
2026-02-22 02:39:36 +01:00
ac0b5caf83
refactor(configuration): centralize DNS list variables in network dispatch
2026-02-22 02:39:32 +01:00
3ddc3c72ed
refactor(configuration): extract shared BLS update task to reduce duplication
2026-02-22 02:39:28 +01:00
f1af7ccbca
fix(bootstrap): add missing --best flag to RHEL dnf commands
2026-02-22 02:39:23 +01:00
51ca969ff4
refactor(global_defaults): consolidate hypervisor auth into shared credential dicts
2026-02-22 02:35:04 +01:00
1221249546
refactor(bootstrap,configuration,environment): add defaults/main.yml and extract hardcoded values
2026-02-22 02:32:36 +01:00
87fd69b825
refactor(bootstrap,configuration): add per-role _normalize.yml for platform resolution
2026-02-22 02:27:46 +01:00
3deb3ea751
refactor(configuration): add platform_config dict and replace is_rhel/is_debian with os_family lookups
2026-02-22 02:26:54 +01:00
cc30637f09
feat(global_defaults): add os_family_map and os_family fact for platform config lookups
2026-02-22 02:23:05 +01:00
23721aac96
fix(virtualization): add vTPM2 result validation before VMware power-on
2026-02-22 02:22:37 +01:00
5a9b346d72
feat(global_defaults): add semantic validations for IP, hostname, LUKS method, and interface prefix
2026-02-22 02:22:05 +01:00
75267e5140
refactor(global_defaults): extract physical_default_os to configurable default
2026-02-22 02:21:34 +01:00
f0fb68992d
fix(global_defaults): normalize system.type 'vm' to 'virtual' for main project compatibility
2026-02-22 02:21:22 +01:00
0e3edb41f7
docs(bootstrap): add section comments, role boundary docs, and pipeline overview
2026-02-22 01:59:12 +01:00
2bf0cb901e
refactor(global_defaults): data-driven hypervisor validation and shared constants
2026-02-22 01:59:09 +01:00
1216c79619
refactor(extras): convert custom.sh from template to static copy
2026-02-22 01:59:04 +01:00
4efd64664d
fix(cleanup,config): xen tmp cleanup, tpm2 fallback warning, add code comments
2026-02-22 01:59:01 +01:00
dc5aa5077e
fix(partitioning,network): swapon idempotency, DNS search domains, tune2fs changed_when
2026-02-22 01:58:56 +01:00
c65934c290
fix(encryption): add no_log to LUKS configuration block
2026-02-22 01:58:52 +01:00
5b8438ac3b
fix(network): bind NM connections to detected interface names for multi-NIC
2026-02-21 16:51:15 +01:00
45df803131
fix(bootstrap): make dhcp-client conditional for EL < 10 (removed in EL 10)
2026-02-21 13:43:41 +01:00
30f74fa4bd
fix(bootstrap): remove --asexplicit from pacstrap to preserve dependency metadata
2026-02-21 13:26:59 +01:00
19372db27e
fix(bootstrap): add kernel package to rocky and almalinux extra packages
2026-02-21 12:06:09 +01:00
d55fc5799d
fix(bootstrap): detect kernel package name for dnf family reinstall step
2026-02-21 11:46:57 +01:00
98231be0bd
fix(bootstrap): ensure chroot DNS resolution before installing extra packages
2026-02-21 11:30:28 +01:00
c46a4a5a0a
fix(environment): align repo IDs in rocky and almalinux templates with bootstrap config
2026-02-21 11:18:34 +01:00
b84688f1d6
fix(configuration): omit interface-name when not explicitly provided to avoid predictable naming mismatch
2026-02-21 08:29:24 +01:00
b1d2294d63
refactor(configuration): rename _uid to configuration_uid for role prefix convention
2026-02-21 05:14:33 +01:00
ac339b54c4
fix(configuration): handle boolean sudo values in sudoers deployment
2026-02-21 05:14:29 +01:00
cb46a6989f
fix(configuration): use full path for chpasswd in chroot
2026-02-21 05:03:36 +01:00
73ea7a177b
fix(global_defaults): enrich pre-computed system_cfg with bootstrap defaults
2026-02-21 04:24:23 +01:00
0f8faf0a22
chore(lint): suppress var-naming for user-facing API dicts
2026-02-21 02:58:10 +01:00
b520126253
fix(configuration): remove unnecessary changed_when on set_fact tasks
2026-02-21 02:56:58 +01:00
a4ca4c4ff4
refactor(cis): align normalization with main project activation gate pattern
2026-02-21 02:56:39 +01:00
d9efb54bec
fix(global_defaults): remove dead /swap and make pacman cache arch-only in reserved mounts
2026-02-21 02:56:20 +01:00
e7a0cc4f62
fix(global_defaults): set filesystem default to ext4 instead of empty string
2026-02-21 02:56:08 +01:00
a76f317f8f
refactor(bootstrap): restructure package lists to self-contained per-OS dicts with base/extra/conditional
2026-02-21 02:39:06 +01:00
e5bd152fb3
refactor(environment): split main.yml into focused sub-task files
2026-02-21 02:39:05 +01:00
6d1c3577df
refactor(global_defaults): add idempotency guards to normalization tasks
2026-02-21 02:39:03 +01:00
86f0284acb
fix(global_defaults): default interface name to eth0 instead of empty string
2026-02-21 02:38:59 +01:00
221bb4d517
docs(cis): add comment explaining squashfs/snap Ubuntu exclusion
2026-02-21 02:38:58 +01:00
e81ba76446
chore(bootstrap): pin collection versions in requirements.yml
2026-02-21 02:38:57 +01:00
54bbb9d15c
fix(bootstrap): move Jinja to end of task name and rename registers to bootstrap_dnf_*
2026-02-21 02:38:27 +01:00
f94b220020
docs: update README with cis dict API, execution pipeline, and cleanup defaults
2026-02-21 01:30:36 +01:00
3fd470d63e
fix(validation): align btrfs disk size check with new 2GB swap minimum
2026-02-21 01:28:32 +01:00
a3cd507b2a
refactor(bootstrap): unify rocky, almalinux, and fedora into shared _dnf_family.yml
2026-02-21 01:27:33 +01:00
f74ec325ea
refactor(cis): extract hardcoded values to cis_defaults and add _normalize.yml
2026-02-21 01:26:31 +01:00
bef15af69f
refactor(cleanup): prioritize source-match over target-match in libvirt media removal
2026-02-21 01:22:44 +01:00
7970d933e8
docs(cis): explain Fedora exclusion from crypto-policy configuration
2026-02-21 01:22:41 +01:00
a123a32feb
fix(bootstrap): replace brittle sed with ansible.builtin.replace for ubuntu universe repo
2026-02-21 01:22:37 +01:00
54c704de4e
refactor(virtualization): simplify cloud-user-data sudo to unconditional NOPASSWD
2026-02-21 01:22:34 +01:00
9308d09d7b
fix(bootstrap): remove duplicate lrzsz and gate dbus-daemon on version in almalinux
2026-02-21 01:20:34 +01:00
f367844239
fix(virtualization): fix cloud-user-data sudo logic to respect sudo: false
2026-02-21 01:20:31 +01:00
53e4499d2b
fix(partitioning): lower swap minimum from 4GB to 2GB for small VMs
2026-02-21 01:19:23 +01:00
eb63a4fa83
fix(partitioning): add wipefs before mkfs on extra disk partitions
2026-02-21 01:19:19 +01:00
9e3688ae2b
fix(cis): strengthen kernel module blacklist and sysctl hardening
2026-02-21 01:18:52 +01:00
dea01cc8a0
refactor(partitioning): split monolithic main.yml into focused task files
2026-02-21 00:39:03 +01:00
92c9702e1d
fix(validation): add CIDR prefix range check and Ubuntu version validation
2026-02-21 00:38:57 +01:00
c837a52a24
refactor(cis): remove redundant AllowUsers/AllowGroups/DenyUsers/DenyGroups from sshd
2026-02-21 00:38:52 +01:00
fbd57e0603
fix(cis): skip squashfs blacklist on Ubuntu to preserve snap functionality
2026-02-21 00:38:47 +01:00
40a9ee9882
fix(partitioning): correct changed_when on btrfs quota and qgroup commands
2026-02-21 00:38:43 +01:00
3448e95e5c
fix(cis): add regexp to all lineinfile entries in security_lines.yml for idempotency
2026-02-21 00:38:36 +01:00
074831833f
fix: add no_log to credential-handling pre_tasks and post_tasks in main.yml
2026-02-21 00:38:32 +01:00
d1a5217e88
fix(virtualization): add no_log and secure temp file handling to libvirt cloud-init
2026-02-21 00:38:28 +01:00
07492b5b57
refactor(cleanup): add configurable verify_boot, boot_timeout, and remove_on_failure defaults
2026-02-20 23:02:24 +01:00
14913bcd3d
refactor: move playbook-root templates into their respective roles
2026-02-20 23:01:38 +01:00
041650c287
refactor: add loop_control labels to dict-based loops across all roles
2026-02-20 23:00:53 +01:00
a63ffbc731
refactor(partitioning): move btrfs home quota to configurable default
2026-02-20 22:55:37 +01:00
9d2f1cc5bd
fix(environment): detect RHEL ISO device dynamically instead of hardcoded /dev/sr paths
2026-02-20 22:54:42 +01:00
f72f9feb9a
refactor(global_defaults): split system.yml into composable normalization stages
2026-02-20 22:54:05 +01:00
417737f904
refactor(global_defaults): extract OS family lists to single source of truth
2026-02-20 22:52:55 +01:00
a06c2ebdcf
fix(partitioning): add failed_when to all blkid commands to catch empty UUIDs
2026-02-20 22:52:18 +01:00
e174ecda42
fix(partitioning): add default fallbacks for is_rhel, os, os_version in defaults
2026-02-20 22:51:37 +01:00
5246a905bb
fix(virtualization): use hostname variable instead of hardcoded archiso in cloud-user-data
2026-02-20 22:51:32 +01:00
d00d84b69c
fix(virtualization): avoid no-handler lint finding in xen VM created tracking
2026-02-20 22:29:03 +01:00
4dafa8c596
fix(partitioning): fix line length violation in home size calculation
2026-02-20 22:28:58 +01:00
53584b8730
fix(configuration): add pipefail to root password shell pipe
2026-02-20 22:28:54 +01:00
ce40468b77
fix(bootstrap): use release map for ubuntu version detection
2026-02-20 22:27:46 +01:00
4b4fab3c33
chore: add .yamllint matching main project conventions
2026-02-20 22:27:31 +01:00
db2fab5e7d
fix(configuration): use chpasswd for root password and separate shell setting
2026-02-20 22:27:17 +01:00
42be0a5919
fix(configuration): add explicit LUKS auto-decrypt fallback state tracking and logging
2026-02-20 22:26:47 +01:00
17400fa6ff
refactor(partitioning): externalize hardcoded LVM and disk sizing constants to defaults
2026-02-20 22:26:23 +01:00
deb14d2c94
fix(virtualization): add xen VM existence check and improve changed_when
2026-02-20 22:25:10 +01:00
65c5b1029b
fix(cis): add pipefail to sshd version detection and define binary defaults
2026-02-20 22:24:14 +01:00
a1fbb7c21d
feat(cleanup): gate RHEL ISO disk and fstab handling on rhel_repo.source
2026-02-20 21:51:20 +01:00
d076ac8fef
feat(global_defaults): add system.features.rhel_repo option (iso|satellite|none)
2026-02-20 21:51:16 +01:00
c82e4afc4d
fix(encryption): add warning before silent TPM2-to-keyfile fallback
2026-02-20 21:51:12 +01:00
ac72fdc4a6
fix(partitioning): correct wipefs changed_when to report actual disk modification
2026-02-20 21:51:09 +01:00
b2e050c467
fix(validation): require password for primary user in system.users[0]
2026-02-20 21:51:06 +01:00
914d7dd9d1
fix(system_check): move no_log from block to individual API tasks
2026-02-20 21:51:02 +01:00
21bf8f79e2
fix(cis): make mlkem768x25519-sha256 KexAlgorithm conditional on OpenSSH 9.9+
2026-02-20 21:50:58 +01:00
38feff4369
fix(cis): use is_rhel for journald config path instead of fedora-only check
2026-02-20 21:50:55 +01:00
404529e8a4
refactor(configuration): add conditional dispatch to task includes
2026-02-20 21:16:52 +01:00
3db18858c3
refactor(cis): move OS-specific binary resolution to vars/main.yml
2026-02-20 21:16:48 +01:00
72a9576abe
refactor(configuration): split network.yml into per-init-system dispatch files
2026-02-20 21:16:45 +01:00
462c2c7dfe
refactor(bootstrap): restructure conditional package lists to list concatenation
2026-02-20 21:16:40 +01:00
ef8bfeaf84
refactor(configuration): convert services.yml to list-based loop
2026-02-20 21:16:37 +01:00
ba6be037ac
refactor(virt): adopt module_defaults for hypervisor credentials
2026-02-20 21:16:33 +01:00
5ca1c7f570
refactor(cleanup): restructure dispatch to use hypervisor_type include
2026-02-20 21:16:28 +01:00
cd8e477534
refactor(partitioning): extract VG name to defaults variable
2026-02-20 21:16:25 +01:00
c439e9741e
fix(configuration): remove trailing blank line from extras.yml
2026-02-20 20:20:33 +01:00
0a5c70e49f
docs(environment): document RPM GPG policy relaxation
2026-02-20 20:19:57 +01:00
19f2c9efe2
chore(bootstrap): align ansible.cfg with main project settings
2026-02-20 20:19:46 +01:00
230c74fd9b
feat(system_check): add safety check for physical installs
2026-02-20 20:19:37 +01:00
a2c19e2e49
fix(cleanup): fix vmware CD-ROM omit fragility and add cross-role defaults
2026-02-20 20:19:25 +01:00
9f9a4b38b8
fix(virtualization): add XML safety attributes and switch xen to virtio
2026-02-20 20:18:49 +01:00
524356cf8d
fix(cis): remove deprecated sshd options and update hardening values
2026-02-20 20:17:52 +01:00
a2993212ca
fix(configuration): disambiguate BLS task names and clean up misc noise
2026-02-20 20:17:05 +01:00
fba2e5fc94
refactor(configuration): relocate login banner and fix blockinfile markers
2026-02-20 20:16:19 +01:00
cf68a93b45
fix(configuration): use short hostname and allow per-user shell
2026-02-20 20:15:49 +01:00
3000268a0e
fix(partitioning): mount extra disks by UUID instead of device path
2026-02-20 20:15:25 +01:00
196c5be67a
fix(partitioning): correct LVM swap sizing and harden UUID fallbacks
2026-02-20 20:15:00 +01:00
33bad193b4
fix(configuration): add trailing semicolons to NM keyfile DNS fields
2026-02-20 20:14:06 +01:00
d5277802f7
fix(bootstrap): add missing packages and remove duplicates
2026-02-20 20:13:53 +01:00
28e6cf50d1
fix(bootstrap): add devpts mount and use ephemeral state for RHEL DVD
2026-02-20 20:12:59 +01:00
42cb5071c2
fix(bootstrap): unify resolv.conf to live environment DNS symlink
2026-02-20 20:12:42 +01:00
23a798a63a
fix(global_defaults): add no_log to hypervisor tasks and expand validation
2026-02-20 20:11:37 +01:00
5dd84c6b39
fix: configurable OVMF/machine type, routes syntax, package lists, interface names
2026-02-20 18:47:12 +01:00
d0ae20911b
fix(cleanup): keep RHEL ISO ide1 attached as local repo
2026-02-20 18:41:40 +01:00
b6d06dd96d
fix: deep analysis audit — no_log, resolv.conf, service conflicts, lint
2026-02-20 18:34:59 +01:00
09b3ed44ba
fix(bootstrap): RHEL 9 bootstrap from Arch ISO compatibility
...
- Generate resolv.conf from inventory DNS settings instead of copying
host file (Arch ISO has systemd-resolved stub 127.0.0.53)
- Add XFS compat options for GRUB 2.06 and kernel 5.14 across LVM
volumes, /boot partition, and data disks
- Mount API filesystems (proc, sys, dev) into chroot for RPM scriptlets
- Bypass GPG Sequoia validation with _pkgverify_level none
- Tolerate grub2-common scriptlet warnings
- Handle libvirt VM destroy gracefully during cleanup
2026-02-20 16:58:59 +01:00
603abe63cb
refactor: make bootstrap host target configurable
2026-02-20 16:58:59 +01:00
1c0e6533ae
fix(ubuntu): add initramfs-tools to debootstrap base packages
2026-02-20 16:58:59 +01:00
00aa614cfd
fix(bootstrap): use explicit keyring for debootstrap and copy resolv.conf
2026-02-20 16:58:59 +01:00
4905d10bc0
fix(cloud-init): handle boolean sudo values in user-data template
2026-02-20 16:58:59 +01:00
b4e8ccb77f
fix: re-gather facts after reboot to detect target OS package manager
...
The live ISO (Arch) caches ansible_pkg_mgr=pacman. After rebooting
into the target OS (e.g. Debian), package module fails because pacman
is not available. Re-gather minimal facts including pkg_mgr.
2026-02-20 16:58:59 +01:00
2a82ee4d5c
fix: resolve Jinja2 .keys ambiguity, fastfetch availability, and python interpreter
...
- Use bracket notation item['keys'] instead of item.keys to avoid
conflict with Python dict .keys() method
- Remove fastfetch from Debian 12 package list (only available in 13+)
- Set explicit python interpreter path for post-reboot tasks
2026-02-20 16:58:58 +01:00
7b213e7456
fix(partitioning): create separate /boot for LVM-based filesystems
...
VMware EFI firmware may not initialize all SCSI devices before GRUB
runs, preventing LVM assembly when the root LV spans multiple disks.
A separate /boot partition (the standard RHEL Anaconda layout) lets
GRUB load kernels without LVM; the kernel initramfs handles LVM
activation with proper device waiting.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-20 04:50:32 +01:00
cfc261878a
fix(bootloader): run efibootmgr on host for universal chroot compatibility
...
The previous approach ran efibootmgr inside the chroot, which only works
with arch-chroot (auto-mounts efivars) but fails silently with
systemd-nspawn or plain chroot. Move EFI boot entry creation to the host
where efivars is always available.
Also fixes wrong EFI loader path (\efi\EFI\... -> \EFI\...) and uses
the correct vendor label (e.g. "redhat" instead of raw os variable).
For non-RHEL distros, grub-install now uses --no-nvram to avoid
redundant NVRAM writes; the host efibootmgr handles entry creation
for all distros uniformly with idempotent pre-check.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-20 03:36:20 +01:00
