chore(bootstrap): update ubuntu non-lts codename to questing (25.10)

roles/bootstrap/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
-- name: Normalize bootstrap
-  ansible.builtin.import_tasks: _normalize.yml
+- name: Validate bootstrap input
+  ansible.builtin.import_tasks: _validate.yml
 
 - name: Create API filesystem mountpoints in installroot
   when: os_family == 'RedHat'

roles/bootstrap/tasks/ubuntu.yml

@@ -3,7 +3,7 @@
   vars:
     # ubuntu = latest non-LTS, ubuntu-lts = latest LTS
     bootstrap_ubuntu_release_map:
-      ubuntu: plucky
+      ubuntu: questing
       ubuntu-lts: noble
     bootstrap_ubuntu_release: "{{ bootstrap_ubuntu_release_map[os] | default('noble') }}"
     _config: "{{ lookup('vars', bootstrap_var_key) }}"

roles/cleanup/defaults/main.yml

@@ -3,13 +3,3 @@
 cleanup_verify_boot: true
 cleanup_boot_timeout: 300
 cleanup_remove_on_failure: true
-
-# Libvirt paths
-cleanup_libvirt_image_dir: >-
-  {{
-    system_cfg.path
-    if system_cfg is defined and (system_cfg.path | string | length) > 0
-    else '/var/lib/libvirt/images'
-  }}
-cleanup_libvirt_cloudinit_path: >-
-  {{ [cleanup_libvirt_image_dir, hostname ~ '-cloudinit.iso'] | ansible.builtin.path_join }}

roles/cleanup/tasks/libvirt.yml

@@ -85,7 +85,7 @@
 
     - name: Remove cloud-init disk
       ansible.builtin.file:
-        path: "{{ cleanup_libvirt_cloudinit_path }}"
+        path: "{{ virtualization_libvirt_cloudinit_path }}"
         state: absent
 
     - name: Ensure VM is powered off before restart

roles/configuration/tasks/main.yml

@@ -1,6 +1,6 @@
 ---
-- name: Normalize configuration
-  ansible.builtin.import_tasks: _normalize.yml
+- name: Resolve platform configuration
+  ansible.builtin.import_tasks: _resolve_platform.yml
 
 - name: Include configuration tasks
   when: configuration_task.when | default(true)

roles/configuration/tasks/users.yml

@@ -11,7 +11,7 @@
 
 - name: Set root shell
   ansible.builtin.command: >-
-    {{ chroot_command }} /usr/sbin/usermod --shell {{ system_cfg.root.shell | default('/bin/bash') }} root
+    {{ chroot_command }} /usr/sbin/usermod --shell {{ system_cfg.root.shell }} root
   register: configuration_root_shell_result
   changed_when: configuration_root_shell_result.rc == 0
 

roles/global_defaults/defaults/main.yml

@@ -87,6 +87,7 @@ system_defaults:
   users: []
   root:
     password: ""
+    shell: "/bin/bash"
   luks:
     enabled: false
     passphrase: ""

roles/global_defaults/tasks/_normalize_system.yml

@@ -84,6 +84,7 @@
       users: "{{ system_raw.users | default([]) }}"
       root:
         password: "{{ system_raw.root.password | string }}"
+        shell: "{{ system_raw.root.shell | default('/bin/bash') | string }}"
       # --- LUKS disk encryption ---
       luks:
         enabled: "{{ system_raw.luks.enabled | bool }}"

roles/global_defaults/tasks/validation.yml

@@ -123,7 +123,7 @@
         or (
           os == "debian" and (os_version | string) in ["10", "11", "12", "13", "unstable"]
         ) or (
-          os == "fedora" and (os_version | int) >= 38 and (os_version | int) <= 45
+          os == "fedora" and (os_version | int) >= 38 and (os_version | int) <= 43
         ) or (
           os in ["rocky", "almalinux"]
           and (os_version | string) is match("^(8|9|10)(\\.\\d+)?$")
@@ -206,6 +206,7 @@
       - system_cfg.features.firewall.toolkit is defined
       - system_cfg.features.firewall.toolkit in ["iptables", "nftables"]
       - system_cfg.features.firewall.enabled is defined
+      - system_cfg.features.ssh.enabled is defined
       - system_cfg.features.banner.motd is defined
       - system_cfg.features.banner.sudo is defined
       - system_cfg.luks.enabled is defined

roles/partitioning/tasks/_create_filesystems.yml

@@ -77,7 +77,7 @@
     - name: Get UUID for LVM home filesystem
       when:
         - system_cfg.filesystem != 'btrfs'
-        - system_cfg.features.cis.enabled
+        - system_cfg.features.cis.enabled | bool
       ansible.builtin.command: blkid -s UUID -o value /dev/{{ partitioning_vg_name }}/home
       register: partitioning_uuid_home_result
       changed_when: false
@@ -86,7 +86,7 @@
     - name: Get UUID for LVM var filesystem
       when:
         - system_cfg.filesystem != 'btrfs'
-        - system_cfg.features.cis.enabled
+        - system_cfg.features.cis.enabled | bool
       ansible.builtin.command: blkid -s UUID -o value /dev/{{ partitioning_vg_name }}/var
       register: partitioning_uuid_var_result
       changed_when: false
@@ -95,7 +95,7 @@
     - name: Get UUID for LVM var_log filesystem
       when:
         - system_cfg.filesystem != 'btrfs'
-        - system_cfg.features.cis.enabled
+        - system_cfg.features.cis.enabled | bool
       ansible.builtin.command: blkid -s UUID -o value /dev/{{ partitioning_vg_name }}/var_log
       register: partitioning_uuid_var_log_result
       changed_when: false
@@ -104,7 +104,7 @@
     - name: Get UUID for LVM var_log_audit filesystem
       when:
         - system_cfg.filesystem != 'btrfs'
-        - system_cfg.features.cis.enabled
+        - system_cfg.features.cis.enabled | bool
       ansible.builtin.command: blkid -s UUID -o value /dev/{{ partitioning_vg_name }}/var_log_audit
       register: partitioning_uuid_var_log_audit_result
       changed_when: false
@@ -123,24 +123,24 @@
         partitioning_uuid_home: >-
           {{
             partitioning_uuid_home_result.stdout_lines | default([])
-            if system_cfg.features.cis.enabled
+            if system_cfg.features.cis.enabled | bool
             else []
           }}
         partitioning_uuid_var: >-
           {{
             partitioning_uuid_var_result.stdout_lines | default([])
-            if system_cfg.features.cis.enabled
+            if system_cfg.features.cis.enabled | bool
             else []
           }}
         partitioning_uuid_var_log: >-
           {{
             partitioning_uuid_var_log_result.stdout_lines | default([])
-            if system_cfg.features.cis.enabled
+            if system_cfg.features.cis.enabled | bool
             else []
           }}
         partitioning_uuid_var_log_audit: >-
           {{
             partitioning_uuid_var_log_audit_result.stdout_lines | default([])
-            if system_cfg.features.cis.enabled
+            if system_cfg.features.cis.enabled | bool
             else []
           }}

roles/partitioning/tasks/_create_lvm.yml

@@ -29,7 +29,7 @@
 
     - name: Create LVM logical volumes
       when:
-        - system_cfg.features.cis.enabled or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
+        - system_cfg.features.cis.enabled | bool or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
         - system_cfg.features.swap.enabled | bool or item.lv != 'swap'
       vars:
         partitioning_lvm_extent_reserve_count: 10
@@ -84,7 +84,7 @@
                 (
                   (partitioning_disk_size_gb | float)
                   - (partitioning_reserved_gb | float)
-                  - (system_cfg.features.cis.enabled | ternary(partitioning_cis_reserved_gb | float, 0))
+                  - (system_cfg.features.cis.enabled | bool | ternary(partitioning_cis_reserved_gb | float, 0))
                   - partitioning_lvm_extent_reserve_gb
                   - 4
                 ),
@@ -99,7 +99,7 @@
             (
               (partitioning_disk_size_gb | float)
               - (partitioning_reserved_gb | float)
-              - (system_cfg.features.cis.enabled | ternary(partitioning_cis_reserved_gb | float, 0))
+              - (system_cfg.features.cis.enabled | bool | ternary(partitioning_cis_reserved_gb | float, 0))
               - partitioning_lvm_extent_reserve_gb
               - partitioning_lvm_swap_target_limited_gb
             ) | float
@@ -160,7 +160,7 @@
                     + (partitioning_lvm_var_gb | float)
                     + (partitioning_lvm_var_log_gb | float)
                     + (partitioning_lvm_var_log_audit_gb | float)
-                    if system_cfg.features.cis.enabled
+                    if system_cfg.features.cis.enabled | bool
                     else 0
                   )
               ),

roles/partitioning/tasks/_mount.yml

@@ -7,8 +7,8 @@
     - name: Mount filesystems and subvolumes
       when:
         - >-
-          system_cfg.features.cis.enabled or (
-            not system_cfg.features.cis.enabled and (
+          system_cfg.features.cis.enabled | bool or (
+            not (system_cfg.features.cis.enabled | bool) and (
               (system_cfg.filesystem == 'btrfs' and item.path in ['/home', '/var/log', '/var/cache/pacman/pkg'])
               or (item.path not in ['/home', '/var', '/var/log', '/var/log/audit', '/var/cache/pacman/pkg'])
             )

roles/partitioning/tasks/btrfs.yml

@@ -41,7 +41,7 @@
 
     - name: Make root subvolumes
       when:
-        - system_cfg.features.cis.enabled or item.subvol not in ['var_log_audit']
+        - system_cfg.features.cis.enabled | bool or item.subvol not in ['var_log_audit']
         - system_cfg.features.swap.enabled | bool or item.subvol != 'swap'
       ansible.builtin.command: btrfs su cr /mnt/{{ '@' if item.subvol == 'root' else '@' + item.subvol }}
       args:
@@ -59,7 +59,7 @@
       register: partitioning_btrfs_subvol_result
 
     - name: Set quotas for subvolumes
-      when: system_cfg.features.cis.enabled
+      when: system_cfg.features.cis.enabled | bool
       ansible.builtin.command: btrfs qgroup limit {{ item.quota }} /mnt/{{ '@' if item.subvol == 'root' else '@' + item.subvol }}
       loop:
         - { subvol: home, quota: "{{ partitioning_btrfs_home_quota }}" }

roles/partitioning/tasks/ext4.yml

@@ -1,6 +1,6 @@
 ---
 - name: Create and format ext4 logical volumes
-  when: system_cfg.features.cis.enabled or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
+  when: system_cfg.features.cis.enabled | bool or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
   community.general.filesystem:
     dev: /dev/{{ partitioning_vg_name }}/{{ item.lv }}
     fstype: ext4
@@ -17,7 +17,7 @@
 - name: Remove Unsupported features for older Systems
   when: >
     (os in ['almalinux', 'rocky', 'rhel'] or (os == 'debian' and (os_version | string) == '11'))
-    and (system_cfg.features.cis.enabled or item.lv not in ['home', 'var', 'var_log', 'var_log_audit'])
+    and (system_cfg.features.cis.enabled | bool or item.lv not in ['home', 'var', 'var_log', 'var_log_audit'])
   ansible.builtin.command: tune2fs -O "^orphan_file,^metadata_csum_seed" "/dev/{{ partitioning_vg_name }}/{{ item.lv }}"
   loop:
     - { lv: root }

roles/partitioning/tasks/xfs.yml

@@ -1,6 +1,6 @@
 ---
 - name: Create and format XFS logical volumes
-  when: system_cfg.features.cis.enabled or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
+  when: system_cfg.features.cis.enabled | bool or item.lv not in ['home', 'var', 'var_log', 'var_log_audit']
   community.general.filesystem:
     dev: /dev/{{ partitioning_vg_name }}/{{ item.lv }}
     fstype: xfs