Compare commits

..

86 Commits

Author SHA1 Message Date
43755a6016 fix(partitioning): resolve vmware disks by scsi target instead of the sdX letter 2026-09-15 20:19:53 +02:00
a795535305 fix(configuration): disable selinux with selinux=0 on el9 when the feature is off 2026-08-31 13:45:06 +02:00
a9a9706f2c fix(configuration): disable the preset-enabled firewall daemon when the feature is off 2026-08-31 13:40:41 +02:00
f5bb5e92be fix(system_check): retry transient vcenter api errors in the preflight lookups 2026-08-31 13:11:16 +02:00
22e66959ee fix(global_defaults): normalize disks when install_drive is supplied externally 2026-08-24 18:38:48 +02:00
332dfeb6f1 fix(configuration): put new EFI boot entry first and install removable fallback 2026-07-31 20:33:54 +02:00
19029bdc8b fix(bootstrap): map Intel firmware to linux-firmware-intel so iwlwifi loads 2026-07-31 20:33:54 +02:00
9c4a86c0ec style(cleanup): drop redundant comments from the power-off tasks 2026-07-15 00:09:44 +02:00
723f0516da fix(cleanup): wait for the guest shutdown before forcing the VM off 2026-07-15 00:05:38 +02:00
975384661e docs(content): correct the family default to rhel=dvd, not EL=dvd 2026-07-14 21:14:41 +02:00
ad25bec9fd fix(cleanup): force-stop the vmware VM before booting the installed OS 2026-07-14 06:48:25 +02:00
6240217318 feat(system_check): preflight boot media and datastore placement 2026-07-14 01:48:26 +02:00
1c00ec9370 fix(configuration): grant the platform sudo group only when sudo is set 2026-07-14 01:48:26 +02:00
371d5a0acd fix(configuration): deploy sudoers rules for bool-or-string sudo values 2026-07-14 01:48:26 +02:00
41ccf2a5b9 fix(configuration): allow guest-exec RPCs for EL golden cloning 2026-05-29 22:43:14 +02:00
8f9cfe3b2f fix(cleanup): force-stop then start the proxmox VM after install 2026-05-29 22:40:02 +02:00
6a75237197 fix(environment): pick the largest cdrom as the RHEL install DVD 2026-05-28 17:52:44 +02:00
b04aad12fb fix(satellite): drop auto-attach (mutually exclusive with activation key) 2026-05-26 01:08:09 +02:00
4fff9f8d80 fix(virtualization): create vmware target folder before vm deploy 2026-06-04 18:17:50 +02:00
7f12a0f3d8 feat: accept proxmox API-token auth alongside password 2026-05-31 12:40:31 +02:00
ceb2237bbb fix(encryption): add tpm2-tss dracut module explicitly for TPM2 LUKS 2026-05-31 12:39:24 +02:00
477c8379c4 fix(configuration): enable per-family time-sync and skip sudo-rs lecture 2026-05-31 12:30:26 +02:00
579c499c02 feat(configuration): multi-backend networking, bind by match not MAC 2026-05-31 12:25:53 +02:00
89e366d0f0 fix: EL10 PAM and crypto readiness via authselect profile and DEFAULT policy 2026-05-28 17:30:57 +02:00
6fe843355e fix(bootstrap): keep package cache off the 2 GiB CIS /var during install 2026-05-28 17:26:25 +02:00
441876fab9 refactor(global_defaults): single source of truth for family-default resolution 2026-05-28 17:25:23 +02:00
00acd4d200 refactor(configuration): consolidate firewall into one phase-aware path 2026-05-27 05:28:00 +02:00
d922efd2e4 feat: uniform system.content source schema across installers and repositories 2026-05-27 05:15:32 +02:00
939c5c741f feat: golden-image build support (cloud-init on EL, selinux relabel, SSH wait) 2026-05-27 05:05:55 +02:00
2c35409519 feat(cis): add selectable profile and per-rule hardening toggles 2026-05-25 04:37:33 +02:00
d2a19cfd5c feat(hardware): auto-detect audio, bluetooth, camera with declarative override 2026-05-25 04:36:21 +02:00
44f5adc682 feat(bootstrap): per-os desktop apps, KDE plasma-login-manager and DM resolution 2026-05-25 04:30:53 +02:00
0185797af9 fix(environment): co-upgrade soname closure when installing installer tools 2026-05-25 03:54:12 +02:00
e0ecf628cd fix(bootstrap): deploy all non-EOL core distros (keyrings, repos, versions) 2026-05-25 03:52:44 +02:00
37df881daa docs: refresh bootstrap examples and README 2026-05-30 18:05:14 +02:00
55b21eae5d fix: encryption, partitioning, cis and virtualization hardening 2026-05-30 18:05:14 +02:00
b1e938b7f0 fix(users): accept plaintext or pre-hashed passwords uniformly 2026-05-30 18:05:05 +02:00
c843f5289b feat: hardware/firmware/gpu/peripherals detection and packages 2026-05-30 18:05:05 +02:00
9757ed3785 feat: complete wayland desktop deployment (gnome/kde/sway/hyprland) 2026-05-30 18:05:05 +02:00
876e90ce2b refactor: trim bootstrap OS support to core three distro families 2026-05-30 18:04:00 +02:00
7c44cb1ff0 docs(bootstrap): fix users dict format in examples, sync schema defaults, document secure_boot/rhel_repo 2026-05-30 09:25:34 +02:00
5d0630a386 refactor(global_defaults): drop orphan luks.urandom/verify and aur feature, bump fedora to 45 2026-05-30 09:25:34 +02:00
3eaf918a53 fix(lint): convert sshd restart to handler, add pipefail to btrfs subvol set 2026-05-30 09:25:34 +02:00
382e82ff85 fix(configuration): tolerate missing units, gate Secure Boot to supported OSes, fix clevis install per family 2026-05-30 09:25:34 +02:00
db7dc53bd7 docs(bootstrap): document firmware/gpu/peripherals/hardware features 2026-05-30 09:25:34 +02:00
7d45f25a7e feat(bootstrap): install vendor-matched hardware packages 2026-05-30 09:25:34 +02:00
3880b8f41e feat(environment): detect cpu/gpu/wireless/fingerprint hardware 2026-05-30 09:25:34 +02:00
dc3c4a901f feat(global_defaults): firmware/gpu/peripherals/hardware schema 2026-05-30 09:25:34 +02:00
6bfaa0aa2b fix(configuration): guard user keys access to avoid dict.keys() method collision 2026-04-16 15:37:13 +02:00
5dc0424acb feat(cleanup): enroll Secure Boot keys in VM NVRAM after OS installation 2026-04-16 15:37:13 +02:00
c12332a853 feat(virtualization): enable TPM2 emulation for Secure Boot VMs 2026-04-16 15:37:13 +02:00
5ace4577a2 feat(configuration): auto-bind PCR 7 when Secure Boot and FDE are both enabled 2026-04-16 15:37:13 +02:00
c0ff01ef40 feat(configuration): add Secure Boot tasks for shim and sbctl 2026-04-16 15:37:13 +02:00
57417514e3 feat(configuration): override EFI loader to shim when Secure Boot enabled 2026-04-02 04:34:47 +02:00
0928588c1f feat(bootstrap): add Secure Boot conditional packages for Debian, Ubuntu, and Arch 2026-04-02 04:34:16 +02:00
6d622f2db4 feat(global_defaults): add secure_boot feature toggle with normalization 2026-04-02 04:33:07 +02:00
b11d65a6f3 docs(bootstrap): document desktop, initramfs, and FDE features with SSH keepalive config 2026-04-01 15:07:58 +02:00
3623fc292c feat(configuration): generic FDE with systemd-cryptenroll, clevis fallback, and configurable initramfs 2026-04-01 15:07:58 +02:00
dfca7ec94b fix(configuration): RedHat EFI grub wrapper with btrfs subvol prefix and boot order 2026-04-01 15:07:58 +02:00
e8be84bf49 fix(partitioning): set btrfs default subvolume and restrict @pkg to Arch 2026-04-01 15:07:58 +02:00
322cc0b1ce fix(bootstrap): resolve interface-only network, sshd penalties, dnf scriptlets, and EFI cleanup 2026-04-01 15:07:58 +02:00
4b38754f8b feat(bootstrap): add desktop environment support with configurable DE, DM, and display target 2026-04-01 15:07:58 +02:00
a6bc7ffe04 fix(configuration): use /boot/grub2/grub.cfg for RedHat EFI grub config 2026-03-25 16:03:39 +01:00
c529e71ebc feat(packages): add needrestart to Debian and Ubuntu package lists 2026-03-20 18:06:14 +01:00
cb46de2b6d feat(bootstrap): add full package upgrade step for Debian and Ubuntu 2026-03-20 18:05:04 +01:00
9169117b25 fix(vim): use vimscript comment syntax for blockinfile markers in vimrc 2026-03-20 18:00:12 +01:00
6c94c519fb fix(sudo): use explicit string check instead of bool conditional for sudo field 2026-03-20 17:31:49 +01:00
efd96a42b8 fix(connection): set ansible_port explicitly at every connection transition 2026-03-20 17:31:49 +01:00
68661c3cca fix(vmware): use primary ansible_* vars for vmware_tools connection plugin precedence 2026-03-20 17:31:49 +01:00
1db20c7ac0 fix(vmware): use empty password for vmware_tools during live ISO bootstrap 2026-03-20 17:31:49 +01:00
7b155b427b fix(users): update cloud-init template and input validation for dict users 2026-03-20 17:31:49 +01:00
ca8721e98f refactor(prompts): remove vars_prompt, require users defined in inventory 2026-03-20 17:31:49 +01:00
cdb2559d8f fix(prompts): add default values to vars_prompt to skip in non-interactive mode 2026-03-20 17:31:49 +01:00
443f6623df refactor(users): change system.users from list to dict keyed by username 2026-03-20 17:31:49 +01:00
6cf418fe00 fix(configuration): make root password, user keys, and sudo all optional 2026-03-20 17:31:49 +01:00
47ec5fe621 fix(cloud-init): handle missing keys and make sudo conditional 2026-03-20 17:31:49 +01:00
240f945cce fix(cleanup): remove ansible_become override that blocks swapoff/umount 2026-03-20 17:31:49 +01:00
663a04556f feat(global_defaults): add system.features.aur schema for validation passthrough 2026-03-20 17:31:49 +01:00
6febd1acf1 refactor(virtualization): extract shared Xen disk definitions 2026-03-12 12:27:18 +01:00
008187860c refactor: remove unnecessary changed_when from set_fact tasks 2026-03-12 12:25:45 +01:00
cd1be6b5e1 refactor(partitioning): remove redundant blockdev --rereadpt calls 2026-03-12 12:25:15 +01:00
15be6149fd refactor(partitioning): remove unused register variables 2026-03-12 12:24:59 +01:00
ca29ad200d chore: suppress args[module] false positives from variable-based module_defaults 2026-03-12 12:12:27 +01:00
8079099cee fix(cleanup): add no_log to Proxmox VM restart task 2026-03-12 12:12:27 +01:00
9e79185b07 fix(virtualization): add missing changed_when to Xen VM stop task 2026-03-12 12:12:27 +01:00
b88bf2860f fix(configuration): replace fail+ignore_errors with debug for TPM2 fallback warning 2026-03-12 12:12:27 +01:00
3 changed files with 7 additions and 9 deletions

View File

@@ -206,7 +206,6 @@ bootstrap_debian:
- openssh-server - openssh-server
- python3 - python3
- xfsprogs - xfsprogs
- xz-utils
extra: extra:
- bat - bat
- curl - curl
@@ -259,7 +258,6 @@ bootstrap_ubuntu:
- openssh-server - openssh-server
- python3 - python3
- xfsprogs - xfsprogs
- xz-utils
extra: extra:
- bash-completion - bash-completion
- bat - bat

View File

@@ -35,12 +35,10 @@
}, recursive=True) }, recursive=True)
}} }}
# Keyed on os, not hostname: inventories set hostname themselves, and doing so
# would otherwise skip enrichment and leave os undefined for validation.
- name: Check if pre-computed system_cfg needs enrichment - name: Check if pre-computed system_cfg needs enrichment
when: system_cfg is defined when: system_cfg is defined
ansible.builtin.set_fact: ansible.builtin.set_fact:
_bootstrap_needs_enrichment: "{{ os is not defined }}" _bootstrap_needs_enrichment: "{{ hostname is not defined }}"
- name: Merge pre-computed system_cfg with bootstrap system_defaults - name: Merge pre-computed system_cfg with bootstrap system_defaults
when: when:

View File

@@ -317,7 +317,7 @@
_autologin: "{{ system_cfg.features.desktop.autologin | default(false) }}" _autologin: "{{ system_cfg.features.desktop.autologin | default(false) }}"
ansible.builtin.assert: ansible.builtin.assert:
that: that:
- _autologin is boolean and not _autologin or (_autologin is string and _autologin | length > 0 and _autologin in system_cfg.users | map(attribute='name')) - _autologin is boolean and not _autologin or (_autologin is string and _autologin | length > 0 and _autologin in system_cfg.users)
fail_msg: >- fail_msg: >-
desktop.autologin must be false or a username string present in desktop.autologin must be false or a username string present in
system.users; got '{{ _autologin }}'. Bool true is not accepted - the system.users; got '{{ _autologin }}'. Bool true is not accepted - the
@@ -355,12 +355,14 @@
- name: Validate at least one user with a password is defined - name: Validate at least one user with a password is defined
vars: vars:
_pw_users: "{{ system_cfg.users | selectattr('password', 'defined') | map(attribute='password') | map('string') | reject('equalto', '') | list }}" _pw_users: "{{ system_cfg.users | dict2items | selectattr('value.password', 'defined') | list }}"
ansible.builtin.assert: ansible.builtin.assert:
that: that:
- system_cfg.users | default([]) | length > 0 - system_cfg.users | default({}) | length > 0
- _pw_users | length > 0 - _pw_users | length > 0
fail_msg: "At least one user with a non-empty password must be defined in system.users." - _pw_users[0].key | string | length > 0
- _pw_users[0].value.password | string | length > 0
fail_msg: "At least one user with a password must be defined in system.users."
quiet: true quiet: true
no_log: true no_log: true