deploy hermes

fix typo
additional service name changes
2026-05-25 20:21:24 -05:00 · 2026-05-24 21:15:08 -05:00 · 2026-05-24 21:12:10 -05:00 · 2026-05-24 19:46:19 -05:00 · 2026-05-24 19:43:13 -05:00 · 2026-05-24 18:35:52 -05:00
416 changed files with 43791 additions and 1597 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,15 +1,9 @@
-# macOS system files
+# macOS
 .DS_Store
 .AppleDouble
 .LSOverride
 # Icon must end with two \r
 Icon
 # Thumbnails
 ._*
 # Files that might appear in the root of a volume
 .DocumentRevisions-V100
 .fseventsd
 .Spotlight-V100
@@ -17,32 +11,53 @@ Icon
 .Trashes
 .VolumeIcon.icns
 .com.apple.timemachine.donotpresent
 # Directories potentially created on remote AFP share
 .AppleDB
 .AppleDesktop
 Network Trash Folder
 Temporary Items
 .apdisk
 # VS Code
 .vscode/
 # macOS metadata
 *.icloud
-# Terraform
+# IDE
 .vscode/
 .idea/
 .kiro/
 # Terraform (track .tf files, ignore state and runtime)
 .terraform/
 *.tfstate
 *.tfstate.backup
-
+# *.tfvars
-# Crash log files
+!*.tfvars.example
 !*.pkrvars.hcl
 crash.log
 # Ignore override files as they are usually used to override resources locally
 *.override.tf
 *.override.tf.json
 # Ignore CLI configuration files
 .terraformrc
-.terraformrc.json
+terraform.rc
 # Ansible
 *.retry
 ansible/vault/*.vault
 # Packer
 packer_cache/
 # Secrets
 *.pem
 *.key
 # Environment files with secrets
 boilerplates/**/.env
 # Local paths
 ~/
 # Misc
 doppler-token.yaml
 # talhelper generated machine configs — contain secrets, never commit
 talos/talhelper/clusterconfig/
 # talenv.yaml plaintext — only commit the SOPS-encrypted version
 talos/talhelper/talenv.yaml
 !talos/talhelper/talenv.sops.yaml
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -0,0 +1,3 @@
 creation_rules:
  - path_regex: talos/talhelper/talenv.yaml
    age: age1xkyuv8r8ce6lu3d64jfspz4e50k6pxlaxwmuplzrtnpfnnrnycaq6mfsrn
--- a/00-core-infra/ansible/README.md
+++ b/00-core-infra/ansible/README.md
@@ -1,43 +0,0 @@
 # README
 inventory                # inventory file for all servers
 group_vars/
   group1.yml             # here we assign variables to particular groups
   group2.yml
 host_vars/
   hostname1.yml          # here we assign variables to particular systems
   hostname2.yml
 library/                  # if any custom modules, put them here (optional)
 module_utils/             # if any custom module_utils to support modules, put them here (optional)
 filter_plugins/           # if any custom filter plugins, put them here (optional)
 site.yml                  # master playbook
 webservers.yml            # playbook for webserver tier
 dbservers.yml             # playbook for dbserver tier
 roles/
    common/               # this hierarchy represents a "role"
        tasks/            #
            main.yml      #  <-- tasks file can include smaller files if warranted
        handlers/         #
            main.yml      #  <-- handlers file
        templates/        #  <-- files for use with the template resource
            ntp.conf.j2   #  <------- templates end in .j2
        files/            #
            bar.txt       #  <-- files for use with the copy resource
            foo.sh        #  <-- script files for use with the script resource
        vars/             #
            main.yml      #  <-- variables associated with this role
        defaults/         #
            main.yml      #  <-- default lower priority variables for this role
        meta/             #
            main.yml      #  <-- role dependencies
        library/          # roles can also include custom modules
        module_utils/     # roles can also include custom module_utils
        lookup_plugins/   # or other types of plugins, like lookup in this case
    webtier/              # same kind of structure as "common" was above, done for the webtier role
    monitoring/           # ""
    fooapp/               # ""
--- a/00-core-infra/ansible/ansible-ssh-key.yml
+++ b/00-core-infra/ansible/ansible-ssh-key.yml
@@ -1,13 +0,0 @@
 - name: "Add SSH key to servers for Ansible"
  hosts: ipaserver
  vars_files:
  - ansible-vault.yml
  roles:
  - role: rywillia.ssh-copy-id 
    vars:
      hostname: "{{ ansible_hostname }}"
      username: "{{ vault_ansible_user }}"
      password: "{{ vault_ansible_password }}"
      ssh_public_key: "/Users/rblundon/git/MK-Labs/ansible/files/ansible"
--- a/00-core-infra/ansible/ansible-vault.yml
+++ b/00-core-infra/ansible/ansible-vault.yml
@@ -1,8 +0,0 @@
 $ANSIBLE_VAULT;1.1;AES256
 37663530616632333938363737366639623261366264616231396533366432303034376365643633
 3632383464666637343765366439333964646637643936380a326335353639326362366263373466
 63646562353737636333653333373765363331323065386137626161633333643034323962316630
 6263373464613033360a376633663236333464393866373733643839336165363761373931623761
 37646139633036646435323361326366326134656630656366366434363335353165356431613731
 39653364653465613066323164663261363461316662623433663637333330306663633864303862
 643261393832643433326332366166383239
--- a/00-core-infra/ansible/ansible.cfg
+++ b/00-core-infra/ansible/ansible.cfg
@@ -1,19 +0,0 @@
 [defaults]
 # Chick-Fil-A would like a word...
 nocows = True
 # Installs collections into [current dir]/ansible_collections/namespace/collection_name
 collections_paths = ./collections:~/.ansible/collections
 # Installs roles into [current dir]/roles/namespace.rolename
 roles_path = ./roles
 inventory = ./inventory
 # default user to use for playbooks if user is not specified
 # (/usr/bin/ansible will use current user as default)
 remote_user = wed
 private_key_file = ~/.ssh/ansible
 allow_world_readable_tmpfiles = True
--- a/00-core-infra/ansible/collections/requirements.yml
+++ b/00-core-infra/ansible/collections/requirements.yml
@@ -1,5 +0,0 @@
 ---
 roles: []
 collections: []
 #  - name: community.docker
--- a/00-core-infra/ansible/debub.yml
+++ b/00-core-infra/ansible/debub.yml
@@ -1,23 +0,0 @@
 - name: "Playbook to test the inventory_hostname and ansible_hostname"
  hosts: ipaserver
  # gather_facts: true
  tasks:
    - name: "What is my inventory_hostname"
      ansible.builtin.debug:
        var: inventory_hostname
    - name: "What is my hostname"
      ansible.builtin.debug:
        var: hostname
    - name: "What is my ansible_hostname"
      ansible.builtin.debug:
        var: ansible_hostname
    - name: "What is my ansible_host"
      ansible.builtin.debug:
        var: ansible_host
 #    - name: "Ansible | List all known variables and facts"
 #      ansible.builtin.debug:
 #        var: hostvars[inventory_hostname]
--- a/00-core-infra/ansible/group_vars/ipaserver/main.yml
+++ b/00-core-infra/ansible/group_vars/ipaserver/main.yml
@@ -1,14 +0,0 @@
 ---
 ipaadmin_password: "{{ vault_ipaadmin_password }}"
 ipadm_password: "{{ vault_ipadm_password }}"
 ipaserver_domain: int.mk-labs.cloud
 ipaserver_realm: INT.MK-LABS.CLOUD
 ipaserver_setup_firewalld: true
 ipaserver_setup_dns: true
 ipaserver_forwarders: 1.1.1.1,1.0.0.1
 ipaserver_random_serial_numbers: true
 #dns_ip_addresses: "{{ ansible_hostname }}"
 #dns_reverse_zones:
 #domain: int.mk-labs.cloud
 forwarders: 1.1.1.1,1.0.0.1
 #hostname: "{{ hostname }}"
--- a/00-core-infra/ansible/group_vars/unbound_servers/main.yml
+++ b/00-core-infra/ansible/group_vars/unbound_servers/main.yml
@@ -1,5 +0,0 @@
 ---
 unbound_do_ip6: "no"
 #unbound_forward_zones:
 unbound_chroot: "/etc/unbound"
 #unbound_pidfile: "/etc/unbound/unbound.pid"
--- a/00-core-infra/ansible/host_vars/infra01/vars/main.yml
+++ b/00-core-infra/ansible/host_vars/infra01/vars/main.yml
@@ -1,2 +0,0 @@
 ---
 hostname: infra01.int.mk-labs.cloud
--- a/00-core-infra/ansible/host_vars/infra01/vault/main.yml
+++ b/00-core-infra/ansible/host_vars/infra01/vault/main.yml
@@ -1,6 +0,0 @@
 $ANSIBLE_VAULT;1.1;AES256
 36383531343863313331636462653666393131633533346433343237653433633938343737363531
 3330616336336635313037356130373231643531613237340a613663303764333837333438343433
 38373264316533613763373634343735323764316364376138613934323339653735303562636631
 6166393933356663660a393036653937386239396331653037376564663232666561306631306331
 6362
--- a/00-core-infra/ansible/host_vars/infra01/vault/vault.yml
+++ b/00-core-infra/ansible/host_vars/infra01/vault/vault.yml
@@ -1,9 +0,0 @@
 $ANSIBLE_VAULT;1.1;AES256
 36393261393537313432333136623438383339303162636464353239386433316134613537336263
 6462326336363562613431653435353032383064303166340a333761633530643265336465663634
 65633864653830653738333563326162326430666237303362336537306238356231393761376539
 3335336333316231620a633562633731396464393366323762323365383664326430323038646566
 34643339303863303734623038393336313264636439636663616462613465303232643337653539
 39386231373231306639343561613665626634383932393836616239643662376237353965316162
 64623934616533386664333732343230626130343630393235303863366536363033323335323337
 61356536323131383438
--- a/00-core-infra/ansible/host_vars/unbound/vars/main.yml
+++ b/00-core-infra/ansible/host_vars/unbound/vars/main.yml
@@ -1,2 +0,0 @@
 ---
 hostname: unbound.int.mk-labs.cloud
--- a/00-core-infra/ansible/host_vars/unbound01.yml
+++ b/00-core-infra/ansible/host_vars/unbound01.yml
@@ -1,2 +0,0 @@
 ---
 hostname: unbound01.int.mk-labs.cloud
--- a/00-core-infra/ansible/host_vars/unbound02.yml
+++ b/00-core-infra/ansible/host_vars/unbound02.yml
@@ -1,2 +0,0 @@
 ---
 hostname: unbound02.int.mk-labs.cloud
--- a/00-core-infra/ansible/idm-servers.yml
+++ b/00-core-infra/ansible/idm-servers.yml
@@ -1,10 +0,0 @@
 ---
 - name: Playbook to configure IPA server
  hosts: ipaserver
  become: true
  vars_files:
  - idm-vault.yml
  roles:
  - role: freeipa.ansible_freeipa.ipaserver
    state: present
--- a/00-core-infra/ansible/idm-vault.yml
+++ b/00-core-infra/ansible/idm-vault.yml
@@ -1,9 +0,0 @@
 $ANSIBLE_VAULT;1.1;AES256
 62613936343461366134333738386435646236386662663434373563663433393437383961336634
 6234303634383134623162396130623562353332313463620a373364393561633038383662643561
 37636232366532623364306638373064623433626364383639353137653139353764343466386463
 3237373565653262630a383633353438303934643064623464313639623963386661393562333738
 39316136633733386166663433633434653636333239323236306161653864353666653137653935
 34636236353635336631313432386362616462383763346162363466323432333064633336646439
 38656362306337393065366362653864363438313934333235616338653934626535363266633039
 38626466343338313239
--- a/00-core-infra/ansible/inventory
+++ b/00-core-infra/ansible/inventory
@@ -1,32 +0,0 @@
 ---
 proxmox:
  hosts:
    pve01:
      ansible_host: 10.10.21.51
    pve02:
      ansible_host: 10.10.21.52
    pve03:
      ansible_host: 10.10.21.53
 unbound_servers:
  hosts:
    unbound:
      ansible_host: 10.1.71.254
    unbound01:
      ansible_host: 10.1.71.254
    unbound02:
      ansible_host: 10.1.71.253
 ipaserver:
  hosts:
    infra01:
      ansible_host: 10.1.71.5
 ipareplicas:
  hosts:
 #    infra02.int.mk-labs.cloud:
 #      ansible_host: 10.1.71.6
 #infra:
 #  hosts:
 #    awx.int.mk-labs.cloud:
--- a/00-core-infra/ansible/roles/unbound/files/resolved_unbound.conf
+++ b/00-core-infra/ansible/roles/unbound/files/resolved_unbound.conf
@@ -1,4 +0,0 @@
 [Resolve]
 DNS=127.0.0.1
 DNSSEC=yes
 DNSStubListener=no
--- a/00-core-infra/ansible/roles/unbound/files/unbound.conf
+++ b/00-core-infra/ansible/roles/unbound/files/unbound.conf
@@ -1,236 +0,0 @@
 ## Authoritative, validating, recursive caching DNS
 ## unbound.conf -- https://calomel.org
 #
 server:
  # log verbosity
    verbosity: 1
    chroot: ""
  # specify the interfaces to answer queries from by ip-address.  The default
  # is to listen to localhost (127.0.0.1 and ::1).  specify 0.0.0.0 and ::0 to
  # bind to all available interfaces.  specify every interface[@port] on a new
  # 'interface:' labeled line.  The listen interfaces are not changed on
  # reload, only on restart.
    interface: 0.0.0.0
  # port to answer queries from
    port: 53
  # Enable IPv4, "yes" or "no".
    do-ip4: yes
  # Enable IPv6, "yes" or "no".
    do-ip6: no
  # Enable UDP, "yes" or "no".
    do-udp: yes
  # Enable TCP, "yes" or "no". If TCP is not needed, Unbound is actually
  # quicker to resolve as the functions related to TCP checks are not done.i
  # NOTE: you may need tcp enabled to get the DNSSEC results from *.edu domains
  # due to their size.
    do-tcp: yes
  # control which client ips are allowed to make (recursive) queries to this
  # server. Specify classless netblocks with /size and action.  By default
  # everything is refused, except for localhost.  Choose deny (drop message),
  # refuse (polite error reply), allow (recursive ok), allow_snoop (recursive
  # and nonrecursive ok)
    access-control: 192.168.1.0/24 allow
    access-control: 192.168.3.0/24 allow
    access-control: 192.168.10.0/24 allow
    access-control: 10.1.71.0/24 allow
  # Read  the  root  hints from this file. Default is nothing, using built in
  # hints for the IN class. The file has the format of  zone files,  with  root
  # nameserver  names  and  addresses  only. The default may become outdated,
  # when servers change,  therefore  it is good practice to use a root-hints
  # file.  get one from https://www.internic.net/domain/named.root 
    root-hints: "/etc/unbound/root.hints"
  # enable to not answer id.server and hostname.bind queries.
    hide-identity: yes
  # enable to not answer version.server and version.bind queries.
    hide-version: yes
  # Will trust glue only if it is within the servers authority.
  # Harden against out of zone rrsets, to avoid spoofing attempts. 
  # Hardening queries multiple name servers for the same data to make
  # spoofing significantly harder and does not mandate dnssec.
    harden-glue: yes
  # Require DNSSEC data for trust-anchored zones, if such data is absent, the
  # zone becomes  bogus.  Harden against receiving dnssec-stripped data. If you
  # turn it off, failing to validate dnskey data for a trustanchor will trigger
  # insecure mode for that zone (like without a trustanchor).  Default on,
  # which insists on dnssec data for trust-anchored zones.
    harden-dnssec-stripped: yes
  # Use 0x20-encoded random bits in the query to foil spoof attempts.
  # http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
  # While upper and lower case letters are allowed in domain names, no significance
  # is attached to the case. That is, two names with the same spelling but
  # different case are to be treated as if identical. This means calomel.org is the
  # same as CaLoMeL.Org which is the same as CALOMEL.ORG.
    use-caps-for-id: yes
  # the time to live (TTL) value lower bound, in seconds. Default 0.
  # If more than an hour could easily give trouble due to stale data.
    cache-min-ttl: 3600
  # the time to live (TTL) value cap for RRsets and messages in the
  # cache. Items are not cached for longer. In seconds.
    cache-max-ttl: 86400
  # perform prefetching of close to expired message cache entries.  If a client
  # requests the dns lookup and the TTL of the cached hostname is going to
  # expire in less than 10% of its TTL, unbound will (1st) return the ip of the
  # host to the client and (2nd) pre-fetch the dns request from the remote dns
  # server. This method has been shown to increase the amount of cached hits by
  # local clients by 10% on average.
    prefetch: yes
  # number of threads to create. 1 disables threading. This should equal the number
  # of CPU cores in the machine. Our example machine has 4 CPU cores.
    num-threads: 2
  ## Unbound Optimization and Speed Tweaks ###
  # the number of slabs to use for cache and must be a power of 2 times the
  # number of num-threads set above. more slabs reduce lock contention, but
  # fragment memory usage.
    msg-cache-slabs: 8
    rrset-cache-slabs: 8
    infra-cache-slabs: 8
    key-cache-slabs: 8
  # Increase the memory size of the cache. Use roughly twice as much rrset cache
  # memory as you use msg cache memory. Due to malloc overhead, the total memory
  # usage is likely to rise to double (or 2.5x) the total cache memory. The test
  # box has 4gig of ram so 256meg for rrset allows a lot of room for cacheed objects.
    rrset-cache-size: 256m
    msg-cache-size: 128m
  # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets
  # the kernel buffer larger so that no messages are lost in spikes in the traffic.
    so-rcvbuf: 1m
  ## Unbound Optimization and Speed Tweaks ###
  # Enforce privacy of these addresses. Strips them away from answers.  It may
  # cause DNSSEC validation to additionally mark it as bogus.  Protects against
  # 'DNS Rebinding' (uses browser as network proxy).  Only 'private-domain' and
  # 'local-data' names are allowed to have these private addresses. No default.
    private-address: 192.168.1.0/24
    private-address: 192.168.3.0/24
    private-address: 192.168.10.0/24
    private-address: 10.1.71.0/24
  # Allow the domain (and its subdomains) to contain private addresses.
  # local-data statements are allowed to contain private addresses too.
    private-domain: "mk-labs.cloud"
  # If nonzero, unwanted replies are not only reported in statistics, but also
  # a running total is kept per thread. If it reaches the threshold, a warning
  # is printed and a defensive action is taken, the cache is cleared to flush
  # potential poison out of it.  A suggested value is 10000000, the default is
  # 0 (turned off). We think 10K is a good value.
    unwanted-reply-threshold: 10000
  # IMPORTANT FOR TESTING: If you are testing and setup NSD or BIND  on
  # localhost you will want to allow the resolver to send queries to localhost.
  # Make sure to set do-not-query-localhost: yes . If yes, the above default
  # do-not-query-address entries are present.  if no, localhost can be queried
  # (for testing and debugging). 
    do-not-query-localhost: no
  # File with trusted keys, kept up to date using RFC5011 probes, initial file
  # like trust-anchor-file, then it stores metadata.  Use several entries, one
  # per domain name, to track multiple zones. If you use forward-zone below to
  # query the Google DNS servers you MUST comment out this option or all DNS
  # queries will fail.
   #auto-trust-anchor-file: "/etc/unbound/root.key"
  # Should additional section of secure message also be kept clean of unsecure
  # data. Useful to shield the users of this validator from potential bogus
  # data in the additional section. All unsigned data in the additional section
  # is removed from secure messages.
    val-clean-additional: yes
  # Blocking Ad Server domains. Google's AdSense, DoubleClick and Yahoo
  # account for a 70 percent share of all advertising traffic. Block them.
  # local-zone: "doubleclick.net" redirect
  # local-data: "doubleclick.net A 127.0.0.1"
  # local-zone: "googlesyndication.com" redirect
  # local-data: "googlesyndication.com A 127.0.0.1"
  # local-zone: "googleadservices.com" redirect
  # local-data: "googleadservices.com A 127.0.0.1"
  # local-zone: "google-analytics.com" redirect
  # local-data: "google-analytics.com A 127.0.0.1"
  # local-zone: "ads.youtube.com" redirect
  # local-data: "ads.youtube.com A 127.0.0.1"
  # local-zone: "adserver.yahoo.com" redirect
  # local-data: "adserver.yahoo.com A 127.0.0.1"
  # local-zone: "ask.com" redirect
  # local-data: "ask.com A 127.0.0.1"
  # Unbound will not load if you specify the same local-zone and local-data
  # servers in the main configuration as well as in this "include:" file. We
  # suggest commenting out any of the local-zone and local-data lines above if
  # you suspect they could be included in the unbound_ad_servers servers file.
  #include: "/etc/unbound/unbound_ad_servers"
  # locally served zones can be configured for the machines on the LAN.
 #    local-zone: "home.lan." static
 #    local-data: "firewall.home.lan.  IN A 10.0.0.1"
 #    local-data-ptr: "10.0.0.1  firewall.home.lan"
  # Unbound can query your NSD or BIND server for private domain queries too.
  # On our NSD page we have NSD configured to serve the private domain,
  # "home.lan". Here we can tell Unbound to connect to the NSD server when it
  # needs to resolve a *.home.lan hostname or IP.
  #
  # private-domain: "home.lan"
  # local-zone: "0.0.10.in-addr.arpa." nodefault
  # stub-zone:
  #      name: "home.lan"
  #      stub-addr: 10.0.0.111@53
  # If you have an internal or private DNS names the external DNS servers can
  # not resolve, then you can assign domain name strings to be redirected to a
  # seperate dns server. For example, our comapny has the domain
  # organization.com and the domain name internal.organization.com can not be
  # resolved by Google's public DNS, but can be resolved by our private DNS
  # server located at 1.1.1.1. The following tells Unbound that any
  # organization.com domain, i.e. *.organization.com be dns resolved by 1.1.1.1
  # instead of the public dns servers.
  #
  forward-zone:
      name: "int.mk-labs.cloud"
      forward-addr: 10.1.71.5        # Internal or private DNS
  # Use the following forward-zone to forward all queries to Google DNS,
  # OpenDNS.com or your local ISP's dns servers for example. To test resolution
  # speeds use "drill calomel.org @8.8.8.8" and look for the "Query time:" in
  # milliseconds.
  #
  forward-zone:
    name: "."
    forward-addr: 1.0.0.1@53#one.one.one.one
    forward-addr: 1.1.1.1@53#one.one.one.one
 #   forward-addr: 8.8.8.8@53#dns.google
 #   forward-addr: 9.9.9.9@53#dns.quad9.net
 #   forward-addr: 1.0.0.1@53#one.one.one.one
 #   forward-addr: 8.8.4.4@53#dns.google
 #   forward-addr: 149.112.112.112@53#dns.quad9.net
 #
 #
 ## Authoritative, validating, recursive caching DNS
 ## unbound.conf -- https://calomel.org
--- a/00-core-infra/ansible/set_hostname.yml
+++ b/00-core-infra/ansible/set_hostname.yml
@@ -1,15 +0,0 @@
 ---
 - name: Set hostname
  hosts: ipa_server
  become: true
  gather_facts: true
  tasks:
    - name: Set hostname
      ansible.builtin.hostname:
        name: "{{ hostname }}"
      register: result
    - name: Print result
      ansible.builtin.debug:
        var: result
--- a/00-core-infra/ansible/set_sudoers.yml
+++ b/00-core-infra/ansible/set_sudoers.yml
@@ -1,14 +0,0 @@
 ---
 - name: Update sudoers for passwordless
  hosts: unbound_servers
  become: true
  gather_facts: true
  tasks:
    - name: Update sudoers for passwordless
      ansible.builtin.lineinfile:
        path: /etc/sudoers
        state: present
        regexp: '^%wheel'
        line: '%wheel ALL=(ALL) NOPASSWD:ALL'
        validate: 'visudo -cf %s'
--- a/00-core-infra/ansible/site.yml
+++ b/00-core-infra/ansible/site.yml
@@ -1,4 +0,0 @@
 ---
 # file: site.yml
 #- import_playbook: webservers.yml
 #- import_playbook: dbservers.yml
--- a/00-core-infra/ansible/uninstall-ipa.yml
+++ b/00-core-infra/ansible/uninstall-ipa.yml
@@ -1,8 +0,0 @@
 ---
 - name: Playbook to unconfigure IPA servers
  hosts: ipaserver
  become: true
  roles:
  - role: freeipa.ansible_freeipa.ipaserver
    state: absent
--- a/00-core-infra/ansible/vault/mk-labs.vault
+++ b/00-core-infra/ansible/vault/mk-labs.vault
@@ -1,10 +0,0 @@
 $ANSIBLE_VAULT;1.1;AES256
 66323366323966373436343163303131323239343134323434373762383539663539363464393234
 3762666265303430373832333865613538316261386162640a653562666130323138313533616334
 37623336653332353830306534633165626634376636396166356235353937323965616161323437
 3536643537623931380a633730366330396538373836326439306566666663633932393230323563
 30643032646366393530663138376638386538336466633532303563636163303637303933646465
 37316239393136383638636436646230643338616438646564396238376136653639393865363666
 39346337356133313938303938643866346636663737323238333762386234373563633761333166
 36373063643438303930313366653436363731656163376666323330633763373361393663633631
 39353232346634633836623134383861656337663062393232373932353431323730
--- a/00-network/README.md
+++ b/00-network/README.md
@@ -1,9 +0,0 @@
 # Networks
 My homelab is segmented into a set of networks. Each network is a separate subnet, and each subnet is a separate VLAN that usually corresponds to the 3rd octet of the IPv4 block it aligns to. The following table shows the network and VLAN information:
 | Network         | VLAN | DHCP Range       | Description            |
 |-----------------|------|------------------|------------------------|
 | 10.1.71.0/24    |   71 | 10.71.1.10-250   | Server network         |
 | 10.10.22.0/24   |   22 | Static IPs       | Cluster network        |
 | 10.10.121.0/24  |  121 | Static IPs       | Storage network        |
--- a/02-proxmox/README.md
+++ b/02-proxmox/README.md
@@ -1,33 +0,0 @@
 # Proxmox
 In this iteration of my homelab, core services are running as VMs in Proxmox.
 The proxmox cluster will be installed via ISO Image and manually configured. (Future iterations will gitops this configuration via Ansible playbooks.)
 ## Primary Networking
 | Hostname    | VLAN | IP Address       | NIC             | Notes                      |
 |-------------|------|------------------|-----------------|----------------------------|
 | pve01       |      | 10.1.71.51       | On-board 1 GbE  | VLAN 71 set on switch port |
 | pve02       |      | 10.1.71.52       | On-board 1 GbE  | VLAN 71 set on switch port |
 | pve03       |      | 10.1.71.53       | On-board 1 GbE  | VLAN 71 set on switch port |
 ## Additional Networking
 | Hostname    | VLAN | IP Address         | NIC          | Notes                        |
 |-------------|------|--------------------|--------------|------------------------------|
 | pve01       |   22 |  10.10.22.51       | PCIe 10 GbE  | Cluster Network, VLAN tagged |
 | pve01       |  121 | 10.10.121.51       | PCIe 10 GbE  | Storage Network, VLAN tagged |
 | pve02       |   22 |  10.10.22.52       | PCIe 10 GbE  | Cluster Network, VLAN tagged |
 | pve02       |  121 | 10.10.121.52       | PCIe 10 GbE  | Storage Network, VLAN tagged |
 | pve03       |   22 |  10.10.22.53       | PCIe 10 GbE  | Cluster Network, VLAN tagged |
 | pve03       |  121 | 10.10.121.53       | PCIe 10 GbE  | Storage Network, VLAN tagged |
 ## Hosted Services
 - Recursive DNS (Unbound)
 - Authoritative DNS (FreeIPA)
 - Identity Management (FreeIPA)
 - iPXE (Matchbox)
 - VM Backup (Proxmox Backup)
 - VM Tempalate Creation (Terraform/Packer)
--- a/03-infra01-server/install.yml
+++ b/03-infra01-server/install.yml
@@ -1,43 +0,0 @@
 ---
 - name: Install all software on infra01
  hosts: infra01
  gather_facts: true
  become: true
  tasks:
  # - Update all packages
  # - Install ansible-core
  # - Copy .vault_pass.txt from laptop and set env variable
  # - Clone git repo
  # - Install ansible required packages
    - name: Install ansible-core
      ansible.builtin.package:
        name: ansible-core
        state: present
      become: true
    - name: Install dnf-plugins-core
      ansible.builtin.package:
        name: dnf-plugins-core
        state: present
      become: true
    - name: Register status of /usr/local/bin/terraform
      ansible.builtin.stat:
        path: /usr/local/bin/terraform
      register: terraform_path
    - name: Download and installt erraform version
      when: not terraform_path.stat.exists
      block:
        - name: Download  and install terraform
          ansible.builtin.unarchive:
            src: "https://releases.hashicorp.com/terraform/{{ terraform_version }}/terraform_{{ terraform_version }}_linux_amd64.zip"
            dest: "/usr/local/bin/"
            remote_src: true
            mode: '0755'
            exclude: "LICENSE.txt"
  roles:
    - somaz94.ansible_k8s_iac_tool.install_kustomize
--- a/10-sno-hub-cluster/01-dhcp/host-reservations.yml
+++ b/10-sno-hub-cluster/01-dhcp/host-reservations.yml
@@ -1,13 +0,0 @@
 ---
 - name: Dnsmasq
  hosts: localhost
  become: yes
  vars:
    - additional_dhcp_hosts:
        ethernet_switch:
          desc: "SNO Hub Cluster"
          mac: 98:b7:85:1e:c6:f1
          ip: 10.1.71.10
  roles:
    - role: ricsanfre.dnsmasq
--- a/10-sno-hub-cluster/01-dns/.terraform.lock.hcl
+++ b/10-sno-hub-cluster/01-dns/.terraform.lock.hcl
@@ -1,24 +0,0 @@
 # This file is maintained automatically by "terraform init".
 # Manual edits may be lost in future updates.
 provider "registry.terraform.io/rework-space-com/freeipa" {
  version     = "5.0.0"
  constraints = "5.0.0"
  hashes = [
    "h1:6EquDv6GgQO2HjZUUoRIUVzYa951n+wb4Uk7ggD6XD0=",
    "zh:098607e559c3b696401034ff494ba8068962b45059ee067a54b58334b6ee0f2c",
    "zh:18b806a14bb9d9382213c6929af35f5a65f16c17ff526d475f1eab33d1470290",
    "zh:2c8c74668844d256b7fdc503cd736a20b7e58db5b31880d1ad8090c1af04e24c",
    "zh:3bba458b9a6df99c21da58750dd6586b93bdcc557e4a2d695e801ada39e8de1e",
    "zh:58f728d9e98cc7aae3841c07318be64b6dcb2f51c041f04bba977e61104a2333",
    "zh:597dfbefbfe111a31e9ff3c4fc14fc8e12c1e255454087d3eebd2ec6c7aa9bf3",
    "zh:6093d6db13d834c23f5482efae80c8e1ae046028fccf24242f0f1c1935e6aa70",
    "zh:87271fa234a57ce05d4166e444002bd66976f971b434f7add45c874c9587129d",
    "zh:89f7f6be64b6bf9e708fbafd22f410cf3f50b1fcd4cd6c61e9ffffd6180ea839",
    "zh:9bdd7a984f845ff6f4bc4df5cc41a9de019639fceca62e60fc7c0f098ad2695c",
    "zh:a0551311c96b86050d15854b4fca2beaa06b2e1964f97945824567d0b90db580",
    "zh:c3daa12021725883bd32d7d852a2de845bb7a5f18009a45be7c2c2d891631713",
    "zh:d7871eb99683934a30b9d47508379e6d16978f3dcd73601af2204652668592aa",
    "zh:e8f72fd7750e6c1f0f97d039fea66cb85f457cf22908b7c3f14c7d2cf990ee84",
  ]
 }
--- a/10-sno-hub-cluster/01-dns/README.md
+++ b/10-sno-hub-cluster/01-dns/README.md
@@ -1,3 +0,0 @@
 # DNS Provider Configuration
 This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster.
--- a/10-sno-hub-cluster/01-dns/dns.tf
+++ b/10-sno-hub-cluster/01-dns/dns.tf
@@ -1,39 +0,0 @@
 resource "freeipa_dns_record" "ocp-hub" {
  zone_name = "int.mk-labs.cloud."
  name = "ocp-hub"
  type = "A"
  records = [
    "10.1.71.10",
  ]
  ttl = 60
 }
 resource "freeipa_dns_record" "api" {
  zone_name = "int.mk-labs.cloud."
  name = "api.hub"
  type = "A"
  records = [
    "10.1.71.10",
  ]
  ttl = 60
 }
 resource "freeipa_dns_record" "api-int" {
  zone_name = "int.mk-labs.cloud."
  name = "api-int.hub"
  type = "A"
  records = [
    "10.1.71.10",
  ]
  ttl = 60
 }
 resource "freeipa_dns_record" "wildcard-apps" {
  zone_name = "int.mk-labs.cloud."
  name = "*.apps.hub"
  type = "A"
  records = [
    "10.1.71.10",
  ]
  ttl = 60
 }
--- a/10-sno-hub-cluster/01-dns/provider.tf
+++ b/10-sno-hub-cluster/01-dns/provider.tf
@@ -1,22 +0,0 @@
 # Configure the DNS Provider
 provider "freeipa" {
  host        = "infra01.int.mk-labs.cloud"
  username    = "admin"
  password    = var.freeipa_password
  insecure    = true
 }
 variable "freeipa_password" {
  description = "The password for the FreeIPA provider"
  type        = string
  sensitive   = true
 }
 terraform {
  required_providers {
    freeipa = {
      source = "rework-space-com/freeipa"
      version = "5.0.0"
    }
  }
 }
--- a/10-sno-hub-cluster/02-dhcp/README.md
+++ b/10-sno-hub-cluster/02-dhcp/README.md
@@ -1 +0,0 @@
 # Add/modify entry in DNSmasq
--- a/10-sno-hub-cluster/02-dhcp/ip-reservations.yml
+++ b/10-sno-hub-cluster/02-dhcp/ip-reservations.yml
@@ -1,28 +0,0 @@
 ---
 - name: Ensure dnsmasq is installed
  ansible.builtin.apt:
    name: dnsmasq
    state: present
  become: true
  when: ansible_os_family == "Debian"
 - name: Ensure dnsmasq is installed
  ansible.builtin.dnf:
    name: dnsmasq
    state: present
  become: true
  when: ansible_os_family == "RedHat"
 - name: Add host reservation to dnsmasq
  ansible.builtin.lineinfile:
    path: /etc/dnsmasq.d/hosts.conf
    regexp: "^dhcp-host={{ hostvars['ocp-hub'].mac_address }}"
    line: "dhcp-host={{ hostvars['ocp-hub'].mac_address }},{{ hostvars['ocp-hub'].ip_address }} #{{ hostvars['ocp-hub'].hostname }}"
    state: present
  become: true
 - name: Restart dnsmasq service
  ansible.builtin.service:
    name: dnsmasq
    state: restarted
  become: true
--- a/10-sno-hub-cluster/03-openshift-image/README.md
+++ b/10-sno-hub-cluster/03-openshift-image/README.md
@@ -1,7 +0,0 @@
 # Configure the OpenShift Agent Installer and Matchbox
 ## Reference Document
 <https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/epub/installing_an_on-premise_cluster_with_the_agent-based_installer/prepare-pxe-assets-agent#prepare-pxe-assets-agent>
 Recap of image creation is in 10-sno-hub-cluster/02-matchbox/.openshift_install.log
--- a/10-sno-hub-cluster/03-openshift-image/create-openshift-image.yml
+++ b/10-sno-hub-cluster/03-openshift-image/create-openshift-image.yml
@@ -1,5 +0,0 @@
 ---
 - name: OpenShift image creation
  ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
  args:
    chdir: 03-openshift-image
--- a/10-sno-hub-cluster/03-openshift-image/move-pxe-assets.yml
+++ b/10-sno-hub-cluster/03-openshift-image/move-pxe-assets.yml
@@ -1,16 +0,0 @@
 ---
 - name: Create a directory if it does not exist
  ansible.builtin.file:
    path: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}"
    state: directory
    mode: '0755'
  become: true
 - name: Copy file with owner and permissions
  ansible.builtin.copy:
    src: 03-openshift-image/boot-artifacts/
    dest: "{{ hostvars[groups['matchbox'][0]].assets }}/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/"
    owner: matchbox
    group: matchbox
    mode: '0644'
  become: true
--- a/10-sno-hub-cluster/03-openshift-image/templates/agent-config.yaml.j2
+++ b/10-sno-hub-cluster/03-openshift-image/templates/agent-config.yaml.j2
@@ -1,33 +0,0 @@
 apiVersion: v1alpha1
 kind: AgentConfig
 metadata:
  name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
 rendezvousIP: {{ hostvars['ocp-hub'].ip_address }}
 bootArtifactsBaseURL: {{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/hub/
 hosts:
  - hostname: {{ hostvars['ocp-hub'].hostname }}
    role: master
    interfaces:
      - name: {{ hostvars['ocp-hub'].primary_interface }}
        macAddress: {{ hostvars['ocp-hub'].mac_address }}
    networkConfig:
      interfaces:
        - name: {{ hostvars['ocp-hub'].primary_interface }}
          type: ethernet
          state: up
          identifier: mac-address
          mac-address: {{ hostvars['ocp-hub'].mac_address }}
          ipv4:
            enabled: true
            dhcp: true
      dns-resolver:
        config:
          server:
            - 10.1.71.254
            - 10.1.71.253
      routes:
        config:
          - destination: 0.0.0.0/0
            next-hop-address: 10.1.71.1
            next-hop-interface: {{ hostvars['ocp-hub'].primary_interface }}
            table-id: 254
--- a/10-sno-hub-cluster/03-openshift-image/templates/install-config.yaml.j2
+++ b/10-sno-hub-cluster/03-openshift-image/templates/install-config.yaml.j2
@@ -1,25 +0,0 @@
 apiVersion: v1
 baseDomain: {{ hostvars[groups['hub-cluster'][0]].base_domain }}
 compute:
 - name: worker
  replicas: {{ hostvars[groups['hub-cluster'][0]].worker_node_count }}
 controlPlane:
  hyperthreading: Enabled
  name: master
  replicas: {{ hostvars[groups['hub-cluster'][0]].master_node_count }}
 metadata:
  name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
 networking:
  clusterNetwork:
  - cidr: {{ hostvars[groups['hub-cluster'][0]].cluster_network }}
    hostPrefix: {{ hostvars[groups['hub-cluster'][0]].cluster_network_host_prefix }}
  machineNetwork:
  - cidr: {{ hostvars[groups['hub-cluster'][0]].machine_network }}
  networkType: OVNKubernetes
  serviceNetwork:
  - {{ hostvars[groups['hub-cluster'][0]].service_network }}
 platform:
  {{ hostvars[groups['hub-cluster'][0]].platform_type }}: {}
 fips: false
 pullSecret: '{{ vault_pull_secret }}'
 sshKey: '{{ vault_ssh_key }}'
--- a/10-sno-hub-cluster/04-matchbox/templates/groups.tf.j2
+++ b/10-sno-hub-cluster/04-matchbox/templates/groups.tf.j2
@@ -1,8 +0,0 @@
 // Matcher group for OCP Internal machines
 resource "matchbox_group" "{{ hostvars[groups['hub-cluster'][0]].cluster_name }}" {
  name = "{{ hostvars['ocp-hub'].hostname }}" # Physical Server
  profile = matchbox_profile.openshift-agent-install.name
  selector = {
    mac = "{{ hostvars['ocp-hub'].mac_address }}" # PXE boots and installs to 10GbE NIC
  }
 }
--- a/10-sno-hub-cluster/04-matchbox/templates/profiles.tf.j2
+++ b/10-sno-hub-cluster/04-matchbox/templates/profiles.tf.j2
@@ -1,16 +0,0 @@
 // Fedora CoreOS profile
 resource "matchbox_profile" "openshift-agent-install" {
  name   = "{{ hostvars[groups['hub-cluster'][0]].cluster_name }}"
  kernel = "/assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-vmlinuz"
  initrd = [
    "--name initrd /assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-initrd.img"
  ]
  args = [
    "initrd=initrd",
    "coreos.live.rootfs_url={{ hostvars[groups['matchbox'][0]].http_endpoint }}/assets/{{ hostvars[groups['hub-cluster'][0]].cluster_name }}/agent.x86_64-rootfs.img",
    "rw",
    "ignition.firstboot",
    "ignition.platform.id=metal",
  ]
 }
--- a/10-sno-hub-cluster/05-bootstrap-acm/install2.yml
+++ b/10-sno-hub-cluster/05-bootstrap-acm/install2.yml
@@ -1,13 +0,0 @@
 ---
 - name: Run all tasks necessary to configure matchbox to install the cluster
  hosts: matchbox
  connection: local
  gather_facts: true
  tasks:
    - name: Clone Git repository
      ansible.builtin.git:
        repo: "https://github.com/redhatryan/acm-hub-bootstrap.git"
        dest: 05-bootstrap-acm
        version: main
      become: true
--- a/10-sno-hub-cluster/README.md
+++ b/10-sno-hub-cluster/README.md
@@ -1 +0,0 @@
 # Moved to other documentation
--- a/10-sno-hub-cluster/install.yml
+++ b/10-sno-hub-cluster/install.yml
@@ -1,62 +0,0 @@
 ---
 - name: Run all tasks necessary to configure matchbox to install the cluster
  hosts: matchbox
  connection: local
  gather_facts: true
  tasks:
    - name: Deploy DNS entries for cluster via Terraform
      community.general.terraform:
        project_path: 01-dns/
        variables:
          freeipa_password: "{{ vault_freeipa_password }}"
        state: present
        force_init: true
    - name: Deploy DHCP entries for cluster via Terraform
      ansible.builtin.include_tasks:
        file: 02-dhcp/ip-reservations.yml
    - name: OpenShift Installer install-config.yaml
      ansible.builtin.template:
        src: 03-openshift-image/templates/install-config.yaml.j2
        dest: 03-openshift-image/install-config.yaml
        mode: '0644'
    - name: OpenShift Installer agent-config.yaml
      ansible.builtin.template:
        src: 03-openshift-image/templates/agent-config.yaml.j2
        dest: 03-openshift-image/agent-config.yaml
        mode: '0644'
    - name: Create OpenShift image
      ansible.builtin.include_tasks:
        file: 03-openshift-image/create-openshift-image.yml
    - name: Move PXE assets to matchbox
      ansible.builtin.include_tasks:
        file: 03-openshift-image/move-pxe-assets.yml
    - name: Terraform matchbox groups file
      ansible.builtin.template:
        src: 04-matchbox/templates/groups.tf.j2
        dest: 04-matchbox/groups.tf
        mode: '0644'
    - name: Terraform matchbox profiles file
      ansible.builtin.template:
        src: 04-matchbox/templates/profiles.tf.j2
        dest: 04-matchbox/profiles.tf
        mode: '0644'
    - name: Terraform matchbox provider file
      ansible.builtin.template:
        src: 04-matchbox/templates/provider.tf.j2
        dest: 04-matchbox/provider.tf
        mode: '0644'
    - name: Configure Matchbox via Terraform
      community.general.terraform:
        project_path: 04-matchbox/
        state: present
        force_init: true
--- a/README.md
+++ b/README.md
@@ -1,95 +1,102 @@
-# A Homelab based on Red Hat Technologies
+# mk-labs
-This repository is the configuration of my homelab. In addition to providing services, the purpose of my homelab is to learn advanced concepts primarily based on Red Hat OpenShift.
+Automated infrastructure provisioning and configuration for a personal homelab, built on GitOps practices with clear tool responsibility boundaries.
-This implementation is built on easily accessible consumer based hardware and will focus heavily on GitOps practices and automation will be used wherever possible.
+## Architecture
 A single operator action — setting a VM record's status to **Staged** in NetBox — triggers a fully automated provisioning pipeline:
 ```
 NetBox (webhook) → n8n (validate & orchestrate) → Terraform (create VM + DHCP)
                                                 → Ansible (OS config + DNS + status update)
 ```
 | Tool | Host | IP | Responsibility |
 |------|------|----|---------------|
 | NetBox | fire-station | 10.1.71.102 | Source of truth — VM records, IP allocation, VLAN data |
 | n8n | tiki-room | 10.1.71.23 | Event orchestration, validation, pipeline sequencing |
 | Terraform | city-hall | 10.1.71.35 | Proxmox VM lifecycle, Unifi DHCP reservations |
 | Ansible / Semaphore | imagineering | 10.1.71.22 | OS configuration, DNS records, NetBox status updates |
 | Proxmox | fantasyland | 10.1.71.13 | Target hypervisor |
 All systems on the Server Trusted VLAN (10.1.71.0/24).
 ## Repository Structure
 ```
 homelab/
 ├── ansible/
 │   ├── inventory/          # NetBox dynamic inventory + static
 │   ├── playbooks/          # Runnable playbooks (vm-provision, DNS, OS updates)
 │   ├── roles/              # vm-baseline, dns-manager, common, haproxy, n8n, observer, etc.
 │   ├── tasks/              # Shared includable task files
 │   ├── group_vars/         # Group variable definitions
 │   ├── host_vars/          # Per-host variable definitions
 │   ├── templates/          # Jinja2 templates
 │   └── ansible.cfg
 │
 ├── terraform/
 │   ├── proxmox/vm/         # bpg/proxmox provider — VM creation from templates
 │   ├── unifi/dhcp/         # Unifi provider — DHCP static reservations on UDM Pro
 │   └── dns/                # DNS record management
 │
 ├── packer/
 │   ├── ubuntu-24.04/       # Ubuntu 24.04 VM template (small → xlarge-plus sizes)
 │   └── fedora-42/          # Fedora 42 VM template
 │
 ├── n8n/
 │   └── workflows/          # Exported n8n workflow JSON (vm-provisioning)
 │
 ├── netbox/
 │   └── initializers/       # Custom fields, VLANs, IP prefixes as code
 │
 └── docs/
    └── decisions/          # Architecture decision records
 ```
 ## Pipeline Flow
 | # | System | Action |
 |---|--------|--------|
 | 1 | NetBox | Operator sets VM status to Staged → webhook fires |
 | 2 | n8n | Validates payload (hostname, IP, VLAN, template, proxmox_node) |
 | 3 | n8n → city-hall | SSH + `terraform apply` — creates VM on Proxmox |
 | 4 | n8n | Queries Proxmox API for MAC address |
 | 5 | n8n → NetBox | Writes MAC to VM interface record |
 | 6 | n8n → city-hall | SSH + `terraform apply` — creates DHCP reservation on UDM Pro |
 | 7 | n8n → imagineering | Triggers Ansible via Semaphore API |
 | 8 | Ansible | OS baseline, SSH hardening, Technitium DNS A record |
 | 9 | Ansible → NetBox | Sets VM status to Active |
 On any failure, NetBox status is set to **Failed**. No auto-retry — operator investigates.
 ## Hardware
- Dell 7050 SFF (7)
+- 7× Dell 7050 SFF
- Minisforum TH60 (3)
+- 3× Minisforum TH60
- Minisforum MS01 (2)
+- 2× Minisforum MS01
- Synology 1621+
+- Synology DS1621+
 - Ubiquiti UDM Pro
-## Software
+## Software Stack
- Proxmox (Virtualization)
+- **Virtualization**: Proxmox
- Cloudflare (Domain Hosting, Public DNS)
+- **Automation**: Terraform, Ansible, n8n, Semaphore
- Unbound (Recursive DNS)
+- **DNS**: Technitium (authoritative), Unbound (recursive)
- FreeIPA (Identity management, Authoritive DNS)
+- **IPAM/DCIM**: NetBox
- Matchbox (iPXE)
+- **Networking**: Ubiquiti UDM Pro
- Red Hat OpenShift
+- **Templates**: Packer (Ubuntu 24.04, Fedora 42)
 - OpenShift Agent Based Installer (Install OpenShift)
  - [Red Hat Advanced Cluster Management for Kubernetes](https://www.redhat.com/en/technologies/management/advanced-cluster-management)
  - [Vault](https://www.hashicorp.com/en/products/vault)
  - [OpenShift GitOps (ArgoCD)](https://www.redhat.com/en/technologies/cloud-computing/openshift/gitops)
  - [Red Hat Ansible Automation Platform](https://www.redhat.com/en/technologies/management/ansible)
 ## Prerequisites
 - Ansible user created
 - Ansible configured 
 - [Networking](docs/networks.md)
 - [Proxmox](docs/proxmox.md) (In my homelab, internal DNS, identity manangement, and ipxe are hosted here.)
 - Matchbox
 - DNS
 - Domain Registration
 ## Assumptions
 There are a dozen different architectures you could use to deploy OpenShift in every which way.
 For the sake of this documentation we'll assume the following:
 ## Getting Started
-[Step-by-Step Walkthrough](step-by-step.md)
+See [docs/decisions/vm-provisioning-flow.md](docs/decisions/vm-provisioning-flow.md) for the full architecture decision record.
-### Hub Cluster
+Previous OpenShift/ACM/Fastpass content is preserved in the `archive/pre-mk-labs` branch.
-You'll need an OpenShift "Hub Cluster" with access to persistant storage.
+## Security
 A Single Node OpenShift (SNO) instance, installed on bare metal, will act as a Hub cluster and run:
- Advanced Cluster Management
+No sensitive data is stored in this repository. Secrets are managed via Ansible Vault and environment variables on pipeline hosts.
 - Ansible Automation Platform
 - Vault
 - OpenShift GitOps
 #### Network Prerequisites
 The prerequisites for OpenShift in traditional and HCP patterns are largely the same - it just kind of depends on where your DNS records go to.
 | Cluster           | Endpoint    | VIP           | DNS A Record                      | Notes                           |
 |------------------|-------------|---------------|-----------------------------------|----------------------------------|
 | Hub Cluster (SNO) | App Ingress | 192.168.0.10 | *.apps.hub-cluster.example.com    | SNO App VIP goes to IP of node  |
 | Hub Cluster (SNO) | API         | 192.168.0.10 | api.hub-cluster.example.com       | SNO API goes to IP of node      |
 These DNS entries should be put in your Authoratitive DNS.
 #### ACM & GitOps Configuration
 Before you start creating clusters you may want to create some Policies, integrate ACM and ArgoCD, etc. This step is optional in case you're just interested in trying out Hosted Control Planes or copy/paste around a cluster for testing purposes.
 Find additional details in the ./02-rhacm-config folder.
 #### Creating a Cluster
 With everything in its right place, you can now start to declaratively create clusters
 ./05-clusters/hcp-bmh - HCP to Bare Metal Hosts
 ### Internal Cluster
 Two additional bare metal nodes, to be added to Advanced Cluster Management (ACM) running on the SNO Hub. These will be used to create another HCP cluster.
 These servers have a BMC interface with Redfish - if not, then you'll need to manually manage the boot and installation of those servers.
 This makes it to where you just need 3 bare metal nodes. You could run one HCP Bare Metal cluster with both of the other nodes, but then you have a shared storage requirement that can't be satisfied by ODF since that needs at least 3 nodes.
 ### External Cluster
 You'll also either need you just need at least 2 bare metal nodes.
 ---
 ## Credits
- Ken Moini - As I used his [repo](https://github.com/kenmoini/ztp-for-you-and-me) as the baseline for this project.
+**Status**: 🚧 Active Development — VM Provisioning Pipeline
- Ryan Etten
+
- Andrew Potozniak
+**Last Updated**: February 2026
--- a/ansible/DNS_MANAGEMENT_REFACTOR.md
+++ b/ansible/DNS_MANAGEMENT_REFACTOR.md
@@ -0,0 +1,193 @@
 # DNS Management Refactor - Modular & Repeatable
 This document explains the refactoring of DNS management from standalone playbooks to modular, reusable tasks.
 ## 🎯 **What Changed**
 ### **Before (Monolithic)**
 ```yaml
 # Standalone playbook: add_technitium_dns_entry.yml
 - name: Add entry to Technitium DNS
  hosts: all
  tasks:
    - name: Create DNS entry
      effectivelywild.technitium_dns.technitium_dns_add_record:
        # ... hardcoded parameters
 ```
 ### **After (Modular)**
 ```yaml
 # Reusable task: tasks/add_technitium_dns_entry.yml
 - name: Create DNS entry for {{ dns_record_name }}
  effectivelywild.technitium_dns.technitium_dns_add_record:
    # ... parameterized with variables
 ```
 ## 📁 **New Structure**
 ```
 ansible/
 ├── playbooks/
 │   ├── tasks/
 │   │   └── add_technitium_dns_entry.yml    # ✅ Reusable task file
 │   ├── add_dns_entry.yml                   # ✅ New playbook using task
 │   ├── add_technitium_dns_entry.yml.backup # 📦 Backed up old version
 │   └── roles/
 │       └── dns-manager/                    # ✅ Enhanced role
 │           ├── tasks/main.yml              # Uses task file
 │           └── defaults/main.yml           # Technitium defaults
 └── scripts/
    └── migrate-dns-references.sh           # ✅ Migration helper
 ```
 ## 🚀 **Usage Examples**
 ### **1. In Playbooks (Direct Task Include)**
 ```yaml
 - name: Add DNS entry for my server
  hosts: my_servers
  tasks:
    - name: Create DNS entry
      ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
      vars:
        dns_record_name: "{{ inventory_hostname }}"
        dns_zone: "{{ base_domain }}"
        dns_ip_address: "{{ ansible_default_ipv4.address }}"
 ```
 ### **2. Using the DNS Manager Role**
 ```yaml
 - name: Setup cluster DNS
  hosts: control_plane[0]
  roles:
    - role: dns-manager
      vars:
        cluster_endpoint: "my-cluster.local.mk-labs.cloud"
        cluster_vip: "10.1.71.100"
 ```
 ### **3. Using the New Playbook**
 ```yaml
 # Import the new modular playbook
 - import_playbook: add_dns_entry.yml
 ```
 ### **4. In Cluster Network Setup**
 ```yaml
 - name: Setup complete cluster network
  ansible.builtin.include_role:
    name: cluster-network-setup
  vars:
    cluster_name: "fastpass"
    cluster_endpoint: "fastpass.local.mk-labs.cloud"
    cluster_vip: "10.1.71.53"
 ```
 ## 🔧 **Migration Guide**
 ### **Automatic Migration**
 ```bash
 # Run the migration script to find references
 ./scripts/migrate-dns-references.sh
 ```
 ### **Manual Updates**
 1. **Replace playbook imports:**
   ```yaml
   # OLD
   - import_playbook: add_technitium_dns_entry.yml
   # NEW
   - import_playbook: add_dns_entry.yml
   ```
 2. **Use task includes in roles:**
   ```yaml
   - ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
     vars:
       dns_record_name: "my-server"
       dns_ip_address: "10.1.71.100"
   ```
 3. **Use the dns-manager role:**
   ```yaml
   - ansible.builtin.include_role:
       name: dns-manager
   ```
 ## 📋 **Variable Reference**
 ### **Task Variables (`tasks/add_technitium_dns_entry.yml`)**
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `dns_record_name` | `inventory_hostname` | DNS record name |
 | `dns_zone` | `base_domain` | DNS zone |
 | `dns_ip_address` | `ip_address` | IP address for A record |
 | `dns_record_type` | `A` | DNS record type |
 | `dns_ttl` | `360` | TTL in seconds |
 | `dns_create_ptr` | `true` | Create PTR record |
 | `dns_debug` | `true` | Show debug output |
 ### **DNS Manager Role Variables**
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `cluster_endpoint` | - | Full cluster FQDN |
 | `cluster_vip` | - | Cluster VIP address |
 | `dns_management_enabled` | `true` | Enable DNS management |
 | `use_hosts_file_fallback` | `true` | Add to /etc/hosts |
 | `dns_ttl` | `360` | DNS TTL |
 | `create_ptr_record` | `true` | Create PTR record |
 ## 🎯 **Benefits**
 ### ✅ **Modularity**
 - Single task file used across multiple contexts
 - Consistent DNS management approach
 - Easy to maintain and update
 ### ✅ **Flexibility**
 - Works in playbooks, roles, and standalone
 - Parameterized for different use cases
 - Supports multiple DNS providers (extensible)
 ### ✅ **Maintainability**
 - One place to update DNS logic
 - Clear variable interface
 - Better error handling and debugging
 ### ✅ **Integration**
 - Seamlessly integrates with cluster setup
 - Works with existing homelab infrastructure
 - Compatible with Traefik load balancer setup
 ## 🔄 **Integration with Cluster Setup**
 The DNS management now integrates seamlessly with your cluster deployment:
 ```yaml
 # In fastpass-first-control-plane role
 - name: Setup network infrastructure for FastPass cluster
  ansible.builtin.include_role:
    name: cluster-network-setup
  vars:
    cluster_name: "{{ cluster_name }}"
    cluster_endpoint: "{{ control_plane_endpoint }}"
    cluster_vip: "{{ ansible_default_ipv4.address }}"
    control_plane_nodes: "{{ groups['fastpass_control_plane'] }}"
 ```
 This automatically:
 1. ✅ Creates DNS entry for `fastpass.local.mk-labs.cloud`
 2. ✅ Configures Traefik load balancer
 3. ✅ Tests connectivity
 4. ✅ Provides fallback to /etc/hosts
 ## 🚀 **Next Steps**
 1. **Test the refactored approach** with your FastPass cluster
 2. **Extend to other clusters** (Hub, Internal) using the same pattern
 3. **Add support for other DNS providers** if needed
 4. **Create monitoring** for DNS health checks
 This modular approach makes your homelab's DNS management much more maintainable and repeatable across all your Kubernetes clusters!
--- a/.ansible/ansible.cfg
+++ b/.ansible/ansible.cfg
@@ -209,7 +209,7 @@ private_key_file=~/.ssh/ansible
 remote_user=wed
 # (pathspec) Colon-separated paths in which Ansible will search for Roles.
-;roles_path=/Users/rblundon/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
+roles_path=/opt/git/homelab/ansible/playbooks/roles:/Users/rblundon/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
 # (string) Set the main callback used to display Ansible output. You can only have one at a time.
 # You can have many other callbacks, but just one can be in charge of stdout.
--- a/ansible/group_vars/all/step_ca.yml
+++ b/ansible/group_vars/all/step_ca.yml
@@ -0,0 +1,4 @@
 ---
 step_ca_url: "https://turnstile.local.mk-labs.cloud:9000"
 step_ca_fingerprint: "f63c44e76381e359978bd2dca07c928d04ad44b575f0364fa66b5725c7e7891b"
 step_ca_provisioner_name: "admin"
--- a/ansible/group_vars/all/vars
+++ b/ansible/group_vars/all/vars
@@ -0,0 +1,32 @@
 ---
 # file: group_vars/all
 # Proxmox variables
 proxmox_user: "root@pam"
 proxmox_password: "{{ vault_proxmox_root_password }}"
 proxmox_host: "main-street-usa.local.mk-labs.cloud"
 # DNS variables
 dns_server: "monorail" # .local.mk-labs.cloud"
 #dns_admin: "admin"
 base_domain: "local.mk-labs.cloud"
 # DHCP server
 #dhcp_server: "matchbox"
 # Terraform variables
 terraform_server: "infra01"
 # Traefik variables
 traefik_server: "lightning-lane"
 step_ca_principal_mappings:
  - local_user: wed
    principals:
      - ryan.blundon@protonmail.com
      - ryan.blundon
      - ryanblundon
  - local_user: rblundon
    principals:
      - ryan.blundon@protonmail.com
      - ryan.blundon
      - ryanblundon
--- a/ansible/group_vars/all/vault
+++ b/ansible/group_vars/all/vault
@@ -0,0 +1,306 @@
 $ANSIBLE_VAULT;1.1;AES256
 33333438373661633337383161343862383963623736636136653339363064386538386437323135
 6436666330363032616365656434356161396530363363610a333864313064633232366133366232
 37316636366334346536663337663065303635626638666264666435393933343832653061323237
 6663333736386636350a653931626665346234323832393334373563303130626262646565653231
 30326263623965356639386438636531306430343239313162383065386135653534636134376333
 64616432303732646535643530353963363734663538393539633034326535643539356561656632
 36363330346131393262326561356631343631356434666264616134643136646238376336373665
 65346361636435316437353235393263313766623438336662353532306463353134366435326364
 36613865343264616364333631353238663238313338333232626262313637633662633163366638
 61323166393739656536656435336538303439636561363961353832313431666432393463636537
 62323939376265353330356334303334303532643136376531343765613738656562386665336132
 36346232313432396431666535663362333332613037623531636135376439393936353261653863
 65373061316461303866363338376131343736323933383636626338616431656533363833663266
 62363935313262393733333566386337633630666332353263666462373164346362313034636239
 33656462396238343065613965613232623132343562323364653366313231323531326364376631
 65643961303862653030343364326533356336393031636437393465636263626236303633326139
 65643432663037333332346261323663613031386563383533336538383133373332343363326530
 66643231666636366435623639643166333863376533633537363364396663363732333932663333
 62333239613264353233303064333931326236396538323130353061366139623362393734323434
 36343537393363343861633131346561353637646336313233376162656561623362653565623339
 63386337613461343534643964323932356661383436303966346339386131336133643132376330
 38656535353335303966636235643666306336396435636434363733313665366234393032333065
 37633231376134636435343233363032666231666134623365653238373836326237373831326262
 66303234303164303961316166623062616139353264343864363938313733653563663661633535
 37326636346435626362336437666364623264363565653935336438386262376663303230313265
 62663665666132313436663330616230383235346333623563313262376530356535613263316436
 35313766363763386234333733636464326134633136346532346632623534646365623136343363
 30316435613031333036383835656230353430636135343961356363613139353763343233633834
 38656431363139396535653565633631393462316334666464333839343035616531643466643531
 35613733373331643961353830376266376433363938373563653833343464633465663766333066
 34633364313762633034633461623232656537653762623532613332386132333365383062653136
 63323234626266336462333534636236653230343530336532653831313339613531343731313237
 39653737663665373361326433643364656434393838326339636238303964366336363961653366
 36643938633635313432663765316130326238306163346566313062626439626263633033623731
 63323532346366653238663931653334613734633963363632643462316130393138363436666532
 32373833323330356164626332646232623031326365653765336261323661616137373732356164
 63383633353764643233323430333233306337623834353934643864636339646239636430316166
 33643030333261323461643031613730343131343830353463313766353035326436306566343161
 35643534323763316165343832346433356364343061383036306434386631356537363331303035
 34303430393034393763343964613935383739656662643066363633333839396465386231383837
 30336331393365346636363732616661633635326364366435366466383639353839343731616365
 65326633636263653438343561633632646234316461616666363630333966326230356331373335
 31353665626233663433633563623765343431376639316232346666663065656462616438663333
 62663662336662346563333935333261626635343764356631356363356362346231306535376466
 36393932666662653934626134613065623461303834393231616332363461306534303666353632
 35646363333065356631393863396536633838343365343238636332303862306631346639656166
 30373735336361653863326331373834663164393863666631623866353338366561326635323132
 35306535626564376666623837666435663337613164623966306138353161313239373436346239
 36656266323233636233326139326266346464353665323465663666646264613466636132626464
 37353762306538643233663338613062353134323832653139663036666337643131613062643936
 37633363376365356333353433613839653130323036643737633163336531323032393937333432
 39343238396534353330346664346135326333333638666261396463656663323935643337313462
 32396137613432623664323134356361323861306230353165663162663732326563626162346630
 34626536393962393764393764393234373138656432346332633963393135386238313563353761
 34366438353337396264373032336166663937343931633635666166343638386237396333626133
 38383766616566336163363931393438366566386565663938356630366430393830653037363738
 30666465326266363834653934643434666466326632366463303965303366326364316430366561
 32636631663232373163636535366333623261366466623262393631626334626263656534386536
 66323833353264623538663232376138346361646362313565333534363535663031643833373064
 38313062346339636335633962323933383230623634303431383236626166636535326465316439
 38646636336130373763646635386265373065326263616438646565313439613830316135616435
 62326430336337643265306261343036653938633634626561333664313035393933646533326661
 62626437306432353938356338616462663130646530623636393233373837336138383963323165
 35643231613565313434386163643637633130626435376561376235346438303234386637383835
 37356238616263646665336435306233396436666664396532373063626162346237376662393639
 35373665373638396434353062666430633362653163633639623836346438323632643164653638
 62623463343465303236346562386338646536656438633966643430343266313935323630616633
 62313531343764343966333439343866613965303036616634363162303434643533366465313562
 62393666313838313938356265633531326431333730626632343139666338656465306431636162
 66343532346238393464366134656334363964626264623263353537633638346239396539653538
 37303339613036306533353132326534306433353364613536316263326363323134333639346236
 39376263313431666462383863336638306631663563313364333235333338323364613361633532
 38313263353539633662353533646333353262356436353938303036663130306362303935356136
 63313234363138383864613664666635613464653765636461383738356135623662313866383036
 64626437343465333563346434323762313232643230323336366539326631396463303961666461
 61656338643532616337653362636362373837373836666535633762343335623033316264366261
 62633137356132306430623537616135613965393737323263343463633839393165646630383331
 36616339346534346636396532333836633436323232323364303963313030656330386336633538
 34383534313236396461653462306130376462396138303561636331663062303864326238303335
 65663832333631613963326639386665643135366632393438666361376334636233336239633837
 36383761616364363262306535653065303536363066316431303464373230326436336661396231
 66333438376664333731333630383031366237396638326534636532343535303964653436633438
 64616263366561653334346138393866353437393037343930623237326231303261383733336232
 37646533393439653965386563333232656565663531396663303334313839323361363864396332
 61656638303130303433666561646663323139643337326561333832373538306236326538363637
 38666534633330653564653066643335623938373331376339393338343533366436333330313165
 65366562386366666632653064663637343536313462326562626436356363306134306237613265
 32366338643237333739626331393763323934396265383138633035646533353536633866313432
 38336137383036373434363530353833653938663035306337643638316463373762613931373038
 32373361326136616331663733616133623936663530356566383461336334663937383230386462
 38656332613763653339363565613762383735333163633831356364333563363630623666616430
 30353237653730613361643233386139303639666137653733353334326530306431376666663664
 34633531393261343165663330373961646665396139323762313663376639366464306533623333
 62326432623334336166656565656230313063656163636561326632666438633966323930316264
 66373866663461616336336264356561373232313737353836646632383438333162383832616662
 30636437613163613631623165366631306438643765383263626133653231333361383633363136
 36653831623562653838633133646633393038666164346461333531373034356435363336636338
 62623464376264363537306166613461396630303039373239656664396564333435303164613235
 61346238386233653462616632303337663036626465663361636130333566303337313237626237
 65636633316366343064663636383362316665633263633136323563363935346138356635653036
 36383835323838366363363335323731333066393334373265653563336533616362633163343661
 66326630353537653633316631343332303231373630363635623136386537666434383032323165
 33333633643064376239346139633664633330323966366430353135616633633465363030386665
 36353164623564343934323063313763316566373830643163616633643937323732333561353832
 66623364666335316230346665353631663465633034323265666663653866623037353935393262
 61623065656637636666383239343661616233396663333038393963366537326136653863333235
 65633137626134383763663366396438366634313465363965343830333966373930333134353339
 35396538303537316636333339613731623636646230323662613663306537326566656666323434
 65346531623533336535393530373963343864313963666335636334396663393837396665373565
 39646138356134313732666633663061646330643438393736653433313238373135656636643337
 39396362383363333434376336613933613438653636663334336337653633613433623336623461
 32373565306435646438306365343465653863656434663937653938393839333739363639326536
 64303534383961333333386237366239386330386533343939613664363439373135333731393739
 39363166306636333766333332393265613133356262356666343039666237663664636266626664
 65316339323638353333653631363365356562623535666235313234613236326130616261663830
 34663063626539363734313562656233656131326265626637353239636638396564313561383761
 62663638623135343333316464346236353364616239633566393039633339306334623234616331
 34366435663938346335323932633330366639653636336636373562306561656536653363366233
 39383064623435356338636335343662343435336564363965646439393964323162363736346637
 65323765333364353831396433666561376437333834313334316165386631616332633533666336
 37313533623535313934393230353439363231623063663961376537393638636237623134323337
 30393032333530316330333736616463633262616631353238323933303766646137386465643366
 33356665396437623732373437373537303034353431353031313162323730316566396238653038
 30366234663037653736353137376264363934646366353761323364663538346662323934343266
 30373662613461663561623466633939396439653663353365346133623933613462623231616562
 66643738643661643766323266626266313330633936313964366536323263373666303130623738
 32323230356665323439646532343930333936373536626466656566363161646663616266326133
 32393137663562613531323832313565346632303131646432363961613331346636653830323136
 36323436373964313737313131346131353630636561636639316464323666636336656265343565
 65303936353165326137613638366532303265356537343337656165366663383961643134656435
 61383565306265333939613561613035616663336361396536343939343761663833346134646365
 34323233666439623436323261616432363838616437386138393735383364393164646638373630
 33386632346239383037633132636431366264383633333365306338333661303662363533376339
 62633663366362303038616666336335346332316366353136323666346531393938666236343163
 31663665643839313439663839353431343061386465366331663637373532613266383065393639
 62613565626135363133623261333061373738633333623337396631356332643039306638303434
 65663762373630323263333239613939346133626534613632396433376234663636363062656537
 62386664343462346334663662663865653766373738306438316533643962356136653565373761
 62393437326138323065396630653838326138653865643937353431656137393732346361353734
 31326634653331353232633061303230393462363065613832303630383237366463363666613864
 37643135303034326335326563353064343835323863313134616262386564313235653762376332
 36636533646235343138396537623266333566633466393764353731393935306432313266636133
 63326362653033613264333139633638643638326532313239646239386332323330306538366362
 37646432363535396161336465376363343430333261396536346464356135343462663462613136
 36666238633663326230373834303431336566366666666534343537313635366537396262656236
 36646639643730393134613662383238623835626230313833653932303832323366343765343434
 34363033323836663035363166313630313062663162313165636138373261386636623831666632
 33373962626237666130373031633437653966386561363232363332333633303961323864333263
 39666230383332376537313137643635623336316336646537333137633564376432356432326639
 61383565313233376435636366366531363462306535636131636163636130663732383161616364
 37343064333264663533343739356139353365386565383833363165326536306431393764303632
 30653865623566363965306636366530303261616663306433393135656366383138356337383365
 36323736643035383231663034626564643235646237623632383164633062326132363331353634
 61653761346439326665366565383534393635616365353361353863363763383664303166383434
 33393732313837373336616564343864633330663566653933356237613538653366663838383132
 33303437323438313837616134616466626562313262653866313034383764656566373331343738
 30613062303630663365636230396231313065356662376163353632613564363066316239636434
 66356535386263353737383838653538316366343935323337386561353533353161636538646363
 63643739376366326536333261306263653563353331393133323964653764373932663136316335
 36333535626231373864316634613366353535393932373039646161646466363663626561373033
 64333133353931303361363466346666376431363336323166356162363537633536336638653838
 35323562653138393833383130353232616564393738326638366565616233633634336438303632
 30353765623565336330386335306162336662643466663335623836383238316161633339373137
 32393165323735643034633464313337386362363331353432363233396538393835383933313637
 65656330383732633537646361666439303266653165313233636464313964383639346635376538
 64633861623439626331643431326336646135656539313836323135373862316438393237663564
 31373135356135356662336265633862343435356530393835376430666566653036373338636332
 64663230323361356262356537656262396665663538386664363735646234306231613339636338
 34366433326535353965376236643661646339366566663531653864316533356466653864373633
 33363330333765373662646634326236313434383433653563383436316635353461386662646165
 31626566616163373137326165323066646535663766636265386435633965326165303831323633
 39613139623835316165326138386431383530383035653931616334353235636138303761383037
 39336163373332346365333935656563343939623335313461363138656239666263366236663464
 32303732663937363964346639323236623166373334386239613564643834316536363634326461
 64623939363635613863613065656363303734643766306564326437663037623839303734393036
 64326363626562363934313930383766383462663766336666663338653765656137393362643366
 36326336323638393161353464396637633566383262333234656233653334623131323532376637
 62613064626532616631646232386631623839326665346431333232333463373031316237363462
 30643731653666643331643839343865646437613135346363646131383262396134376363303335
 34303164303236383139326264623462363062313139653465346435336163653863633764613631
 33623666316530353163396539323238663935643764643939333966336137353034663164643733
 34393132323339626331626532643266336435653636353930393738363134353661653636643263
 30313138393263383837333438356463636162383938396137363035646433663932613066386138
 37316535373939326131643930353435383232623366393630663463633233393232373730333631
 37623837373533383462323431323335316231356436303239313535633837353931613730303363
 31613765626466636636613366346166393766373834643337353764666532376335376139316138
 38646133643736636363363434306334373933633264366530373534666637393835366266306633
 66653966613136653936313732396366323830376236626530306139333030323966383035643733
 36353833323539393136303035393866366563323430636336356639623734656135356566373062
 34666433316139316664643234623530363732373338623162363636303463346463323131333065
 64656566353837336266386233323439623237366364343635306137663038326434366531623062
 64613365323339613465326464653965613439653766623762363139366264663765363862323839
 63346539323961343532626465363266626234363964313531353662636635623165376130616536
 64363361383766636333626366616531343833633033643965626435313130653938316430313532
 64363731633139383236326231653434663132313463326563393739393132663765396337643035
 32373963393830356362366130376135353935396631393533333430363531636234333832373939
 36656233343663623262346337323034653036373432303266353333626434353137353939346665
 37633432303162323538343339643635636464353333313063363662663033396630303162333639
 31633537373364666234653938633461343738333464653736316331343038393333643936646462
 36373232373962653031333730363166393463313232616631383233386533373464366465623335
 65393462353638633931353331313233356230303565313030663739626230323766666466326339
 35303361383065353333666161306433383139366439633730666364383130316637633464646336
 66643065303934663765623233333261313939373236396136366566306438626439393163636430
 30656334663361396230303239663338373664346362623934313130343064353435626439356562
 35653638613037656133313765313165333066353732363361386234353635626563323932356237
 31363333326536353536323931643739333764323637356164663566343563633761333462383735
 66383134646139373130386366316532656139336231303931656265636130643130616531366530
 62383132643236623835323362383866613765343762333536333365336338373264633130656438
 36343331666431326530626137333665623836636136303031333965356366396239396534663263
 35343730303534313830623430666566386564653036356635623038303133623231616635396463
 65626137633033663631373366373238353766323533643462396562633164633730633135396266
 36316362353964306463336237383232306530613539653462326137383938333638353038396132
 66343265643162363735663235353161393732326530373735363662633165316265323065396163
 31663761303637616566396262346238366631663562323566323364663464373930373831323630
 39333165336264336539353634633936396561626363353466303931343436306636356663346438
 64373561666638656439353964626436613164643663336336333337393332346132313830316430
 37336139333539316639646337383737373530643533336133633135333936343165303764623366
 35346432656263396439663635653066303861643938633033393334336336396133626237336432
 31393061653839653964613239353336653666366163616163616230396661313233613934326339
 36333733663032613633613037343337646237666565316239303231313163383264376636336338
 37656532373634383132346163316337336534316465383531316465353861633062336235376631
 33333963313730653164313866323461353334653231333762336232366434333631396135333466
 36643362653137323934323966303734316334306133656139613763336431323236643264663530
 38633730346531396435666530316563386566323737343766653135386537393165356264356534
 62323962306332393063313062313230333334353833393362656166353638323366353934656263
 38633531306438663134616262323332323338653361356336353962376331323537623734316532
 35306434383336633436656437663765626530626535383464356532613536356533646332646135
 39613030323432643161366363313262633261366566613931303663636262353466313933303162
 66373535353934626135326439653630303437666535396266303532626636613563616633623237
 38623938323137393065616136376663363234633735363264356438353534616338393832386337
 66663339313062613766666435626364353935643932633233643630323464336135336339376437
 30323536373639343738613463613466396335626339343135306666663931656564393664643761
 65396336613465313035396134636438636134316236636566333031646666383939383264303437
 38656337326233363866336363363161333236326137393465633935626165663136316661316131
 66393764313130373766386235663134376239323037373365333730643336656532316434663265
 35646664383338326366386536616339393938336539373762643839613763323434363037326330
 66353738643735656165396138343262653563353934376237366564636638623630393238373530
 39336335303564616232393165653639326166333536343966353933633365326539383632646639
 37636238376137646239353731343933346562613630656130653865633834626363656231373162
 65333662653962373139633466383834626566336234316161633038653137393266393564376439
 62343365666637396639326438326631613664666662653935346230316632396361663038663239
 63336335643665353162393330623635663839666162333561376265363330383530653733333239
 37373665646562343562313764386534663239636130646564333433313661363338326439363865
 63353064613161366461383862623363333637633430376361366566383332636634646630363139
 65303139396539323336313666336362626339326666343061303431356361343438313365353431
 30303266363664373233303231346166643839343564306363613236316665306437333636343131
 61303234666664323138376335623639393939633836353664343232316630393263323233343366
 32393736336166323166616139323066613062646139656236343233623630616262343034383631
 61653662383537646364363764353335333630353431633534313731633265626263303863326565
 37616534303164316162353165396236656565303532326235393237366434323739633662663261
 33383635653734303233356438636132343731383439623463633732373833303339353662386435
 63316138353766303962616435383138373739383835353662613666356565366237353932393263
 34326561613234356537343234303166613534356134643766383332646263623430653632386365
 61376165656366366532346465343932313032643163313362373633373066653036346238343938
 66626133306163353966386662363039323166353330633239386264306337386361653430633838
 66366636616661313939316562373330313564383033643035393738353939613066316138643238
 35376336633238636463376234376364386464396461636336313562616361396435323639666433
 34653139613962623235613035363634383735326564333332333632656237333238356566646536
 62346435303932363231306634643037623935653235613330666666656433396463656231643364
 34313235613064646432633935656231643162363530313761303339323830653564303963643532
 39326163396461613161363031616336666564326630323465663831653431353566643661656435
 35636238633663346139343732353233663930353664623636303134303633356232313063346566
 30633762653239356131613539396435396235326431633062616436613266353266636133656531
 63346533383764393733396436306136383830313265656539376136343536353737313365333865
 61653665393037346231656663363432666332383837393264656231386435323333376633333265
 39633563653161663531303330393237316132653339653531316538316534353334383161623833
 63656534643833656366623031326132343732663536393636393537383338613462336638626334
 39326264623032393661303335356235343736613964636261633038333236623232613633343263
 34363865306233346433393664363038303464363834313463636363366333313433333930336634
 65396232663031323965343336366339623239386566323362396564333932336134336231646430
 34376236636536626264663532323530656634333137363431313339643164333236303337373639
 31326131636161386665623838303939616337636666346363616465323263373061633832363839
 39343131386333666231643931353330343136363732396465383336303866623733316235646234
 65613531613333653231666234353532313738363266353336303564613061393639323933646339
 64396334396431313563326136656539613535663334323330326566613264393965623065616634
 32313333663535313531343363656230656334346430643365363838656430616366653766333136
 32346137656136666432383934313865613535303962333464316465313464333233646162376165
 37363265316139643332393761663164346537663064346133323661393030393533396633646134
 39383539333364626263323364353764316539323162346434656234393562326133613632633137
 34323537393838393534643861356365376461636235386638376661623439303832643231616431
 32663264306166366336396130326435346432343732323764346232356439633361663937313233
 62636130663238333433396335356331653166366130626632663162653736656238343134353134
 39373663633437626661393734363264313137663138643665353633366663366562386337396561
 38383464333531306138316266626461326531616364303732343337386464366464633834383439
 66303334333234306166396235666164313833333164356561663063326563303934373933313334
 32326466343761333666373936373332663939643662363665323534333638316637666665326564
 63616134623530333739633265343637626561383831663836626538313539653536373165636133
 62396432376332356133336461633664336264616566376664643861363838313766393833343366
 31386636343835663062396232646663363935396366343361633462643734373437666331383035
 30373963323834343138653063313635643062396130373861643134363062363135623730663335
 34373935623239363866393932363966366233643732646461343964383563393064396331353331
 31646662323364376639316562666465356438386637393130616330663563633839326661643239
 62346633353963336239633738336431326638626232313965336361636430323739653734636436
 39316363316137366233616431346639663335393737653562356532363634346237336266333132
 31343836326538653164653163653738656238326366313532613433333337383263646439326661
 65306135363138646665363463636436303864316432663734393130313932643833356161373139
 65376334376136313237393336636630643933373165336432643233306366633663333930396364
 31393739333730326434313639376365356432376338386430363133666436643837633533616333
 36363464633233343130656163353137663165343064373039363439346631393436393430383361
 61353563346531353561303935363531333235313731303237326334363763646131653961613334
 33306534663238343433363237393234643236393931343230656438353866313638636633396464
 61636561333562383964663261316135373235313234613564333333336438646636303561616634
 63363033613238323463646165373361613834353230653138623132303731393436386139663533
 38393263306139303231626363353931646163323364666161653861643739353262313561393165
 6262
--- a/ansible/group_vars/ntp_servers/vars
+++ b/ansible/group_vars/ntp_servers/vars
@@ -0,0 +1,18 @@
 ---
 # file: group_vars/ntp_servers/vars
 #Ansible vars template for NTP servers.
 ntp_servers:
  - 0.us.pool.ntp.org
  - 1.us.pool.ntp.org
 allowed_networks:
  - "192.168.1.0/24"
  - "192.168.2.0/24"
  - "192.168.3.0/24"
  - "192.168.5.0/24"
  - "192.168.9.0/24"
  - "192.168.10.0/24"
  - "192.168.250.0/24"
  - "10.1.71.0/24"
  - "10.1.82.0/24"
--- a/ansible/group_vars/proxmox/oidc.yml
+++ b/ansible/group_vars/proxmox/oidc.yml
@@ -0,0 +1,19 @@
 ---
 # ansible/group_vars/proxmox/oidc.yml
 #
 # Proxmox OIDC configuration for Authentik integration.
 # Client credentials come from vault.yml.
 proxmox_oidc_realm_name: "authentik"
 proxmox_oidc_issuer_url: "https://authentik.local.mk-labs.cloud/application/o/proxmox/"
 proxmox_oidc_username_claim: "username"
 proxmox_oidc_scopes: "openid email profile"
 proxmox_oidc_autocreate: true
 proxmox_oidc_default_realm: false
 proxmox_oidc_comment: "Authentik SSO"
 # ACL entries - grant your Authentik user admin access
 proxmox_oidc_acl_entries:
  - path: "/"
    user: "rblundon@authentik"
    role: "Administrator"
--- a/ansible/group_vars/proxmox/vault
+++ b/ansible/group_vars/proxmox/vault
@@ -0,0 +1,17 @@
 $ANSIBLE_VAULT;1.1;AES256
 64613361376364346139313833613465663361336634326430393261366630306466363935613139
 3634363235343736643230623865386436333734663531310a343965396534336262356234623966
 39353332626662636666383935383530613139626439373664323063633063316264383331646533
 3366333837613731310a656462633638376432326365343135373863313665346566383933353630
 37303565323630633739396433323165326262363863386233343134636236646366633765616432
 33633165613239653762343935386637393437386431383961306436373765343736313634333933
 30376463646464303066613561613564353938306664373464333966383664383034616439343735
 38363966323366343465393530383736393364373361326234356365363163356632393834393464
 39393530356235383830323065636535383138353864373237333164323436623737383435313261
 64366362626232386438376131633533633162356432613835656465623762633464353936303236
 63353633633262633461353963653534663336396134373435303266386162393965343165303335
 65313436666334383965373837376664323861376162373834363439653539383231346634633737
 30626431373739633930313937643938343165383536373465613535366562313439396533643864
 36323032316131333962373732306334373939333363386564653465303261393337333466316130
 32326533353165393635393130396164636363623937313566343333386562616662383038613565
 35386638383365633362
--- a/ansible/host_vars/arcade/vars
+++ b/ansible/host_vars/arcade/vars
@@ -0,0 +1,59 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 proxmox_clone_node: "fantasyland"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu 
 #    - 24.04
 # - Fedora
 #    - 42
 vm_os_distribution: "ubuntu"
 vm_os_version: "24.04"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "large"
 # Proxmox storage target.
 vm_storage: "liberty-tree"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.111
 # vm_mac_address: 'BC:24:11:11:BC:58'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
--- a/ansible/host_vars/astro-orbiter/vars.yml
+++ b/ansible/host_vars/astro-orbiter/vars.yml
@@ -0,0 +1,25 @@
 ---
 # ------------------------------------------------------------------------------
 # FILE: ansible/host_vars/astro_orbiter/vars.yml
 # HOST: astro-orbiter (10.1.71.130)
 # ROLE: Ollama inference host with AMD RX 5700 GPU passthrough
 # ------------------------------------------------------------------------------
 ansible_host: 10.1.71.130
 ansible_user: wed
 ansible_become: true
 # LVM root expansion — xlarge template uses sda3 partition, standard VG/LV names
 common_expand_root_lvm: true
 common_root_pv: /dev/sda3
 common_root_vg: ubuntu-vg
 common_root_lv: ubuntu-lv
 # Ollama — all defaults apply; explicitly documented here for visibility
 ollama_rocm_version: "6.2"
 ollama_default_model: "qwen3:8b"
 ollama_hsa_override_gfx_version: "10.1.0"
 ollama_data_disk: /dev/sdb
 ollama_data_vg: ollama-vg
 ollama_data_lv: ollama-lv
 ollama_data_dir: /var/lib/ollama
--- a/ansible/host_vars/backup/vars
+++ b/ansible/host_vars/backup/vars
@@ -0,0 +1,6 @@
 ---
 # file: host_vars/backup/vars
 # mac_address: "98:b7:85:1e:c6:f1"
 ip_address: "10.1.71.9"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 # primary_interface: "enp1s0f0"
--- a/ansible/host_vars/big-thunder-mountain/old_vars
+++ b/ansible/host_vars/big-thunder-mountain/old_vars
@@ -0,0 +1,58 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 proxmox_clone_node: "fantasyland"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu 
 #    - 24.04
 # - Fedora
 #    - 42
 vm_os_distribution: "ubuntu"
 vm_os_version: "24.04"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "large-plus"
 # Proxmox storage target.
 vm_storage: "general"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.52
 vm_mac_address: 'BC:24:11:11:BC:58'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
--- a/ansible/host_vars/big-thunder-mountain/vars
+++ b/ansible/host_vars/big-thunder-mountain/vars
@@ -0,0 +1,99 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu (clone)
 #    - 24.04
 # - Fedora (clone)
 #    - 42
 # - Talos (create)
 #    - 1.11.5
 vm_os_distribution: "talos"
 vm_os_version: "1.11.5"
 # VM ISO
 # Talos: talos-v1.11.5-nocloud-amd64.iso
 vm_iso_storage: "templates"
 vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 # Comment out for VM create
 proxmox_clone_node: "fantasyland"
 # Proxmox storage target.
 vm_storage: "liberty-tree"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "large-plus"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.52
 vm_mac_address: 'BC:24:11:11:BC:58'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
 # Dictionaries for VM resources
 # - cores (quantity)
 # - memory (MB)
 # - virtual disk (GiB)
 vm_definitions:
  small:
    cores: 2
    memory: 2048
    disk: 8
  medium:
    cores: 2
    memory: 4096
    disk: 16
  large:
    cores: 4
    memory: 4096
    disk: 32
  large-plus:
    cores: 4
    memory: 4096
    disk: 48
  xlarge:
    cores: 4
    memory: 8192
    disk: 64
  xlarge-plus:
    cores: 4
    memory: 8192
    disk: 128
--- a/ansible/host_vars/city-hall/vars
+++ b/ansible/host_vars/city-hall/vars
@@ -0,0 +1,48 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 proxmox_clone_node: "fantasyland"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Fedora (42)
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 vm_clone_source: "fedora-42-small"
 # Proxmox storage target.
 vm_storage: "mk-general"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.21
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
--- a/ansible/host_vars/docker01/vars
+++ b/ansible/host_vars/docker01/vars
@@ -0,0 +1,11 @@
 ---
 # file: host_vars/docker01/vars
 # Networking
 # primary_interface: "enp1s0f0"
 #mac_address: "BC:24:11:03:A9:7B"
 ip_address: 10.1.71.211
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 # Software
 #terraform_version: "1.11.3"
--- a/ansible/host_vars/guest-relations/vars
+++ b/ansible/host_vars/guest-relations/vars
@@ -0,0 +1,12 @@
 ---
 # file: host_vars/guest-relations/vars
 # guest-relations — Guest Relations
 # VM provisioned by Terraform (pre-pipeline bootstrap)
 # ─── Network ─────────────────────────────────────────────────────────────────
 ip_address: 10.1.71.40
 # ─── Application ─────────────────────────────────────────────────────────────
 app_role: identity_provider
 app_name: authentik
 app_deployment: docker_compose
--- a/ansible/host_vars/haunted-mansion/old_vars
+++ b/ansible/host_vars/haunted-mansion/old_vars
@@ -0,0 +1,60 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 proxmox_clone_node: "fantasyland"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu 
 #    - 24.04
 # - Fedora
 #    - 42
 vm_os_distribution: "ubuntu"
 vm_os_version: "24.04"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "xlarge"
 # Proxmox storage target.
 vm_storage: "general"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.61
 vm_mac_address: 'BC:24:11:C9:3A:13'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
--- a/ansible/host_vars/haunted-mansion/vars
+++ b/ansible/host_vars/haunted-mansion/vars
@@ -0,0 +1,99 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu (clone)
 #    - 24.04
 # - Fedora (clone)
 #    - 42
 # - Talos (create)
 #    - 1.11.5
 vm_os_distribution: "talos"
 vm_os_version: "1.11.5"
 # VM ISO
 # Talos: talos-v1.11.5-nocloud-amd64.iso
 vm_iso_storage: "templates"
 vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 # Comment out for VM create
 proxmox_clone_node: "fantasyland"
 # Proxmox storage target.
 vm_storage: "liberty-tree"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "xlarge"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.61
 vm_mac_address: 'BC:24:11:C9:3A:13'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
 # Dictionaries for VM resources
 # - cores (quantity)
 # - memory (MB)
 # - virtual disk (GiB)
 vm_definitions:
  small:
    cores: 2
    memory: 2048
    disk: 8
  medium:
    cores: 2
    memory: 4096
    disk: 16
  large:
    cores: 4
    memory: 4096
    disk: 32
  large-plus:
    cores: 4
    memory: 4096
    disk: 48
  xlarge:
    cores: 4
    memory: 8192
    disk: 64
  xlarge-plus:
    cores: 4
    memory: 8192
    disk: 128
--- a/ansible/host_vars/infra01/vars
+++ b/ansible/host_vars/infra01/vars
@@ -5,7 +5,7 @@
 # primary_interface: "enp1s0f0"
 # mac_address: "98:b7:85:1e:c6:f1"
 #ip_address: 10.1.71.51
-hostname: "infra01.{{ base_domain }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 # Software
 terraform_version: "1.11.3"
--- a/ansible/host_vars/lightning_lane/vars
+++ b/ansible/host_vars/lightning_lane/vars
@@ -0,0 +1,12 @@
 ---
 # file: host_vars/lightning_lane/vars
 # lightning-lane — Traefik Reverse Proxy / Load Balancer
 # VM provisioned by Terraform (pre-pipeline bootstrap)
 # ─── Network ─────────────────────────────────────────────────────────────────
 ip_address: 10.1.71.35
 # ─── Application ─────────────────────────────────────────────────────────────
 app_role: reverse_proxy
 app_name: traefik
 app_deployment: docker_compose
--- a/ansible/host_vars/matchbox/vars
+++ b/ansible/host_vars/matchbox/vars
@@ -0,0 +1,11 @@
 ---
 # file: host_vars/matchbox/vars
 # Networking
 # primary_interface: "enp1s0f0"
 # mac_address: "98:b7:85:1e:c6:f1"
 ip_address: 10.1.71.7
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 # Software
 #terraform_version: "1.11.3"
--- a/ansible/host_vars/n8n/vars
+++ b/ansible/host_vars/n8n/vars
@@ -0,0 +1,11 @@
 ---
 # file: host_vars/matchbox/vars
 # Networking
 # primary_interface: "enp1s0f0"
 mac_address: "BC:24:11:1B:BB:92"
 ip_address: 10.1.71.81
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 # Software
 #terraform_version: "1.11.3"
--- a/ansible/host_vars/peter-pans-flight/old_vars
+++ b/ansible/host_vars/peter-pans-flight/old_vars
@@ -0,0 +1,59 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 proxmox_clone_node: "fantasyland"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu 
 #    - 24.04
 # - Fedora
 #    - 42
 vm_os_distribution: "ubuntu"
 vm_os_version: "24.04"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "xlarge"
 # Proxmox storage target.
 vm_storage: "general"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.62
 vm_mac_address: 'BC:24:11:AA:8F:3A'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
--- a/ansible/host_vars/peter-pans-flight/vars
+++ b/ansible/host_vars/peter-pans-flight/vars
@@ -0,0 +1,99 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu (clone)
 #    - 24.04
 # - Fedora (clone)
 #    - 42
 # - Talos (create)
 #    - 1.11.5
 vm_os_distribution: "talos"
 vm_os_version: "1.11.5"
 # VM ISO
 # Talos: talos-v1.11.5-nocloud-amd64.iso
 vm_iso_storage: "templates"
 vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 # Comment out for VM create
 proxmox_clone_node: "fantasyland"
 # Proxmox storage target.
 vm_storage: "liberty-tree"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "xlarge"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.62
 vm_mac_address: 'BC:24:11:AA:8F:3A'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
 # Dictionaries for VM resources
 # - cores (quantity)
 # - memory (MB)
 # - virtual disk (GiB)
 vm_definitions:
  small:
    cores: 2
    memory: 2048
    disk: 8
  medium:
    cores: 2
    memory: 4096
    disk: 16
  large:
    cores: 4
    memory: 4096
    disk: 32
  large-plus:
    cores: 4
    memory: 4096
    disk: 48
  xlarge:
    cores: 4
    memory: 8192
    disk: 64
  xlarge-plus:
    cores: 4
    memory: 8192
    disk: 128
--- a/ansible/host_vars/pve01/vars
+++ b/ansible/host_vars/pve01/vars
@@ -0,0 +1,7 @@
 ---
 # file: host_vars/pve01/vars
 # mac_address: "98:b7:85:1e:c6:f1"
 #ip_address: "10.1.71.51"
 ip_address: "10.10.21.51"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 # primary_interface: "enp1s0f0"
--- a/ansible/host_vars/pve02/vars
+++ b/ansible/host_vars/pve02/vars
@@ -0,0 +1,7 @@
 ---
 # file: host_vars/pve02/vars
 # mac_address: "98:b7:85:1e:c6:f1"
 #ip_address: "10.1.71.52"
 ip_address: "10.10.21.52"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 # primary_interface: "enp1s0f0"
--- a/ansible/host_vars/pve03/vars
+++ b/ansible/host_vars/pve03/vars
@@ -0,0 +1,7 @@
 ---
 # file: host_vars/pve03/vars
 # mac_address: "98:b7:85:1e:c6:f1"
 #ip_address: "10.1.71.53"
 ip_address: "10.10.21.53"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 # primary_interface: "enp1s0f0"
--- a/ansible/host_vars/space-mountain/old_vars
+++ b/ansible/host_vars/space-mountain/old_vars
@@ -0,0 +1,59 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 proxmox_clone_node: "fantasyland"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu 
 #    - 24.04
 # - Fedora
 #    - 42
 vm_os_distribution: "ubuntu"
 vm_os_version: "24.04"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "large-plus"
 # Proxmox storage target.
 vm_storage: "general"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.51
 vm_mac_address: 'BC:24:11:1A:E8:8C'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
--- a/ansible/host_vars/space-mountain/vars
+++ b/ansible/host_vars/space-mountain/vars
@@ -0,0 +1,99 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu (clone)
 #    - 24.04
 # - Fedora (clone)
 #    - 42
 # - Talos (create)
 #    - 1.11.5
 vm_os_distribution: "talos"
 vm_os_version: "1.11.5"
 # VM ISO
 # Talos: talos-v1.11.5-nocloud-amd64.iso
 vm_iso_storage: "templates"
 vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 # Comment out for VM create
 proxmox_clone_node: "fantasyland"
 # Proxmox storage target.
 vm_storage: "liberty-tree"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "large-plus"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.51
 vm_mac_address: 'BC:24:11:1A:E8:8C'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
 # Dictionaries for VM resources
 # - cores (quantity)
 # - memory (MB)
 # - virtual disk (GiB)
 vm_definitions:
  small:
    cores: 2
    memory: 2048
    disk: 8
  medium:
    cores: 2
    memory: 4096
    disk: 16
  large:
    cores: 4
    memory: 4096
    disk: 32
  large-plus:
    cores: 4
    memory: 4096
    disk: 48
  xlarge:
    cores: 4
    memory: 8192
    disk: 64
  xlarge-plus:
    cores: 4
    memory: 8192
    disk: 128
--- a/ansible/host_vars/splash-mountain/old_vars
+++ b/ansible/host_vars/splash-mountain/old_vars
@@ -0,0 +1,59 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 proxmox_clone_node: "fantasyland"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu 
 #    - 24.04
 # - Fedora
 #    - 42
 vm_os_distribution: "ubuntu"
 vm_os_version: "24.04"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "large-plus"
 # Proxmox storage target.
 vm_storage: "general"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.53
 vm_mac_address: 'BC:24:11:84:D7:2F'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
--- a/ansible/host_vars/splash-mountain/vars
+++ b/ansible/host_vars/splash-mountain/vars
@@ -0,0 +1,99 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu (clone)
 #    - 24.04
 # - Fedora (clone)
 #    - 42
 # - Talos (create)
 #    - 1.11.5
 vm_os_distribution: "talos"
 vm_os_version: "1.11.5"
 # VM ISO
 # Talos: talos-v1.11.5-nocloud-amd64.iso
 vm_iso_storage: "templates"
 vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 # Comment out for VM create
 proxmox_clone_node: "fantasyland"
 # Proxmox storage target.
 vm_storage: "liberty-tree"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "large-plus"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.53
 vm_mac_address: 'BC:24:11:84:D7:2F'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
 # Dictionaries for VM resources
 # - cores (quantity)
 # - memory (MB)
 # - virtual disk (GiB)
 vm_definitions:
  small:
    cores: 2
    memory: 2048
    disk: 8
  medium:
    cores: 2
    memory: 4096
    disk: 16
  large:
    cores: 4
    memory: 4096
    disk: 32
  large-plus:
    cores: 4
    memory: 4096
    disk: 48
  xlarge:
    cores: 4
    memory: 8192
    disk: 64
  xlarge-plus:
    cores: 4
    memory: 8192
    disk: 128
--- a/ansible/host_vars/splash/vars
+++ b/ansible/host_vars/splash/vars
@@ -0,0 +1,100 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts creation via clone or create.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu (clone)
 #    - 24.04
 # - Fedora (clone)
 #    - 42
 # - Talos (create)
 #    - 1.11.5
 vm_os_distribution: "talos"
 vm_os_version: "1.11.5"
 # VM ISO
 # Talos: talos-v1.11.5-nocloud-amd64.iso
 vm_iso_storage: "templates"
 vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 # Comment out for VM create
 proxmox_clone_node: "fantasyland"
 # Proxmox storage target.
 vm_storage: "liberty-tree"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "small"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "tomorrowland"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 # Comment out vm_mac_address if new MAC address should be generated
 ip_address: 10.1.71.99
 vm_mac_address: 'BC:24:11:97:C3:AA'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
 # Dictionaries for VM resources
 # - cores (quantity)
 # - memory (MB)
 # - virtual disk (GiB)
 vm_definitions:
  small:
    cores: 2
    memory: 2048
    disk: 8
  medium:
    cores: 2
    memory: 4096
    disk: 16
  large:
    cores: 4
    memory: 4096
    disk: 32
  large-plus:
    cores: 4
    memory: 4096
    disk: 48
  xlarge:
    cores: 4
    memory: 8192
    disk: 64
  xlarge-plus:
    cores: 4
    memory: 8192
    disk: 128
--- a/ansible/host_vars/sql01/vars
+++ b/ansible/host_vars/sql01/vars
@@ -0,0 +1,11 @@
 ---
 # file: host_vars/matchbox/vars
 # Networking
 # primary_interface: "enp1s0f0"
 mac_address: "BC:24:11:1C:95:1B"
 ip_address: 10.1.71.91
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 # Software
 #terraform_version: "1.11.3"
--- a/ansible/host_vars/sundial/vars
+++ b/ansible/host_vars/sundial/vars
@@ -0,0 +1,50 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 proxmox_clone_node: "fantasyland"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Fedora (42)
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_clone_source: "fedora-42-small"
 # Proxmox storage target.
 vm_storage: "general"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "fantasyland"
 proxmox_host_target: "fantasyland"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.21
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
--- a/ansible/host_vars/tiki-room/vars
+++ b/ansible/host_vars/tiki-room/vars
@@ -0,0 +1,59 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts created via cloning.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 proxmox_clone_node: "fantasyland"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu 
 #    - 24.04
 # - Fedora
 #    - 42
 vm_os_distribution: "ubuntu"
 vm_os_version: "24.04"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "large"
 # Proxmox storage target.
 vm_storage: "general"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "pve03"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 ip_address: 10.1.71.23
 # vm_mac_address: 'BC:24:11:11:BC:58'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
--- a/ansible/host_vars/turnstile/vars
+++ b/ansible/host_vars/turnstile/vars
@@ -0,0 +1,27 @@
 ---
 # file: host_vars/turnstile/vars
 # turnstile — Smallstep step-ca SSH Certificate Authority
 # VM provisioned by Terraform (pre-pipeline bootstrap)
 # ─── Network ─────────────────────────────────────────────────────────────────
 ip_address: 10.1.71.34
 # ─── Application ─────────────────────────────────────────────────────────────
 app_role: ssh_certificate_authority
 app_name: step-ca
 app_deployment: docker_compose
 # ─── step-ca Configuration ───────────────────────────────────────────────────
 stepca_hostname: turnstile.local.mk-labs.cloud
 stepca_dns_names: "turnstile.local.mk-labs.cloud,10.1.71.34"
 stepca_ssh_enabled: true
 stepca_listen_port: 9000
 # ─── OIDC Provisioner (Authentik) ────────────────────────────────────────────
 # Client ID and secret stored in vault
 stepca_oidc_provisioner_name: authentik
 stepca_oidc_configuration_endpoint: "https://authentik.local.mk-labs.cloud/application/o/step-ca/.well-known/openid-configuration"
 stepca_oidc_listen_address: ":10000"
 stepca_oidc_domains:
  - "local.mk-labs.cloud"
  - "protonmail.com"
--- a/ansible/host_vars/turnstile/vault
+++ b/ansible/host_vars/turnstile/vault
@@ -0,0 +1,17 @@
 $ANSIBLE_VAULT;1.1;AES256
 30383930323363386234333433636465393263613336646464666365643730386430353864616334
 3865343031653162313736656437373666636136653263360a613961646133376262633164393535
 31363434633634303035663133316230633538363936303266373931313661346563333832653032
 6239376363646530620a303231363333363233623038326165316463383662656565626534396232
 62333133623530643932643430663166373930353733363866336533643233373261333130613635
 31633337376337663833613634666436383862386431636537373363343333323932363761653366
 61353166613162346436396138316561646165303566376366323462663861616364336539313138
 30386430373566353761383636626335393463376661356666303861353564313832346333396134
 30653861363866336331336164323130623230666237356165613934333239386536373664643065
 33643139346562346663313533643433353462363665323166313364373335366665373435643935
 65303863663864393238393732303065343364306264396333376233666233346664323334336532
 38373164383835663163363137643531303163396236623565666436363261393563343133333161
 36663934303633663062346161636333396135336135616136303664636562363862353764343562
 39643430396636313139336130656363306562363430346233313530663963366238326334623135
 62383632613061316262323038303333323739303137363334626637666663666263613132336433
 65346266393733633632
--- a/ansible/host_vars/vm_template/vars
+++ b/ansible/host_vars/vm_template/vars
@@ -0,0 +1,104 @@
 ---
 # file: host_vars/vm_template/vars
 # Ansible vars template for hosts creation via clone or create.
 # Supported hypervisors:
 # - Proxmox
 platform: "proxmox"
 # Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
 # Current OS offerings are:
 # - Ubuntu (clone)
 #    - 24.04
 # - Fedora (clone)
 #    - 42
 # - Talos (create)
 #    - 1.11.5
 vm_os_distribution: "ubuntu"
 vm_os_version: "24.04"
 # VM ISO
 # Talos: talos-v1.11.5-nocloud-amd64.iso
 vm_iso_storage: "templates"
 vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
 # This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
 # Comment out for VM create
 proxmox_clone_node: "fantasyland"
 # Proxmox storage target.
 vm_storage: "general"
 # Current VM sizes are:
 # - Small: 2 cores, 2GB memory, 8 GiB virtual disk
 # - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
 # - Large: 4 cores, 4GB memory, 32 GiB virtual disk
 # - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
 # - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
 # - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
 vm_size: "large-plus"
 # Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
 # and backup groups. (ha_group will be factored out in the next functionality update.)
 ha_group: "pve03"
 proxmox_host_target: "tomorrowland"
 # Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
 # sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
 # Comment out vm_mac_address if new MAC address should be generated
 ip_address: 10.1.71.249
 # vm_mac_address: 'BC:24:11:11:BC:58'
 # Software
 # Future enhancement will allow specification of additional software to automatically deploy to
 # the VM after creation.
 #terraform_version: "1.11.3"
 # ---
 vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
 hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
 # Dictionaries for VM resources
 # - cores (quantity)
 # - memory (MB)
 # - virtual disk (GiB)
 small:
  cores: 2
  memory: 2048
  disk: 8
 medium:
  cores: 2
  memory: 4096
  disk: 16
 large:
  cores: 4
  memory: 4096
  disk: 32
 large-plus:
  cores: 4
  memory: 4096
  disk: 48
 xlarge:
  cores: 4
  memory: 8192
  disk: 64
 xlarge-plus:
  cores: 4
  memory: 8192
  disk: 128
--- a/ansible/inventory.yml
+++ b/ansible/inventory.yml
@@ -0,0 +1,99 @@
 # file: inventory.yml
 proxmox:
  hosts:
    main-street-usa:
      ansible_host: 10.1.71.11
      ansible_user: wed
      ansible_become: true
    tomorrowland:
    fantasyland:
 magic_kingdom:
  hosts:
    main-street-usa:
    tomorrowland:
    fantasyland:
 dns_server:
  hosts:
    monorail:
 ntp_servers:
  hosts:
    sundial:
 load_balancers:
  hosts:
    lightning-lane:
      ansible_become: true
 step_ca_server:
  hosts:
    turnstile:
      ansible_become: true
 authentik_server:
  hosts:
    guest-relations:
      ansible_become: true
 gitea_servers:
  hosts:
    mad-tea-party:
      ansible_user: wed
      ansible_become: true
 nextcloud_server:
  hosts:
    the-grid:
      ansible_become: true
 semaphore_server:
  hosts:
    imagineering:
      ansible_host: 10.1.71.37
      ansible_become: true
 n8n_server:
  hosts:
    tiki-room:
 ollama_server:
  hosts:
    astro-orbiter:
      ansible_host: 10.1.71.130
      ansible_user: wed
      ansible_become: true
 papermc_server:
 # ansible-galaxy role install engonzal.papermc
  hosts:
    arcade:
 dev_servers:
  hosts:
    scrim:
 # dhcp_server:
 #   hosts:
 #     matchbox:
 backup_servers:
  hosts:
    timekeeper:
 talos_control:
  hosts:
    city-hall:
      ansible_become: true
  vars:
    talosctl_version: "v1.12.4"
    talos_cluster_name: "fastpass"
 # matchbox_server:
 #   hosts:
 #     matchbox:
 terraform_server:
  hosts:
    infra01:
--- a/00-core-infra/ansible/lightspeed.yml
+++ b/00-core-infra/ansible/lightspeed.yml
--- a/ansible/mk
+++ b/ansible/mk
@@ -0,0 +1,5 @@
 space-mountain
 splash-mountain
 big-thunder-mountain
 peter-pans-flight
 haunted-mansion
--- a/ansible/playbooks/add_dhcp_reservation.yml
+++ b/ansible/playbooks/add_dhcp_reservation.yml
@@ -0,0 +1,84 @@
 ---
 - name: Bind VM MAC address to IP address on Ubiquiti
  hosts: all
  gather_facts: false
  tasks:
    - name: Set VM MAC address (if defined in vars)
      delegate_to: "localhost"
      community.proxmox.proxmox_kvm:
        api_user: "{{ proxmox_user }}"
        api_password: "{{ proxmox_password }}"
        api_host: "{{ proxmox_host }}"
        node: "{{ proxmox_clone_node }}"
        vmid: "{{ vm_id }}"
        net:
          net0: "virtio={{ vm_mac_address }},bridge=vmbr0,firewall=1"
        update: true
        update_unsafe: true
      when: vm_mac_address is defined
    - name: Get VM MAC address from Proxmox (not defined in vars)
      when: vm_mac_address is not defined
      block:
        - name: Retrieve information about specific VM by name and get current configuration
          delegate_to: "localhost"
          community.proxmox.proxmox_vm_info:
            api_user: "{{ proxmox_user }}"
            api_password: "{{ proxmox_password }}"
            api_host: "{{ proxmox_host }}"
            name: "{{ inventory_hostname }}"
            config: current
          register: proxmox_vm_info
        - name: Extract net0 information
          ansible.builtin.set_fact:
            vm_net0: "{{ proxmox_vm_info.proxmox_vms[0].config.net0 }}"
        - name: Extract MAC address using regex
          ansible.builtin.set_fact:
            vm_mac_address: "{{ vm_net0 | regex_search('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}') }}"
    - name: Assign VM MAC address to IP address on Ubiquiti with Terraform
      when: vm_mac_address is defined
      delegate_to: "{{ groups['terraform_server'][0] }}"
      block:
        - name: Create a directory if it does not exist
          ansible.builtin.file:
            path: "~/homelab/terraform/unifi-dhcp"
            state: directory
            mode: '0755'
        - name: Create Unifi provider file from template
          ansible.builtin.template:
            src: templates/unifi_provider.tf.j2
            dest: ~/homelab/terraform/unifi-dhcp/provider.tf
            mode: '0644'
        - name: Create Unifi user (host) file from template
          ansible.builtin.template:
            src: templates/unifi-user.tf.j2
            dest: ~/homelab/terraform/unifi-dhcp/{{ inventory_hostname }}.tf
            mode: '0644'
        - name: Configure Unifi via Terraform
          community.general.terraform:
            project_path: ~/homelab/terraform/unifi-dhcp
            state: present
            force_init: true
    # - name: Add line to hosts file
    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
    #   become: true
    #   ansible.builtin.lineinfile:
    #     path: /etc/dnsmasq.d/hosts.conf
    #     regexp: "# {{ inventory_hostname }}$"
    #     line: "dhcp-host={{ vm_mac_address | lower }},{{ ip_address }} # {{ inventory_hostname }}"
    #     state: present
    # # restart dnsmasq service
    # - name: Restart service dnsmasq
    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
    #   become: true
    #   ansible.builtin.service:
    #     name: dnsmasq
    #     state: restarted
--- a/ansible/playbooks/add_dns_entry.yml
+++ b/ansible/playbooks/add_dns_entry.yml
@@ -0,0 +1,13 @@
 ---
 # Replacement for add_technitium_dns_entry.yml
 # This playbook uses the modular task file approach
 - name: Add DNS entry using Technitium DNS
  hosts: all
  gather_facts: false
  tasks:
    - name: Include Technitium DNS entry task
      ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
      vars:
        host_name: "{{ inventory_hostname }}"
--- a/ansible/playbooks/add_service_route.yml
+++ b/ansible/playbooks/add_service_route.yml
@@ -0,0 +1,90 @@
 ---
 # ------------------------------------------------------------------------------
 # FILE: playbooks/add_service_route.yml
 # DESCRIPTION: Ensures all services in the Traefik dynamic config directory
 #              are routed and have DNS CNAME records on monorail.
 #
 #              1. Syncs boilerplates/traefik/dynamic/ to lightning-lane
 #              2. Scans the directory for service configs
 #              3. Creates CNAME records for each service -> lightning-lane
 #
 # PREREQUISITES:
 #   - Service dynamic config YAML committed to boilerplates/traefik/dynamic/
 #   - vault_technitium_api_key defined in group_vars/all/vault
 #
 # USAGE:
 #   ansible-playbook -i inventory.yml playbooks/add_service_route.yml
 #
 # ADDING A NEW SERVICE:
 #   1. Create boilerplates/traefik/dynamic/<service>.yml
 #   2. Commit and push
 #   3. Run this playbook
 #
 # EXCLUDING FILES:
 #   Files that are not service routes (e.g., default.yml for middleware
 #   definitions) should be added to the exclude_configs list below.
 # ------------------------------------------------------------------------------
 - name: Sync Traefik routes and ensure DNS records
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    base_domain: "local.mk-labs.cloud"
    dns_server: "monorail"
    traefik_host: "10.1.71.35"
    traefik_user: "wed"
    traefik_dynamic_path: "/opt/docker/traefik/dynamic/"
    dynamic_config_dir: "{{ playbook_dir }}/../../boilerplates/traefik/dynamic"
    # Files in the dynamic directory that are NOT service routes
    # (middleware definitions, TLS options, etc.)
    exclude_configs:
      - default.yml
  tasks:
    # ── Step 1: Sync dynamic config to lightning-lane ──
    - name: Sync Traefik dynamic configuration to lightning-lane
      ansible.builtin.shell: >
        rsync -av --delete
        {{ dynamic_config_dir }}/
        {{ traefik_user }}@{{ traefik_host }}:{{ traefik_dynamic_path }}
      register: sync_result
      changed_when: "'sending incremental file list' in sync_result.stdout"
    # ── Step 2: Discover service configs ──
    - name: Find all dynamic config files
      ansible.builtin.find:
        paths: "{{ dynamic_config_dir }}"
        patterns: "*.yml"
      register: config_files
    - name: Build service list from config filenames
      ansible.builtin.set_fact:
        service_names: >-
          {{ config_files.files
             | map(attribute='path')
             | map('basename')
             | reject('in', exclude_configs)
             | map('regex_replace', '\.yml$', '')
             | list }}
    - name: Display services to route
      ansible.builtin.debug:
        msg: "Services found: {{ service_names }}"
    # ── Step 3: Create DNS CNAME records ──
    - name: Create DNS CNAME record for each service
      effectivelywild.technitium_dns.technitium_dns_add_record:
        api_url: "http://{{ dns_server }}.{{ base_domain }}"
        api_token: "{{ vault_technitium_api_key }}"
        zone: "{{ base_domain }}"
        name: "{{ item }}.{{ base_domain }}"
        type: "CNAME"
        cname: "lightning-lane.{{ base_domain }}"
        ttl: 360
        validate_certs: false
      loop: "{{ service_names }}"
      loop_control:
        label: "{{ item }}.{{ base_domain }}"
--- a/ansible/playbooks/add_technitium_dns_entry.yml.backup
+++ b/ansible/playbooks/add_technitium_dns_entry.yml.backup
@@ -0,0 +1,18 @@
 ---
 - name: Add entry to Technitium DNS
  hosts: all
  gather_facts: false
  tasks:
    - name: "Create DNS entry for {{ inventory_hostname }}"
      delegate_to: localhost
      effectivelywild.technitium_dns.technitium_dns_add_record:
        api_url: "http://{{ dns_server }}.{{ base_domain }}"
        api_token: "{{ vault_technitium_api_key }}"
        zone: "{{ base_domain }}"
        name: "{{ inventory_hostname }}.{{ base_domain }}"
        type: "A"
        ipAddress: "{{ ip_address }}"
        ptr: true
        ttl: 360
 #        validate_certs: false
--- a/ansible/playbooks/configure_proxmox_oidc.yml
+++ b/ansible/playbooks/configure_proxmox_oidc.yml
@@ -0,0 +1,20 @@
 ---
 # ansible/playbooks/configure_proxmox_oidc.yml
 #
 # Configures Proxmox OIDC authentication with Authentik.
 # Only targets one node since realm config is cluster-wide.
 #
 # Usage:
 #   cd ansible
 #   ansible-playbook -i inventory.yml playbooks/configure_proxmox_oidc.yml
 #
 # To also set up ACL entries for your user:
 #   ansible-playbook -i inventory.yml playbooks/configure_proxmox_oidc.yml \
 #     -e '{"proxmox_oidc_acl_entries": [{"path": "/", "user": "rblundon@authentik", "role": "Administrator"}]}'
 - name: Configure Proxmox Authentik OIDC
  hosts: main-street-usa
  become: true
  roles:
    - role: proxmox
      tags: [proxmox-oidc]
--- a/ansible/playbooks/configure_unbound.yml
+++ b/ansible/playbooks/configure_unbound.yml
@@ -0,0 +1,37 @@
 ---
 - name: Master playbook to install and configure unbound
  hosts: unbound_servers
  become: true
  tasks:
    - name: Permit traffic in default zone for dns service
      ansible.posix.firewalld:
        service: dns
        permanent: true
        immediate: true
        state: enabled
    - name: Create the directory
      ansible.builtin.file:
        path: /etc/systemd/resolved.conf.d
        state: directory
        mode: '0755'
        owner: root
        group: root
    - name: Put `unbound.conf` in the correct place
      ansible.builtin.copy:
        src: ../roles/common/files/unbound.conf
        dest: /etc/systemd/resolved.conf.d/unbound.conf
        mode: '0644'
        owner: root
        group: root
    - name: Restart service systemd-resolved
      ansible.builtin.service:
        name: systemd-resolved
        state: restarted
    - name: Install unbound via role
      ansible.builtin.import_role:
        name: Anthony25.unbound
--- a/ansible/playbooks/create_vm.yml
+++ b/ansible/playbooks/create_vm.yml
@@ -0,0 +1,23 @@
 ---
 - name: Master playbook to create VM
  hosts: all
  gather_facts: false
 - name: Proxmox Create VM Playbook
  ansible.builtin.import_playbook: proxmox_create_vm.yml
 - name: Set cloud-init network
  ansible.builtin.import_playbook: populate_cloud_init.yml
  when: vm_os_distribution == "ubuntu"
 - name: DNS Playbook
  ansible.builtin.import_playbook: add_dns_entry.yml
 - name: DHCP Playbook
  ansible.builtin.import_playbook: add_dhcp_reservation.yml
 - name: Start VM Playbook
  ansible.builtin.import_playbook: proxmox_start_vm.yml
 - name: Set Hostname Playbook
  ansible.builtin.import_playbook: set_hostname.yml
--- a/ansible/playbooks/create_vm_from_clone.yml
+++ b/ansible/playbooks/create_vm_from_clone.yml
@@ -0,0 +1,23 @@
 ---
 - name: Master playbook to create VM from a template
  hosts: all
  gather_facts: false
 - name: Proxmox Clone VM Playbook
  ansible.builtin.import_playbook: proxmox_clone_vm.yml
 - name: Set cloud-init network
  ansible.builtin.import_playbook: populate_cloud_init.yml
  when: vm_os_distribution == "ubuntu"
 - name: DNS Playbook
  ansible.builtin.import_playbook: add_dns_entry.yml
 - name: DHCP Playbook
  ansible.builtin.import_playbook: add_dhcp_reservation.yml
 - name: Start VM Playbook
  ansible.builtin.import_playbook: proxmox_start_vm.yml
 - name: Set Hostname Playbook
  ansible.builtin.import_playbook: set_hostname.yml
--- a/ansible/playbooks/day0_baseline.yml
+++ b/ansible/playbooks/day0_baseline.yml
@@ -0,0 +1,6 @@
 ---
 - name: Apply common role
  hosts: "{{ target | default('all') }}"
  become: true
  roles:
    - common
--- a/ansible/playbooks/day1_configure_netbox_catalog.yml
+++ b/ansible/playbooks/day1_configure_netbox_catalog.yml
@@ -0,0 +1,400 @@
 ---
 # ansible/playbooks/day1_configure_netbox_catalog.yml
 #
 # Creates the tag taxonomy and custom fields in NetBox for service catalog
 # documentation. Run once (idempotent — uses name-based checks).
 #
 # Usage (from ansible/ directory):
 #   ansible-playbook playbooks/day1_configure_netbox_catalog.yml
 #
 # Requires:
 #   - vault_netbox_token in Ansible Vault
 #   - netbox reachable at http://fire-station.local.mk-labs.cloud
 - name: Configure NetBox service catalog taxonomy
  hosts: localhost
  gather_facts: false
  vars_files:
    - "{{ playbook_dir }}/../group_vars/all/vault"
  vars:
    netbox_url: "http://fire-station.local.mk-labs.cloud"
    netbox_token: "{{ vault_netbox_token }}"
    netbox_api: "{{ netbox_url }}/api"
    headers:
      Authorization: "Token {{ netbox_token }}"
      Content-Type: "application/json"
      Accept: "application/json"
    # ── Tag definitions ───────────────────────────────────────────────────
    tags:
      # Infrastructure type
      - name: k8s
        slug: k8s
        color: "2196f3"   # blue
        description: "Workload running in the fastpass Kubernetes cluster"
      - name: vm
        slug: vm
        color: "4caf50"   # green
        description: "Traditional VM or LXC on Proxmox"
      # Service tier
      - name: platform
        slug: platform
        color: "9c27b0"   # purple
        description: "Platform/infrastructure service (not user-facing)"
      - name: application
        slug: application
        color: "ff9800"   # orange
        description: "User-facing application workload"
      # Service categories
      - name: monitoring
        slug: monitoring
        color: "607d8b"   # grey
        description: "Metrics, logging, alerting"
      - name: auth
        slug: auth
        color: "607d8b"
        description: "Authentication and SSO"
      - name: gitops
        slug: gitops
        color: "607d8b"
        description: "GitOps and CI/CD"
      - name: dashboard
        slug: dashboard
        color: "607d8b"
        description: "Dashboard and portal services"
      - name: storage
        slug: storage
        color: "607d8b"
        description: "Storage and file services"
      - name: dns
        slug: dns
        color: "607d8b"
        description: "DNS and name resolution"
      - name: automation
        slug: automation
        color: "607d8b"
        description: "Automation and orchestration"
      - name: networking
        slug: networking
        color: "607d8b"
        description: "Network infrastructure services"
      - name: inference
        slug: inference
        color: "607d8b"
        description: "AI/ML inference workloads"
    # ── Custom field definitions ──────────────────────────────────────────
    # object_types use app_label.model format
    custom_fields:
      - name: hostnames
        label: Hostnames
        type: longtext
        object_types:
          - ipam.ipaddress
          - virtualization.virtualmachine
        description: "All DNS names that resolve to this service (comma-separated)"
        ui_visible: always
        ui_editable: yes
      - name: namespace
        label: Namespace
        type: text
        object_types:
          - ipam.ipaddress
          - virtualization.virtualmachine
        description: "Kubernetes namespace (blank for VM-based services)"
        ui_visible: always
        ui_editable: yes
      - name: managed_by
        label: Managed By
        type: select
        object_types:
          - ipam.ipaddress
          - virtualization.virtualmachine
        description: "How this service is managed"
        choices:
          - ArgoCD
          - Ansible
          - Manual
        ui_visible: always
        ui_editable: yes
      - name: thematic_name
        label: Thematic Name
        type: text
        object_types:
          - ipam.ipaddress
          - virtualization.virtualmachine
        description: "Disney/Magic Kingdom thematic hostname for this service"
        ui_visible: always
        ui_editable: yes
  tasks:
    # ── Tags ─────────────────────────────────────────────────────────────
    - name: Fetch existing tags
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/tags/?limit=200"
        method: GET
        headers: "{{ headers }}"
        return_content: true
        status_code: 200
      register: existing_tags_response
    - name: Set existing tag slugs fact
      ansible.builtin.set_fact:
        existing_tag_slugs: "{{ existing_tags_response.json.results | map(attribute='slug') | list }}"
    - name: Create tags
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/tags/"
        method: POST
        headers: "{{ headers }}"
        body_format: json
        body:
          name: "{{ item.name }}"
          slug: "{{ item.slug }}"
          color: "{{ item.color }}"
          description: "{{ item.description }}"
        status_code: 201
      loop: "{{ tags }}"
      when: item.slug not in existing_tag_slugs
      register: tag_creation
      changed_when: tag_creation.status == 201
    # ── Custom Fields ─────────────────────────────────────────────────────
    - name: Fetch existing custom fields
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-fields/?limit=200"
        method: GET
        headers: "{{ headers }}"
        return_content: true
        status_code: 200
      register: existing_cf_response
    - name: Set existing custom field names fact
      ansible.builtin.set_fact:
        existing_cf_names: "{{ existing_cf_response.json.results | map(attribute='name') | list }}"
    - name: Create custom field — hostnames
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-fields/"
        method: POST
        headers: "{{ headers }}"
        body_format: json
        body:
          name: hostnames
          label: Hostnames
          type: longtext
          object_types: "{{ custom_fields[0].object_types }}"
          description: "{{ custom_fields[0].description }}"
          ui_visible: always
          ui_editable: yes
        status_code: 201
      when: "'hostnames' not in existing_cf_names"
      register: cf_hostnames
      changed_when: cf_hostnames.status == 201
    - name: Create custom field — namespace
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-fields/"
        method: POST
        headers: "{{ headers }}"
        body_format: json
        body:
          name: namespace
          label: Namespace
          type: text
          object_types: "{{ custom_fields[1].object_types }}"
          description: "{{ custom_fields[1].description }}"
          ui_visible: always
          ui_editable: yes
        status_code: 201
      when: "'namespace' not in existing_cf_names"
      register: cf_namespace
      changed_when: cf_namespace.status == 201
    - name: Create choice set for managed_by field
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-field-choice-sets/"
        method: POST
        headers: "{{ headers }}"
        body_format: json
        body:
          name: managed-by-choices
          extra_choices:
            - - ArgoCD
              - ArgoCD
            - - Ansible
              - Ansible
            - - Manual
              - Manual
        status_code: [201, 400]
      register: choice_set
      changed_when: choice_set.status == 201
    - name: Fetch choice set ID
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-field-choice-sets/?name=managed-by-choices"
        method: GET
        headers: "{{ headers }}"
        return_content: true
        status_code: 200
      register: choice_set_response
    - name: Create custom field — managed_by
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-fields/"
        method: POST
        headers: "{{ headers }}"
        body_format: json
        body:
          name: managed_by
          label: Managed By
          type: select
          object_types: "{{ custom_fields[2].object_types }}"
          description: "{{ custom_fields[2].description }}"
          choice_set: "{{ choice_set_response.json.results[0].id }}"
          ui_visible: always
          ui_editable: yes
        status_code: 201
      when: "'managed_by' not in existing_cf_names"
      register: cf_managed_by
      changed_when: cf_managed_by.status == 201
    - name: Create custom field — thematic_name
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-fields/"
        method: POST
        headers: "{{ headers }}"
        body_format: json
        body:
          name: thematic_name
          label: Thematic Name
          type: text
          object_types: "{{ custom_fields[3].object_types }}"
          description: "{{ custom_fields[3].description }}"
          ui_visible: always
          ui_editable: yes
        status_code: 201
      when: "'thematic_name' not in existing_cf_names"
      register: cf_thematic_name
      changed_when: cf_thematic_name.status == 201
    # ── Provisioning Pipeline Fields ──────────────────────────────────────
    # These fields drive the NetBox → n8n → Terraform pipeline.
    # proxmox_datastore already exists — PATCH it to add utilidor choice.
    # data_disk_enabled and data_disk_size_gb are new POSTs.
    - name: Fetch proxmox_datastore field ID
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-fields/?name=proxmox_datastore"
        method: GET
        headers: "{{ headers }}"
        return_content: true
        status_code: 200
      register: proxmox_datastore_cf_response
    - name: Fetch proxmox-datastore-choices choice set ID
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-field-choice-sets/?name=proxmox-datastore-choices"
        method: GET
        headers: "{{ headers }}"
        return_content: true
        status_code: 200
      register: datastore_choice_set_response
    - name: Create proxmox-datastore-choices choice set if missing
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-field-choice-sets/"
        method: POST
        headers: "{{ headers }}"
        body_format: json
        body:
          name: proxmox-datastore-choices
          extra_choices:
            - - liberty-tree
              - liberty-tree
            - - utilidor
              - utilidor
        status_code: [201, 400]
      register: datastore_choice_set_create
      changed_when: datastore_choice_set_create.status == 201
      when: datastore_choice_set_response.json.count == 0
    - name: Re-fetch proxmox-datastore-choices choice set ID after possible creation
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-field-choice-sets/?name=proxmox-datastore-choices"
        method: GET
        headers: "{{ headers }}"
        return_content: true
        status_code: 200
      register: datastore_choice_set_response
    - name: Patch proxmox_datastore field to use choice set with utilidor
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-fields/{{ proxmox_datastore_cf_response.json.results[0].id }}/"
        method: PATCH
        headers: "{{ headers }}"
        body_format: json
        body:
          choice_set: "{{ datastore_choice_set_response.json.results[0].id }}"
        status_code: 200
      when: proxmox_datastore_cf_response.json.count > 0
      register: cf_datastore_patch
      changed_when: cf_datastore_patch.status == 200
    - name: Create custom field — data_disk_enabled
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-fields/"
        method: POST
        headers: "{{ headers }}"
        body_format: json
        body:
          name: data_disk_enabled
          label: Data Disk Enabled
          type: boolean
          object_types:
            - virtualization.virtualmachine
          description: "When true, Terraform provisions a second disk for application data storage."
          default: false
          ui_visible: always
          ui_editable: yes
        status_code: 201
      when: "'data_disk_enabled' not in existing_cf_names"
      register: cf_data_disk_enabled
      changed_when: cf_data_disk_enabled.status == 201
    - name: Create custom field — data_disk_size_gb
      ansible.builtin.uri:
        url: "{{ netbox_api }}/extras/custom-fields/"
        method: POST
        headers: "{{ headers }}"
        body_format: json
        body:
          name: data_disk_size_gb
          label: Data Disk Size (GB)
          type: integer
          object_types:
            - virtualization.virtualmachine
          description: "Size in GB for the optional second data disk. Only used when data_disk_enabled is true."
          ui_visible: always
          ui_editable: yes
        status_code: 201
      when: "'data_disk_size_gb' not in existing_cf_names"
      register: cf_data_disk_size
      changed_when: cf_data_disk_size.status == 201
    # ── Summary ───────────────────────────────────────────────────────────
    - name: Summary
      ansible.builtin.debug:
        msg:
          - "Tags created: {{ tag_creation.results | selectattr('status', 'equalto', 201) | list | length }}"
          - "Tags skipped (already exist): {{ tag_creation.results | selectattr('skipped', 'defined') | list | length }}"
          - "Custom fields configured: hostnames, namespace, managed_by, thematic_name, proxmox_datastore (patched), data_disk_enabled, data_disk_size_gb"
--- a/ansible/playbooks/day1_deploy_authentik.yml
+++ b/ansible/playbooks/day1_deploy_authentik.yml
@@ -0,0 +1,18 @@
 ---
 # ------------------------------------------------------------------------------
 # FILE: playbooks/deploy_authentik.yml
 # DESCRIPTION: Deploys Authentik identity provider on guest-relations.
 #              Installs Docker and configures Authentik with PostgreSQL and Redis.
 #
 # USAGE:
 #   ansible-playbook -i inventory.yml playbooks/deploy_authentik.yml
 # ------------------------------------------------------------------------------
 - name: Deploy Authentik identity provider
  hosts: authentik_server
  become: true
  roles:
    - common
    - docker-host
    - authentik
--- a/ansible/playbooks/day1_deploy_gitea.yml
+++ b/ansible/playbooks/day1_deploy_gitea.yml
@@ -0,0 +1,23 @@
 ---
 # ------------------------------------------------------------------------------
 # FILE: ansible/playbooks/day1_deploy_gitea.yml
 # DESCRIPTION: Deploys Gitea + PostgreSQL on mad-tea-party (10.1.71.129)
 #              Role chain: common → docker-host → gitea
 #
 # USAGE:
 #   ansible-playbook -i ansible/inventory.yml ansible/playbooks/day1_deploy_gitea.yml
 #
 # SECRETS REQUIRED IN VAULT (group_vars/all/vault):
 #   vault_gitea_db_password
 # ------------------------------------------------------------------------------
 - name: Deploy Gitea on mad-tea-party
  hosts: gitea_servers
  become: true
  vars:
    gitea_db_password: "{{ vault_gitea_db_password }}"
  roles:
    - role: docker-host
    - role: gitea
--- a/Show More
+++ b/Show More
		`@@ -1,2 +0,0 @@`
			`---`
			`hostname: unbound01.int.mk-labs.cloud`
		`@@ -1,2 +0,0 @@`
			`---`
			`hostname: unbound02.int.mk-labs.cloud`
		`@@ -1,3 +0,0 @@`
			`# DNS Provider Configuration`

			`This directory contains the configuration to updateFreeIPA DNS for the Hub Cluster.`