jmri: remove one-shot xpra migration task (idempotency fix)

Migration from Ubuntu 3.x to upstream 6.x is complete. The explicit
removal task was firing changed on every run. state: latest on the
install task handles upgrades going forward.

.gitignore

@@ -1,15 +1,9 @@
-# macOS system files
+# macOS
 .DS_Store
 .AppleDouble
 .LSOverride
-
-# Icon must end with two \r
 Icon
-
-# Thumbnails
 ._*
-
-# Files that might appear in the root of a volume
 .DocumentRevisions-V100
 .fseventsd
 .Spotlight-V100
@@ -17,36 +11,53 @@ Icon
 .Trashes
 .VolumeIcon.icns
 .com.apple.timemachine.donotpresent
-
-# Directories potentially created on remote AFP share
 .AppleDB
 .AppleDesktop
 Network Trash Folder
 Temporary Items
 .apdisk
-
-# VS Code
-.vscode/
-
-# macOS metadata
 *.icloud
 
-# Terraform
-terraform/
+# IDE
+.vscode/
+.idea/
+.kiro/
+
+# Terraform (track .tf files, ignore state and runtime)
 .terraform/
 *.tfstate
 *.tfstate.backup
-
-# Crash log files
+# *.tfvars
+!*.tfvars.example
+!*.pkrvars.hcl
 crash.log
-
-# Ignore override files as they are usually used to override resources locally
 *.override.tf
 *.override.tf.json
-
-# Ignore CLI configuration files
 .terraformrc
-.terraformrc.json
+terraform.rc
 
-# Ignore secrets
-doppler-token.yaml
+# Ansible
+*.retry
+ansible/vault/*.vault
+
+# Packer
+packer_cache/
+
+# Secrets
+*.pem
+*.key
+
+# Environment files with secrets
+boilerplates/**/.env
+
+# Local paths
+~/
+
+# Misc
+doppler-token.yaml
+
+# talhelper generated machine configs — contain secrets, never commit
+talos/talhelper/clusterconfig/
+# talenv.yaml plaintext — only commit the SOPS-encrypted version
+talos/talhelper/talenv.yaml
+!talos/talhelper/talenv.sops.yaml

.sops.yaml

@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: talos/talhelper/talenv.yaml
+    age: age1xkyuv8r8ce6lu3d64jfspz4e50k6pxlaxwmuplzrtnpfnnrnycaq6mfsrn

COUCHDB-ERLANGCOOKIE-FIX.md

@@ -0,0 +1,160 @@
+# CouchDB erlangCookie Fix - Implementation Guide
+
+## Summary
+
+**Problem**: CouchDB deployment fails because `erlangCookie` is missing from the ExternalSecret configuration.
+
+**Decision**: Externalize `erlangCookie` to 1Password (pragmatic approach)
+
+**Rationale**: 
+- ExternalSecret architecture requires ownership of the entire secret
+- Mixing externalized and chart-generated fields in the same secret is not supported
+- Single-node deployment makes erlangCookie rotation unnecessary
+- This is an acceptable deviation from the pure Harbor pattern given the architectural constraints
+
+## Implementation Steps
+
+### 1. Generate erlangCookie Value
+
+```bash
+openssl rand -hex 20
+```
+
+Example output: `f4e3c2b1a9d8e7f6c5b4a3d2e1f0a9b8c7d6e5f4`
+
+### 2. Add to 1Password
+
+- **Vault**: `mk-labs`
+- **Item**: `couchdb`
+- **Field Name**: `erlang-cookie`
+- **Field Type**: password (concealed)
+- **Value**: `<paste generated value from step 1>`
+
+### 3. Update ExternalSecret Configuration
+
+File: `cluster/applications/couchdb/externalsecret.yaml`
+
+```yaml
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: couchdb-credentials
+  namespace: couchdb
+  labels:
+    app.kubernetes.io/name: couchdb
+    app.kubernetes.io/part-of: mk-labs
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: couchdb-admin
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        adminUsername: "admin"
+        adminPassword: "{{ .adminPassword }}"
+        cookieAuthSecret: "{{ .cookieAuthSecret }}"
+        erlangCookie: "{{ .erlangCookie }}"  # ← ADD THIS LINE
+  data:
+    - secretKey: adminPassword
+      remoteRef:
+        key: couchdb
+        property: admin-password
+    - secretKey: cookieAuthSecret
+      remoteRef:
+        key: couchdb
+        property: cookie-auth-secret
+    - secretKey: erlangCookie  # ← ADD THIS BLOCK
+      remoteRef:
+        key: couchdb
+        property: erlang-cookie
+```
+
+### 4. Update values.yaml Documentation (Optional)
+
+File: `cluster/applications/couchdb/values.yaml`
+
+Update the comment block at line 9-10:
+
+```yaml
+# Admin credentials managed via ExternalSecret
+# See externalsecret.yaml for 1Password integration
+#
+# NOTE: erlangCookie is externalized to 1Password for architectural
+# simplicity (ExternalSecret ownership model). In a pure Harbor pattern,
+# this would be chart-generated, but single-node deployment makes this
+# acceptable. The erlangCookie is treated as an immutable infrastructure
+# secret (generate once, never rotate).
+createAdminSecret: false
+extraSecretName: "couchdb-admin"
+```
+
+### 5. Commit and Push
+
+```bash
+cd ~/git/homelab
+git add cluster/applications/couchdb/externalsecret.yaml
+git add cluster/applications/couchdb/values.yaml  # if modified
+git commit -m "fix(couchdb): add erlangCookie to ExternalSecret from 1Password"
+git push origin main
+```
+
+### 6. Verify Deployment
+
+```bash
+# Watch ExternalSecret sync
+kubectl get externalsecret -n couchdb couchdb-credentials -w
+# Wait for: SecretSynced
+
+# Verify secret created with all four keys
+kubectl get secret -n couchdb couchdb-admin -o yaml
+# Should contain: adminUsername, adminPassword, cookieAuthSecret, erlangCookie
+
+# Watch ArgoCD sync
+kubectl get application -n argocd couchdb -w
+# Wait for: Healthy/Synced
+
+# Watch pod startup
+kubectl get pods -n couchdb -w
+# Wait for: Running
+
+# Test CouchDB access
+kubectl port-forward -n couchdb svc/couchdb-svc-couchdb 5984:5984 &
+curl http://localhost:5984/
+# Expected: {"couchdb":"Welcome","version":"3.5.1"}
+```
+
+## Why Not Follow Harbor Pattern Exactly?
+
+**Harbor Pattern**: Only user-facing credentials externalized, internal secrets chart-generated.
+
+**CouchDB Constraint**: ExternalSecret uses `creationPolicy: Owner`, which takes full ownership of the target secret. This prevents the Helm chart from adding auto-generated fields to the same secret.
+
+**Options Considered**:
+1. ✅ **Externalize erlangCookie** (SELECTED) - Works with current architecture
+2. ❌ Chart auto-generation - Conflicts with ExternalSecret ownership
+3. ❌ Dual-secret approach - Requires Helm chart customization
+4. ❌ Disable ExternalSecret - Loses 1Password integration for admin password
+
+**Decision**: Pragmatic approach wins. erlangCookie is treated as an infrastructure secret (generate once, never rotate), which is acceptable for a single-node deployment.
+
+## Secret Classification
+
+| Secret           | Type          | 1Password? | Rationale                          |
+|------------------|---------------|------------|------------------------------------|
+| adminUsername    | User-facing   | No*        | Static value, hardcoded in template |
+| adminPassword    | User-facing   | ✅ YES     | User login credential              |
+| cookieAuthSecret | Gray area     | ✅ YES     | Session security, periodic rotation |
+| erlangCookie     | Internal      | ✅ YES**   | Architectural constraint           |
+
+\* Hardcoded in ExternalSecret template (not fetched from 1Password)  
+\*\* Pragmatic deviation from Harbor pattern due to ExternalSecret architecture
+
+## References
+
+- Full analysis: `/home/hermes/couchdb-erlangcookie-analysis.txt`
+- Harbor pattern: `/home/hermes/harbor-simplification-complete.txt`
+- CouchDB Helm chart: `apache/couchdb` v4.6.3

README.md

@@ -1,102 +1,102 @@
-# A Homelab based on Red Hat Technologies
+# mk-labs
 
-This repository is the configuration of my homelab. In addition to providing services, the purpose of my homelab is to learn advanced concepts primarily based on Red Hat OpenShift.
+Automated infrastructure provisioning and configuration for a personal homelab, built on GitOps practices with clear tool responsibility boundaries.
 
-This implementation is built on easily accessible consumer based hardware and will focus heavily on GitOps practices and automation will be used wherever possible.
+## Architecture
 
-This repo is a mono-repo that is broken up into three sections:
+A single operator action — setting a VM record's status to **Staged** in NetBox — triggers a fully automated provisioning pipeline:
+```
+NetBox (webhook) → n8n (validate & orchestrate) → Terraform (create VM + DHCP)
+                                                 → Ansible (OS config + DNS + status update)
+```
 
-- infra-config
-- apps
-- cluster
+| Tool | Host | IP | Responsibility |
+|------|------|----|---------------|
+| NetBox | fire-station | 10.1.71.102 | Source of truth — VM records, IP allocation, VLAN data |
+| n8n | tiki-room | 10.1.71.23 | Event orchestration, validation, pipeline sequencing |
+| Terraform | city-hall | 10.1.71.35 | Proxmox VM lifecycle, Unifi DHCP reservations |
+| Ansible / Semaphore | imagineering | 10.1.71.22 | OS configuration, DNS records, NetBox status updates |
+| Proxmox | fantasyland | 10.1.71.13 | Target hypervisor |
+
+All systems on the Server Trusted VLAN (10.1.71.0/24).
+
+## Repository Structure
+```
+homelab/
+├── ansible/
+│   ├── inventory/          # NetBox dynamic inventory + static
+│   ├── playbooks/          # Runnable playbooks (vm-provision, DNS, OS updates)
+│   ├── roles/              # vm-baseline, dns-manager, common, haproxy, n8n, observer, etc.
+│   ├── tasks/              # Shared includable task files
+│   ├── group_vars/         # Group variable definitions
+│   ├── host_vars/          # Per-host variable definitions
+│   ├── templates/          # Jinja2 templates
+│   └── ansible.cfg
+│
+├── terraform/
+│   ├── proxmox/vm/         # bpg/proxmox provider — VM creation from templates
+│   ├── unifi/dhcp/         # Unifi provider — DHCP static reservations on UDM Pro
+│   └── dns/                # DNS record management
+│
+├── packer/
+│   ├── ubuntu-24.04/       # Ubuntu 24.04 VM template (small → xlarge-plus sizes)
+│   └── fedora-42/          # Fedora 42 VM template
+│
+├── n8n/
+│   └── workflows/          # Exported n8n workflow JSON (vm-provisioning)
+│
+├── netbox/
+│   └── initializers/       # Custom fields, VLANs, IP prefixes as code
+│
+└── docs/
+    └── decisions/          # Architecture decision records
+```
+
+## Pipeline Flow
+
+| # | System | Action |
+|---|--------|--------|
+| 1 | NetBox | Operator sets VM status to Staged → webhook fires |
+| 2 | n8n | Validates payload (hostname, IP, VLAN, template, proxmox_node) |
+| 3 | n8n → city-hall | SSH + `terraform apply` — creates VM on Proxmox |
+| 4 | n8n | Queries Proxmox API for MAC address |
+| 5 | n8n → NetBox | Writes MAC to VM interface record |
+| 6 | n8n → city-hall | SSH + `terraform apply` — creates DHCP reservation on UDM Pro |
+| 7 | n8n → imagineering | Triggers Ansible via Semaphore API |
+| 8 | Ansible | OS baseline, SSH hardening, Technitium DNS A record |
+| 9 | Ansible → NetBox | Sets VM status to Active |
+
+On any failure, NetBox status is set to **Failed**. No auto-retry — operator investigates.
 
 ## Hardware
 
-- Dell 7050 SFF (7)
-- Minisforum TH60 (3)
-- Minisforum MS01 (2)
-- Synology 1621+
+- 7× Dell 7050 SFF
+- 3× Minisforum TH60
+- 2× Minisforum MS01
+- Synology DS1621+
+- Ubiquiti UDM Pro
 
-## Software
+## Software Stack
 
-- Proxmox (Virtualization)
-- Cloudflare (Domain Hosting, Public DNS)
-- Unbound (Recursive DNS)
-- FreeIPA (Identity management, Authoritive DNS)
-- Matchbox (iPXE)
-- Red Hat OpenShift
-- OpenShift Agent Based Installer (Install OpenShift)
-  - [Red Hat Advanced Cluster Management for Kubernetes](https://www.redhat.com/en/technologies/management/advanced-cluster-management)
-  - [Vault](https://www.hashicorp.com/en/products/vault)
-  - [OpenShift GitOps (ArgoCD)](https://www.redhat.com/en/technologies/cloud-computing/openshift/gitops)
-  - [Red Hat Ansible Automation Platform](https://www.redhat.com/en/technologies/management/ansible)
-
-## Prerequisites
-
-- Ansible user created
-- Ansible configured
-- [Networking](docs/networks.md)
-- [Proxmox](docs/proxmox.md) (In my homelab, internal DNS, identity manangement, and ipxe are hosted here.)
-- Matchbox
-- DNS
-- Domain Registration
-
-## Assumptions
-
-There are a dozen different architectures you could use to deploy OpenShift in every which way.
-For the sake of this documentation we'll assume the following:
+- **Virtualization**: Proxmox
+- **Automation**: Terraform, Ansible, n8n, Semaphore
+- **DNS**: Technitium (authoritative), Unbound (recursive)
+- **IPAM/DCIM**: NetBox
+- **Networking**: Ubiquiti UDM Pro
+- **Templates**: Packer (Ubuntu 24.04, Fedora 42)
 
 ## Getting Started
 
-[Step-by-Step Walkthrough](step-by-step.md)
+See [docs/decisions/vm-provisioning-flow.md](docs/decisions/vm-provisioning-flow.md) for the full architecture decision record.
 
-### Hub Cluster
+Previous OpenShift/ACM/Fastpass content is preserved in the `archive/pre-mk-labs` branch.
 
-You'll need an OpenShift "Hub Cluster" with access to persistant storage.
-A Single Node OpenShift (SNO) instance, installed on bare metal, will act as a Hub cluster and run:
+## Security
 
-- Advanced Cluster Management
-- Ansible Automation Platform
-- Vault
-- ~~OpenShift GitOps~~
-
-#### Network Prerequisites
-
-The prerequisites for OpenShift in traditional and HCP patterns are largely the same - it just kind of depends on where your DNS records go to.
-
-| Cluster           | Endpoint    | VIP           | DNS A Record                      | Notes                           |
-|------------------|-------------|---------------|-----------------------------------|----------------------------------|
-| Hub Cluster (SNO) | App Ingress | 192.168.0.10 | *.apps.hub-cluster.example.com    | SNO App VIP goes to IP of node  |
-| Hub Cluster (SNO) | API         | 192.168.0.10 | api.hub-cluster.example.com       | SNO API goes to IP of node      |
-
-These DNS entries should be put in your Authoratitive DNS.
-
-#### ACM & GitOps Configuration
-
-Before you start creating clusters you may want to create some Policies, integrate ACM and ArgoCD, etc. This step is optional in case you're just interested in trying out Hosted Control Planes or copy/paste around a cluster for testing purposes.
-
-Find additional details in the ./02-rhacm-config folder.
-
-#### Creating a Cluster
-
-With everything in its right place, you can now start to declaratively create clusters
-
-./05-clusters/hcp-bmh - HCP to Bare Metal Hosts
-
-### Internal Cluster
-
-Two additional bare metal nodes, to be added to Advanced Cluster Management (ACM) running on the SNO Hub. These will be used to create another HCP cluster.
-These servers have a BMC interface with Redfish - if not, then you'll need to manually manage the boot and installation of those servers.
-This makes it to where you just need 3 bare metal nodes. You could run one HCP Bare Metal cluster with both of the other nodes, but then you have a shared storage requirement that can't be satisfied by ODF since that needs at least 3 nodes.
-
-### External Cluster
-
-You'll also either need you just need at least 2 bare metal nodes.
+No sensitive data is stored in this repository. Secrets are managed via Ansible Vault and environment variables on pipeline hosts.
 
 ---
 
-## Credits
+**Status**: 🚧 Active Development — VM Provisioning Pipeline
 
-- Ken Moini - As I used his [repo](https://github.com/kenmoini/ztp-for-you-and-me) as the baseline for this project.
-- Ryan Etten
-- Andrew Potozniak
+**Last Updated**: February 2026

ansible/DNS_MANAGEMENT_REFACTOR.md

@@ -0,0 +1,193 @@
+# DNS Management Refactor - Modular & Repeatable
+
+This document explains the refactoring of DNS management from standalone playbooks to modular, reusable tasks.
+
+## 🎯 **What Changed**
+
+### **Before (Monolithic)**
+```yaml
+# Standalone playbook: add_technitium_dns_entry.yml
+- name: Add entry to Technitium DNS
+  hosts: all
+  tasks:
+    - name: Create DNS entry
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        # ... hardcoded parameters
+```
+
+### **After (Modular)**
+```yaml
+# Reusable task: tasks/add_technitium_dns_entry.yml
+- name: Create DNS entry for {{ dns_record_name }}
+  effectivelywild.technitium_dns.technitium_dns_add_record:
+    # ... parameterized with variables
+```
+
+## 📁 **New Structure**
+
+```
+ansible/
+├── playbooks/
+│   ├── tasks/
+│   │   └── add_technitium_dns_entry.yml    # ✅ Reusable task file
+│   ├── add_dns_entry.yml                   # ✅ New playbook using task
+│   ├── add_technitium_dns_entry.yml.backup # 📦 Backed up old version
+│   └── roles/
+│       └── dns-manager/                    # ✅ Enhanced role
+│           ├── tasks/main.yml              # Uses task file
+│           └── defaults/main.yml           # Technitium defaults
+└── scripts/
+    └── migrate-dns-references.sh           # ✅ Migration helper
+```
+
+## 🚀 **Usage Examples**
+
+### **1. In Playbooks (Direct Task Include)**
+```yaml
+- name: Add DNS entry for my server
+  hosts: my_servers
+  tasks:
+    - name: Create DNS entry
+      ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
+      vars:
+        dns_record_name: "{{ inventory_hostname }}"
+        dns_zone: "{{ base_domain }}"
+        dns_ip_address: "{{ ansible_default_ipv4.address }}"
+```
+
+### **2. Using the DNS Manager Role**
+```yaml
+- name: Setup cluster DNS
+  hosts: control_plane[0]
+  roles:
+    - role: dns-manager
+      vars:
+        cluster_endpoint: "my-cluster.local.mk-labs.cloud"
+        cluster_vip: "10.1.71.100"
+```
+
+### **3. Using the New Playbook**
+```yaml
+# Import the new modular playbook
+- import_playbook: add_dns_entry.yml
+```
+
+### **4. In Cluster Network Setup**
+```yaml
+- name: Setup complete cluster network
+  ansible.builtin.include_role:
+    name: cluster-network-setup
+  vars:
+    cluster_name: "fastpass"
+    cluster_endpoint: "fastpass.local.mk-labs.cloud"
+    cluster_vip: "10.1.71.53"
+```
+
+## 🔧 **Migration Guide**
+
+### **Automatic Migration**
+```bash
+# Run the migration script to find references
+./scripts/migrate-dns-references.sh
+```
+
+### **Manual Updates**
+
+1. **Replace playbook imports:**
+   ```yaml
+   # OLD
+   - import_playbook: add_technitium_dns_entry.yml
+   
+   # NEW
+   - import_playbook: add_dns_entry.yml
+   ```
+
+2. **Use task includes in roles:**
+   ```yaml
+   - ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
+     vars:
+       dns_record_name: "my-server"
+       dns_ip_address: "10.1.71.100"
+   ```
+
+3. **Use the dns-manager role:**
+   ```yaml
+   - ansible.builtin.include_role:
+       name: dns-manager
+   ```
+
+## 📋 **Variable Reference**
+
+### **Task Variables (`tasks/add_technitium_dns_entry.yml`)**
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `dns_record_name` | `inventory_hostname` | DNS record name |
+| `dns_zone` | `base_domain` | DNS zone |
+| `dns_ip_address` | `ip_address` | IP address for A record |
+| `dns_record_type` | `A` | DNS record type |
+| `dns_ttl` | `360` | TTL in seconds |
+| `dns_create_ptr` | `true` | Create PTR record |
+| `dns_debug` | `true` | Show debug output |
+
+### **DNS Manager Role Variables**
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `cluster_endpoint` | - | Full cluster FQDN |
+| `cluster_vip` | - | Cluster VIP address |
+| `dns_management_enabled` | `true` | Enable DNS management |
+| `use_hosts_file_fallback` | `true` | Add to /etc/hosts |
+| `dns_ttl` | `360` | DNS TTL |
+| `create_ptr_record` | `true` | Create PTR record |
+
+## 🎯 **Benefits**
+
+### ✅ **Modularity**
+- Single task file used across multiple contexts
+- Consistent DNS management approach
+- Easy to maintain and update
+
+### ✅ **Flexibility**
+- Works in playbooks, roles, and standalone
+- Parameterized for different use cases
+- Supports multiple DNS providers (extensible)
+
+### ✅ **Maintainability**
+- One place to update DNS logic
+- Clear variable interface
+- Better error handling and debugging
+
+### ✅ **Integration**
+- Seamlessly integrates with cluster setup
+- Works with existing homelab infrastructure
+- Compatible with Traefik load balancer setup
+
+## 🔄 **Integration with Cluster Setup**
+
+The DNS management now integrates seamlessly with your cluster deployment:
+
+```yaml
+# In fastpass-first-control-plane role
+- name: Setup network infrastructure for FastPass cluster
+  ansible.builtin.include_role:
+    name: cluster-network-setup
+  vars:
+    cluster_name: "{{ cluster_name }}"
+    cluster_endpoint: "{{ control_plane_endpoint }}"
+    cluster_vip: "{{ ansible_default_ipv4.address }}"
+    control_plane_nodes: "{{ groups['fastpass_control_plane'] }}"
+```
+
+This automatically:
+1. ✅ Creates DNS entry for `fastpass.local.mk-labs.cloud`
+2. ✅ Configures Traefik load balancer
+3. ✅ Tests connectivity
+4. ✅ Provides fallback to /etc/hosts
+
+## 🚀 **Next Steps**
+
+1. **Test the refactored approach** with your FastPass cluster
+2. **Extend to other clusters** (Hub, Internal) using the same pattern
+3. **Add support for other DNS providers** if needed
+4. **Create monitoring** for DNS health checks
+
+This modular approach makes your homelab's DNS management much more maintainable and repeatable across all your Kubernetes clusters!

ansible/ansible.cfg

@@ -54,7 +54,7 @@
 
 # (pathspec) Colon-separated paths in which Ansible will search for collections content. Collections must be in nested *subdirectories*, not directly in these directories. For example, if ``COLLECTIONS_PATHS`` includes ``'{{ ANSIBLE_HOME ~ "/collections" }}'``, and you want to add ``my.collection`` to that directory, it must be saved as ``'{{ ANSIBLE_HOME} ~ "/collections/ansible_collections/my/collection" }}'``.
 
-;collections_path=/Users/rblundon/.ansible/collections:/usr/share/ansible/collections
+collections_path=/opt/ansible-collections:/usr/share/ansible/collections
 
 # (boolean) A boolean to enable or disable scanning the sys.path for installed collections.
 ;collections_scan_sys_path=True
@@ -209,7 +209,7 @@ private_key_file=~/.ssh/ansible
 remote_user=wed
 
 # (pathspec) Colon-separated paths in which Ansible will search for Roles.
-;roles_path=/Users/rblundon/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
+roles_path=./roles
 
 # (string) Set the main callback used to display Ansible output. You can only have one at a time.
 # You can have many other callbacks, but just one can be in charge of stdout.

ansible/create_jarvis_user.yml

@@ -0,0 +1,6 @@
+---
+- name: Create jarvis user and deploy SSH key
+  hosts: all
+  become: true
+  roles:
+    - jarvis_user

ansible/group_vars/all/semaphore.yml

@@ -0,0 +1,154 @@
+---
+# ============================================================================
+# Semaphore configuration-as-code
+# ============================================================================
+# Drives a freshly-deployed Semaphore instance into its desired state via
+# the Semaphore REST API. Idempotent: every object is checked first; only
+# missing ones are created. Existing objects are left alone.
+#
+# Loaded from group_vars/all/semaphore.yml so that the configuration is
+# version-controlled in the homelab repo and survives a wipe-and-redeploy
+# of the Semaphore VM.
+# ============================================================================
+
+# ---------------------------------------------------------------------------
+# API connection (defaults to the local Traefik-fronted service-name URL).
+# Override semaphore_api_url to point at a specific instance if needed.
+# ---------------------------------------------------------------------------
+semaphore_api_url: "https://semaphore.local.mk-labs.cloud/api"
+semaphore_api_validate_certs: true
+semaphore_api_token: "{{ vault_semaphore_api_token }}"
+
+# Feature flag — keeps day1_deploy_semaphore.yml deploy-only by default.
+# Set true to also run the configuration pass.
+semaphore_configure: false
+
+# ---------------------------------------------------------------------------
+# Declarative configuration of the Semaphore instance.
+# ---------------------------------------------------------------------------
+#
+# Top-level shape:
+#
+#   semaphore_config:
+#     project:        single dict — the lab uses one project ("mk-labs")
+#     keys:           list of credentials Semaphore stores
+#     repositories:   git repos Semaphore can clone
+#     inventories:    Ansible inventories from those repos
+#     environments:   env-var bundles
+#     templates:      task templates that tie everything together
+#
+# Each list element has a unique "name" used as the natural identity key.
+# ---------------------------------------------------------------------------
+
+semaphore_config:
+  project:
+    name: mk-labs
+    alert: false
+    max_parallel_tasks: 0  # 0 = unlimited
+
+  keys:
+    # The ansible-vault password. login_password type with empty login
+    # — only the password field is consumed by Semaphore at runtime.
+    - name: ansible-vault-pass
+      type: login_password
+      login: ""
+      password: "{{ vault_ansible_vault_password }}"
+
+    # SSH key for the gitea deploy access (clone the homelab repo).
+    - name: gitea-deploy
+      type: ssh
+      ssh_login: git
+      ssh_private_key: "{{ vault_gitea_deploy_key }}"
+
+    # SSH key for the universal automation account 'wed' — pre-baked in
+    # every mk-labs VM template. This is the canonical user Semaphore
+    # uses to reach the fleet.
+    - name: wed-ssh
+      type: ssh
+      ssh_login: wed
+      ssh_private_key: "{{ vault_wed_ssh_private_key }}"
+
+    # SSH key Semaphore can use to reach the fleet as jarvis (admin
+    # account provisioned by linux-baseline). Retained for jobs that
+    # specifically need jarvis-level access; the default is wed-ssh.
+    - name: jarvis-ssh
+      type: ssh
+      ssh_login: jarvis
+      ssh_private_key: "{{ vault_jarvis_ssh_private_key }}"
+
+  repositories:
+    - name: homelab
+      git_url: "ssh://git@gitea.mk-labs.cloud:2221/rblundon/homelab.git"
+      git_branch: main
+      ssh_key: gitea-deploy
+
+  inventories:
+    - name: production
+      type: file
+      inventory_file: ansible/inventory.yml
+      repository: homelab
+      # wed is the universal automation account pre-baked in every VM
+      # template. Semaphore uses it for fleet-wide jobs.
+      ssh_key: wed-ssh
+      # become_key is Semaphore's sudo PASSWORD slot, not a second SSH
+      # key. wed has passwordless sudo on every host, so reference the
+      # built-in "None" key. (Semaphore rejects an SSH-type key here.)
+      become_key: None
+
+  environments:
+    - name: default
+      env:
+        ANSIBLE_HOST_KEY_CHECKING: "False"
+        ANSIBLE_FORCE_COLOR: "True"
+        # Semaphore runs ansible-playbook from the cloned REPO ROOT (not
+        # from the playbook's directory as I first assumed). Path is
+        # therefore relative to repo root, not playbook dir.
+        ANSIBLE_ROLES_PATH: "ansible/roles"
+        # Collections are installed by the semaphore role into a host-side
+        # directory bind-mounted into the container at this path.
+        ANSIBLE_COLLECTIONS_PATH: "/opt/ansible-collections"
+
+  templates:
+    - name: "day0_linux_baseline"
+      description: "Apply the mk-labs Linux baseline to one or more hosts."
+      app: ansible
+      playbook: ansible/playbooks/day0_linux_baseline.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--diff"]'
+      survey_vars:
+        - name: target
+          title: "Target host or group"
+          description: "Inventory target (e.g. figment, semaphore_server, all)"
+          required: true
+          type: TextVar
+          default_value: "all"
+
+    - name: "day1_deploy_semaphore"
+      description: "Re-deploy Semaphore + PostgreSQL on figment."
+      app: ansible
+      playbook: ansible/playbooks/day1_deploy_semaphore.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--diff"]'
+
+    - name: "day0_linux_baseline_check"
+      description: "Dry-run the baseline — shows diffs, applies nothing."
+      app: ansible
+      playbook: ansible/playbooks/day0_linux_baseline.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--check","--diff"]'
+      survey_vars:
+        - name: target
+          title: "Target host or group"
+          description: "Inventory target (e.g. figment, semaphore_server, all)"
+          required: true
+          type: TextVar
+          default_value: "all"

ansible/group_vars/all/step_ca.yml

@@ -0,0 +1,4 @@
+---
+step_ca_url: "https://turnstile.local.mk-labs.cloud:9000"
+step_ca_fingerprint: "f63c44e76381e359978bd2dca07c928d04ad44b575f0364fa66b5725c7e7891b"
+step_ca_provisioner_name: "admin"

ansible/group_vars/all/vars

@@ -0,0 +1,47 @@
+---
+# file: group_vars/all
+
+# Proxmox variables
+proxmox_user: "root@pam"
+proxmox_password: "{{ vault_proxmox_root_password }}"
+proxmox_host: "main-street-usa.local.mk-labs.cloud"
+
+# DNS variables
+dns_server: "monorail" # .local.mk-labs.cloud"
+#dns_admin: "admin"
+base_domain: "local.mk-labs.cloud"
+# DHCP server
+#dhcp_server: "matchbox"
+
+# Terraform variables
+terraform_server: "infra01"
+
+# Traefik variables
+traefik_server: "lightning-lane"
+
+# ---------------------------------------------------------------------------
+# JARVIS automation account
+# ---------------------------------------------------------------------------
+# Public key for the 'jarvis' user provisioned by the linux-baseline role on
+# every host. Public keys are not secret; the matching private key lives on
+# the JARVIS command centre (carousel-of-progress) and, when needed, in
+# group_vars/all/vault as vault_jarvis_ssh_private_key.
+jarvis_ssh_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5sym5ajFvDyzw395BkHv7qVb66XPTx/OF1p19MGuNo jarvis@mk-labs"
+
+step_ca_principal_mappings:
+  - local_user: wed
+    principals:
+      - ryan.blundon@protonmail.com
+      - ryan.blundon
+      - ryanblundon
+  - local_user: rblundon
+    principals:
+      - ryan.blundon@protonmail.com
+      - ryan.blundon
+      - ryanblundon
+
+# Leviton My Leviton API
+leviton_email: "{{ vault_leviton_email }}"
+leviton_password: "{{ vault_leviton_password }}"
+
+jmri_vnc_password: "{{ vault_jmri_vnc_password }}"

ansible/group_vars/all/vault

@@ -0,0 +1,361 @@
+$ANSIBLE_VAULT;1.1;AES256
+63623430346462366164333638633439646431326632346630383066333138313438643039373630
+6230333230356433343761666335323934656463653737360a376337346163316334333266346639
+30366436623165323462623330633935313438303761343666393162303466373762623235333161
+3835323539376536300a623962323438326336343537316630626262336339353730316162623935
+64666430626164316163633064643263396238353231373438643432343535633966636430386632
+35653437383361373938353034306264633139373663353062363163623634333538623831633831
+64643261376662613763306664353566643462306431643963633261643732386131333565366539
+35663062633730326166616366323865396536363532643931386637626430373562626531376430
+39376634363634656337363038666336663365363562356664333139633833323562386562396166
+33636437346130326539623364343030326330646137653131383739663166666334623566386631
+64616239656662393536633134643163663537626435653561323066336662613536306363623536
+33396466383537613135353930353832653765313435666435313266336361656633356131653766
+30326132366535323638393137633466333337306466333265353635333762613731396663313839
+36363830653032373564306435626333646530656535396362346132663937336337376339633366
+65373630323631303062656339613536303932656135363437633934333764613939343830353432
+34313665666634336465646363356237306562653534613863353064336236343963393664323738
+38653237656534616562303439616332303134626565646261343131393162343433636232393665
+62343431343535646431363861643964643234343665343366363930303663303565636161393033
+63626638333763343139396465363165363632393664623838623065623466336136373333393263
+34316439656232653261653538396231346462653339353034313063633661376266363265636432
+64316336613736396266333937353833363230653132383339626635386563626131663063396633
+36333061396639653238373965613831653935333533386633613035643530376465366331373832
+32643936373630363539666463353839333335663763653530623037326263306636383233613037
+39376266323064633366326163666264393265306438616330613631663137303963353666353231
+30343565633235643731326136643132376135376639366139383466323333333732396231373534
+62366438376232613463653231376164643930356137336337323763633063613861636266666262
+31323934356237373964316531353537366236633162303661663964356464653561333166643432
+61376631653335633264393762636435376535316663333065313638343361366439383432656138
+38353737353865396233366231373439333863386161323532373537333934346431373664633138
+30646437643737663031613332636536313039313663653262633665633564363130643738333031
+33666232333734646531326266393934636430626332356266333461326238633262316364356336
+65326238316336323037633236383765323332633936633062353266623238633738336132383432
+61343432343035386130363462663239613166626661613332393163386232356237383464383762
+31323739643235326264316134306430356539613865353532663133313830303061396339353566
+35373062316237373232616662383663636236353365626665386532333336313864383837383035
+62653638306136316137663738616663636434303533336433373739313331616631343131353265
+37353430386330333562366132393537613465343363623838393165666538623131653164376434
+61376533353366613735626165353562626431313031633238343966623962323231626265366330
+34353165623864343031623565363235323763646638393762646565393465396534343937666335
+62643530643435343931666563396661653662396265303362663932333666383534656539663033
+61663533353333323733613933363433383033346463306430353634633466396564623837346133
+38636131393738636666313765353835343666353663396539623236313237303437666665303966
+38323364376665613731336334383535373835303138373036613665336636306364623464303963
+39393830646133363263653330306531633863333064663466346135316161376362653862313132
+61333830303765386138303865323766353663656531643965356331633532343435633461366333
+61343534613166656639643363333231653738353936393938376665616136626361653432326531
+64633861653738616237313061393132383264313964643764366534303263653233393035363435
+31376164356466323431383836326334616130363264393139316362333130643262643766376331
+35666130303636363666363932616134306665313339323231306666353236353965356332343430
+36636263353565396535383862336464646134346566626635363063613761353333326137646662
+32656535356332626166636432643635353734393564376161316134613561303931663366616366
+35393166393632326564393763366161663636336362303566316162326631663937336437623637
+39613832666462613963643834313932323837393337633735633833646265666666653339353832
+37636332633063636133663938306234316666393735643634303833666537363932323363613466
+37626235626633383639663262653138613038363737323639306234366562666236326332323932
+63323336623633303736306362326237636465666465616361666130363538643135616237316234
+37623562396363326237663665636539346166323566386365376665616236653735646637363939
+64656662353233323065303438306436623735643934613839333133356564363438653133333037
+33656238663733663665373463393038303865613838366538356538383539396262656561353563
+31666333316564336262366435306261613563376462356338613063343232393766653332643237
+34636639333962393663333566643863386261666630393362356138623732323435666534376561
+61366363313861376566316235326633383630316338346333623432303766663130333130303363
+66616336613364666165393964666665383330316232316465663561613239386434663135613231
+62623334383433373461383037343037663236646463393632636161336562663533636235663039
+65383330373039386361633363613035636135373765353331636139313838353231353731346336
+63323736636130383962363762343437383237373533396433343464383235393030373862346233
+36646238623165353264323162316362376338383463663664636132373963623938373537373037
+30353262626363666565386536626163393130306634343836663137653537393066333637313639
+31376336373565313630636436616635623633396333313036366530613630663332323134613961
+36666438656636626561303637646539656166373861626232663266386533376531346166653834
+34656530363464343131303666616237373030393863326132313764373966633365313834316438
+34396239613235623233373136313464626661303666303438613337366662306363636439613332
+33626635613039363864343233323930333731376665346138626363396336373862636565613061
+30613863356637396133656663653232366265373766636237356539623639333133346361363361
+63343639353734313163346333356138343237383238623733343331376631636632373231363834
+62626432303732663435353762346161363330373266353031633862366539333133313931396166
+38373330323661616366343063363437333436626438376665333866376338626232383735613434
+64656363633332646533376535326566336566306439373835363264373335306564616337383465
+38353966636434653064326265643933653661363439363334383537623563303066346133353431
+62343662646434633761653332323430636339303666646262636334316461383865366436383231
+61313133316332363337343963306431356231306534636231643539383733383265303662373430
+34626666333830353934626139663532663332353938393038303631633335636236393133623064
+37306337386464656339383261323464303934373337333235343635326164653762613838333030
+39653063316131616566613365383961383435636639616536316662333736396238376661386533
+34643833323164303930656165396235353531326535313165663361653939656263633638633337
+36353435613335633239316435313965613439663061313834356661376365653763323837643561
+34333833626663353438623161366537326336646630613536653831306664663636343963313165
+65323332353633323931346634336331636465396337393035613834633962343662393930646337
+36346330353031636633326532616362646465386633363333613134653261323234636539633734
+63343965356433366233646536326333313366366537343934383239383439393633396461633166
+65633439336462363061316435396235346366386335666233343963383163393465633766643731
+62326362613266653238356435633032373036623839306132333136653537306365626165616638
+64316134316134393463313165376536383031366132363831333432323466653538376433333033
+65366438353935613863356562666264643063623439383335396531613730353861313664663234
+36626533366134643164353138306234333765623634316533383264303636353039643130366433
+38313133333632663666303862323939633463633634653963323866376137376137633930313963
+61336431656332333636373638316237663861336136393036653636366566316661303034623566
+31323537356338363762643265613534316466386263666236633038386634333139636561656331
+63613636316439393435383931306530306163386266373161666139373235653935393632313261
+36343066653561363333363830313136653538366639333464376562316334343839363332643137
+39336463613631346161616534613933613234656435383234313831366366643961393633633035
+39663935626134626138383038636266356434393535353165626632633430313635623532646165
+31363166373335326433363336326662663561306166313862373161633739643662376461346266
+61663730366337376165653033353466653761613938366532653633363530616134393464303138
+66353637623135626431643835613239633033386433663735356264333734613162343234633566
+64643039616137393863396433353138373862646138633838356365373863623235376638383439
+36373732373031346132363738383635653865346637626233663537613636613862323666616438
+34333336346235636234653062613466376637623165336337643933623535353033383438646530
+36653133336637346432343136336331336464633439383938353862323365343864666533316633
+66646262343534373165366266656135666339633333626133643238386139353537353866616631
+38306335663165363138303635383164303535386536626431663661396664376433656339373934
+38396130313438653539393263323265646163633939653431393035356332336664396234383636
+32323863366237633462316536626639343335626131323536373364393266386163633433356263
+36366665373432313132363761383632343532306361346134313464653763393533613565363839
+62623938346530636562383937393534653963636365303837336165343361313734303666623739
+30653834616163636538313038636261343434326164616264356261336239313039373661396535
+34346631643337666234373933383362656266346266393035363332303636363035656538636363
+39396466353565346264353663316562623239373564616162326439383334663730326435353236
+37366238653131356339306566326534616561653637613438666430336334323031373661353636
+64356131343763653639313531303866636334326637313838623138303836666466623736623237
+39363838653431323665366634303632666337363663386261326538313635313638383764383765
+34363832366135333436303635373761653265653165316135633135373365346266356635663533
+37303134613131653563356662363965353234643765373438313835343063313931626464636562
+36313434356434656138616433666266353538306666333363363431356530313262356438623537
+33303365393061393161626665316332626238353438623466373831303939663734663038346462
+39323462663732653335373261306635303231636563373465343761613262396466623135323736
+61316638313535653031633230333638343737633163636335343864336336373437643131643335
+63653766623436323039303065646162626331336637346237656132353039623063396631666535
+36316634623034326664313766326464383337663230643530623563326333336232666334323139
+33346563353734346338333432366437353665323764366335336232353163373563326265346234
+36383437383332366234393636323034376434336461336532613663316533653463633263343261
+62333535653062663663313534303237386562623533636230626531646461613233653330386466
+32623137633136323363386232393466303537643331656464663234636336393532313831313961
+37623939323963643364636439663032386630336235623037643065356631376637333062313762
+31653661316562643633643135616634353631623463353637616131343531633266393766336232
+30616138616437323138383732306537326562666239636561383631333534633937396463613765
+62313064653838623537393839386464653539326132393732393131633335393063393636376235
+64306566343762626238386632626136396331336564326361303835613732623531396631363564
+32616631333034313563396532396564663262613733626362663632333938336331633664376638
+34626466613239353935376230653732366236643830353963653662613338616631346561623063
+61616565393965613730326530353935323432306465656464626238623438636263666530336531
+64333864636131343566643164653934306135316437383738323738616362643636383761383433
+65353762663930636366376365623535333636613766666465316134303131623637343864643461
+33663934656631333032353734333361363339336266343631363937306632323635663832643266
+30383633323735333430376662663765303561643563383466333764636131363732636134376462
+37646564386564373038393135653761373937313039623737623938363631393632346565326166
+64376637323432303865366436356264633066343466333838303164373234646661346133646561
+62383838336461306638383266373462326165313161383832316462363835366361386663353935
+35616433393963613363333965666138363365666366646163336163613237386263343737636335
+36623864346566383632643035393361616533396538356562343364386330336636383433303538
+65653630303435373336366639656137386363303439333164633634323730393337333764633461
+32396161303864333362663466303161366465386338396332333462366339353461373638343961
+31343466663537636330663962636431366235646164643332343433393063633435646565333863
+37626239396264653434363538623133366561623436633739646335383534323839663465316339
+63653731636266343130383035323962333062623730343033613663366431386366623038373238
+32666537323237336236386135626339363861636439346664376561666538636532396562333435
+32383366373437303765653664396436623861333164396563623639636131656366316138396131
+61316432663239346539343261363461643632363432653161383233643431303034353136396465
+35623836393435396234336261626162326433356134636139303261653430363835333364656161
+34326533613636366134633332393064356535373432666165386163613961613539333932643963
+32343639343931623366633764363966636164323933623734333935613462303466656439306331
+36323261623639303164646435346533353966616138326230363739303063323366323964356534
+30316534656364373633663464366161373566626639363963356131353936333366326334663438
+32646463653664656635353564323230343763303538316135643838363134393634363031646530
+37323838386134316136663139626262396239643263353432613162666235616133623937383261
+31353138396238313066643964633536636337386238616637383561383563313936373538616334
+62363233623738613064313762303463303266346538333937343566343936326363323037623032
+30346434366661643930623761666134366132373936336630623963636331653532363765363263
+66306133303634343231386164343131333234376662313663393130326664386262363035353565
+37633863353935363635303039333662366462383235636564313666333162666563376666633966
+34666130613034393439346337383862643231666632663463393330356263646165316266613936
+62303536333339303431373531303065613865633339303264323137323732653036333366373664
+64623330313464356461376662663266333430633161393437363862633564396263353333316662
+64636262333832646135626534363737656336663562333365666631646261303665333964326337
+35643964386362323161666464363037623266386539383732626230303830303662366161653063
+36383539626334376238663539336637343033343037346136383733316265383430396133336139
+64616135623230613531313733626537366430626262623836386432363561626238303132613830
+36323533656164376334643436373730653531396236633933393663656435656566626165626164
+39366465646535383532616466313665333533386230656631343332376166613033343364393361
+62656237316466663131333661333565643335646166333332393263626463633639306264656666
+36343330666462373061363466636233333165663662393933343763633333373161626235363138
+64346433663661636561613636366662376562363638356231646438653532633434623132306330
+65656433353262623661636263393737623337316535326332373861393331626563326434383266
+65383931393032376137623833303031303934636135373135626562396364383635623661303431
+65623132393961396336363763616366633064366331316330396130373239336137373964356136
+37653162383030653736626564343739383030636531346534386639313063323938363236306537
+36646132626138643462636466656363353436633863613165613362616264613434303936633661
+38376661306439313036333431363664616662646533333963656165393939303865616661313864
+65656338633864663665303961613165386335646661343438333730313138616535363164336463
+35363563356362396265333334393964356534613763656362323631363237656438653962316336
+62633330616530376537333961383461323432303161343136326363313137333333323835313065
+64666132356632613365393137363061363165623733353534303638353432393739346164346535
+39363464313239386564336436663339303535336633666364373436666635613638643061316235
+61656266623934633339643063306363633131373335333538643338666339396166626262646434
+65623962396464343532366639393339306237653633623763333165303636613834333531306235
+36636430633864396236363638393165653431313139343966316561663138313761653630623436
+33363037303334383363646337303065343239343537343737616438613165323965333334613234
+62623931343365336230343037346230366134396435383236643931366631326335626431306366
+31646339323562653737303465353738343939623037616666656432313833653233373636326130
+30613434646237306636396239363439383961376539613131333164373333313131343062366638
+34333963313163303239333439393765386234313534303834636637393965323439366235613666
+65316336393335656332626165643261316464383232396136336238656662336132646366373263
+65396534353764616134663964376135623035316432623939376231373731343136313265323862
+61646238353761646434313430663362633066663763623735343730633036333533356339393665
+30313763346166653738636234663232323033636332373861373164393737353962323066363238
+34613066323862353831653438633564633561653034356263663430366432643663633836653764
+63333964663765353135636234323330623130633736653263336238396631356436346361366463
+65393239356432386163396135663161626664626137353465333733626635373537396137353437
+64626139393164313866616132386132303837303437306365336164383265346361383661323130
+62396333333666613538363332323032653037646563396436613166323166323666363934333064
+66356665306465653661323331376337653561613761643765666636396531663930333634316230
+35343733613638626230623464663133343432663764663864343363376339333566633963326630
+36313264636638396566623334333230363137353262346531623138656364653038373034353137
+31383533303234636333346332343333336531326363636161623764333762653835396632366436
+31646566363334633336366231363163643837633564363162656130323331626464333236303637
+31663439636234623534336535393835653838643430356364353762613966346461313032353939
+38613932386564623935363135663462626663313130663737373234316231343461616133626264
+31356163363234383132373730663436333738633562336435383532366138653764306165643863
+36383362633137643931333735333264656666336363663161643862323337613536383034336462
+35333165386332366436666439323236346539366530383136626637363539656230336637333432
+35336235363065306534643762346263393935333238383533646331653332643234386539653230
+30376237666166323638303465373737383031373864373266306537373335356139646230656264
+36316536363738323362643230363064363965636563346165356565643265353332386136346435
+66313937346164313661656364373465656230613261333833323335653133396132356334353237
+61353832373063666331646664623565353030663530636135336365633366623533653462386237
+65373462336538663835303831313336396638646534343839343933383032646664306434613230
+38323333666165363662376430356435363463303936396234313931303734666333376431376562
+65636132636435396562376637396464356165363937613435626235303730636239626465306237
+62613335396161303737396231666536353230656533653239353364623733623131333861626637
+64306437633564623565333664653030366166663835353063316631393864663338656663633736
+31346166656636396565333663353562613032373462366433323266396135363430623139373963
+32393864646438326366343036386231353530356233393539646562643339643366346563393162
+39393830646565326666333063396531356336653162623465313365616564653430663264363164
+62306562313037646466366463396432373536303631653338343133393262663865636133343464
+61383237386164633536663230346461383861626666623562313737373138633239333266366132
+32306135313464363461653363636462366662393938396566333661306366383838636438353738
+32356666613238356135353536656130346134663666346362353735613338666234626538373139
+65613262636233366532323630613438663334616164656166623236353531303835326266343663
+66366364333437373039306634383737663963373663366131396566613030386661656235616662
+35663533623864303431343631386362623036343135663665383039333363336534613063313534
+61373939306536376337303561373030343337326437393636366166376630346430666539646266
+34616435346139313033353130303639393530373662616432343330653762393339396432643935
+65313638383330613464363666633965393035643037626162616339306563646130306566613064
+35656130653035363163323831323730633236633736663965653833623131383037323736663066
+35343235356164623038643230373666366265363437396231613365303935366135636135613265
+31393163323837663332623636316462656338646566363361333863336365373562666434366530
+37626236343731313065353037346437356264363233363638393238373063386530646434663564
+35353562396564316535663436376335393136613338643864323132326431633066373462323330
+36306263646434333532316365613239376237303232383531343238623833626363346437386235
+66666565656635306162646430393738666132633065376330393162633066333534383561353336
+33313162666664613636303962656438626133373137336639356133363563653431646461313538
+37316433663263333536386632646536616564316362363238626231613162383966333063636132
+31623436346138613030396462626663616233326662663634633765643864373262393634353937
+32376437363737616337373333313832373135313535666430386536303236356563613166366332
+65323332626363663535633234323364663838333862643232376237653031303137303136633462
+32356431306534626135353462643736373939666130623732303562393932636231373534626132
+32343464353538356231303535396365633465333230353261346533333063303135303135393465
+34656333613966663966646162386633333830323234613836633236626134316162663139656530
+63623666313138666130326139386636646230353637353561323736656437616438633839613837
+62353931313562383830393433313232653461363436353064653039313738396138333263633965
+32316236363233613831303436323835616332646262343336353037323362313265336634393261
+35393761396537373636313665373830326463643136303961316238336238623466396334343664
+61396234663862343937633131623939306135646231373633653534353363383439656539333331
+30303536353462666433626236343163653139333038656662666664626439613639636564393835
+30363165616263656535303439636563643663633434613665613339313162363234623131306630
+34653932376634363264343335343064343838626464666661313533383534383833633863386463
+37633664396537363735353161346238656336396565383637313230636561626362656232333036
+32386538623063613331623662666531626362616430386335333664646234613965643733656236
+31303766326536326461353632353730303434333866353730383562383533623338626232346330
+64396163613663363562633635656566313263383262656666393537653233363166656335653034
+32376335623633373431376266663036616635343231663963363936353137376263656133623735
+65656435393733613762376638613034643466313632646431656461313362363561623463393238
+34373830373633373835376234366532363763316632613766366161613130633762313839386363
+61396632333533663964373463323464323035386236376364646332663431383039623830333137
+62313062393236363338616433613033306563323264316332366161346235356539323232653931
+66313862383935316235653663336666666339343534376336336138366639633538643937303665
+39386262306566386464363337336130633038633837663166333639343161373234303230306338
+30323063393365336332663531316365356531386365343836656437613337346666653637633639
+38653465393236633962373739323331623565643938373563376364333863343030333136333863
+64663132336165616462336232323865636630373533643063383730626565666337636539373136
+32333861656163646332323239653364326163613361373435323966323964313831663138353063
+34653131383463623965386365326531616265653837363462653037386633376361383639656163
+39663338383939323535366135396465656333323331386462353630396237396261316137386165
+38383664613165356535356632376138623233386266336665386330376539373963323162613336
+62396364373031656238356163656464616430316131386537356236663536366461326462373236
+62396363303861303533643438343765356437326663316239613939386134333830303739386464
+63623834366565366163383533393532383061646163666133396136643462376537393935613039
+37623134313439393737626664663637343365373563376261666133346332373033613335316164
+39313733653931383665663238303532353165613131323731306362666138643737346337623064
+34666261323664363864373061666233613163336633383837323766386137323431626337623562
+36336234656635633830366635363463313439646165353261323030323261633737346664373738
+39633836366133633635303638366134393435393663366664623837336164323630353739333462
+36366663643931653230653562326633353637383564623266313936656239393535646131373261
+61356661663534393166383530373739343834313136663366316237333464326563336636656232
+66373035623866383931393238666132386331356530616535313164366466353563653865663832
+39353364396366663462366333306135343065373532663330643435336239353435303762326132
+65343630343532656638653462383266383937663466633034373661643862663933333838653032
+33656261396638666334626366356362623663613461303936323130353436363536663638383162
+63663931313335666435616561353266376134633132633233356435313137653132373935613931
+36623461396139633439396332393037616361316562613137646466613330653234656535623230
+66306434653462633834643036656263376366623835653163326461313831633934366663646566
+65393966373466326137353261383763346666386337666130646133643666656464616438383038
+31306130356238366261616231363933666162373639363463303962303833626135366666303962
+33316161343936393634303964396566653963333237393631353938386262623739393432383339
+37653430336265323133363937303362343336373230633333323764346139326662343434396566
+66383035613262366430303636323236663937393933646566373838383562316334633836633737
+65346537353439306363633431396338396632336565386434363530346365333765363930613063
+65333166393136633665663539656331663037353138366239383332373363366562613237373234
+64303963666462323330653364396464383464666434343831313338633764636337363761616337
+63313462303339643364383361376364366232326361613137326135333263313964616634383464
+61333539373962653338313835656632663261363766346535323735633437323736323632343434
+61643662613261613835366331303439313062313033623065323262356466656533623735643235
+61643332363333363032326434363065303566616661386261386165383066306161376531356334
+63323634356566333065383763333965613366656661313931386532623963383265613131666231
+61363465343462313531313464323731356637393061663133336665363965653035333030383062
+33653335363536656333333738356437316332313361633136396535643836633035303830323232
+65633761333135633739323061613436386166383762353564326430363965623461306235386132
+66366632643763306338373064613935643630616661353233663834396331643130396465636534
+33303830383139343836633163313737313738636365346639396162343561383965323636306466
+63343038363330313363663566656464383264326538303466323862663463353930376165326466
+66383630376465376139646562633065383434333365376362643038643064656364363538356661
+35303432646332623337353465656362656234333465383663353735663537643630616266383763
+30363239363132333166363563376665633936656535663164656532393666336265393964636333
+35323539383835366162326362333537363666386162376561373464323630303032613037636636
+37663135623933643938396635323763353931336531313732636530643865663430646530666465
+34383962353137366431633530376134323635336433653361316363316132383834663030393666
+66303935343839303337636630313138336239393062666265646163386332376536336439616463
+66316165393963333235353931326461626130306435373061626233616430343064303537373839
+63396464306164613863333434373063396534623739373730303135626639663731366666343733
+32313862306431626231373963396461656637313364343661663235323237316432353762383330
+32353736643766323964643035653661363532336261353334363936333766613739623638333861
+30343933613161643862623263623838623866356534323362623838656133663363353366633764
+38323931346630616664316365363463653637663762633138323230356263636634396165613337
+32656666363137623833366561643563613938623565636132313539383130633637313236333365
+32623663333164653733643063396230313033323636323164643534376333346637636436303935
+34346539663366623137326133383533396535376131626631326463323866353363656636313538
+33393731356632313263663533633762313534346435326533346635356162326466316662323230
+62376666666339623638356138353461313431333366633833323836313338643333366161306139
+35383163373139636137356235656564303666346531663663326134656165616435616163323361
+61346131613666653431656464353636303663653934393835373332663432303762393538616465
+63363566396464333861386135336132623539626432383762313762316135623566373937643532
+64653934383662663263303833383034366436613138373863316334376564616235313462363637
+62313166623261626537323631626432393033626233353137366262613134333565666666326332
+62616662653334323535373235616433653233336265343661363765623066363762353836666364
+35373865363165363234333038323437313561646338343930316661633365623938623665623434
+66383562653564623732356130326138346236343766306535386362373664623162393833656230
+35643535353238336361646534313133303835363837353966326538313161353737363939633961
+39626137366133373536326535613362313866303232396233313263363736646139366363303463
+65363266323565303733613065366237636233306137346233333839646438623038343764346462
+35306434336363333562356566636335613263643738313766636534316232653137346166363932
+32386336653265663665623736663330623036323762623562346164373631313533396437613438
+63373632633731333361366462653466346338366139353632616661626630306633363061373937
+36386635653537346535363030326566366165393839653534383065336638303862373366633263
+33633461663764356330333534373036343565313335363731646432323931613737353231636435
+38626361393264363039303831633535643366636365656538343763646538336138623961303064
+31343431616337316661313935333735613662383235663730373632336333346338623432623731
+39303261326363656638333165646661333735316130363234343661393463346132333333633533
+36393635396234623065626463646536633139333662396635303537653338313532313062653339
+65656639646364346265386361623330333666326338386334376366306339653230633334373438
+36333735393664626136

ansible/group_vars/ntp_servers/vars

@@ -0,0 +1,18 @@
+---
+# file: group_vars/ntp_servers/vars
+#Ansible vars template for NTP servers.
+
+ntp_servers:
+  - 0.us.pool.ntp.org
+  - 1.us.pool.ntp.org
+
+allowed_networks:
+  - "192.168.1.0/24"
+  - "192.168.2.0/24"
+  - "192.168.3.0/24"
+  - "192.168.5.0/24"
+  - "192.168.9.0/24"
+  - "192.168.10.0/24"
+  - "192.168.250.0/24"
+  - "10.1.71.0/24"
+  - "10.1.82.0/24"

ansible/group_vars/proxmox/oidc.yml

@@ -0,0 +1,19 @@
+---
+# ansible/group_vars/proxmox/oidc.yml
+#
+# Proxmox OIDC configuration for Authentik integration.
+# Client credentials come from vault.yml.
+
+proxmox_oidc_realm_name: "authentik"
+proxmox_oidc_issuer_url: "https://authentik.local.mk-labs.cloud/application/o/proxmox/"
+proxmox_oidc_username_claim: "username"
+proxmox_oidc_scopes: "openid email profile"
+proxmox_oidc_autocreate: true
+proxmox_oidc_default_realm: false
+proxmox_oidc_comment: "Authentik SSO"
+
+# ACL entries - grant your Authentik user admin access
+proxmox_oidc_acl_entries:
+  - path: "/"
+    user: "rblundon@authentik"
+    role: "Administrator"

ansible/group_vars/proxmox/vault

@@ -0,0 +1,17 @@
+$ANSIBLE_VAULT;1.1;AES256
+64613361376364346139313833613465663361336634326430393261366630306466363935613139
+3634363235343736643230623865386436333734663531310a343965396534336262356234623966
+39353332626662636666383935383530613139626439373664323063633063316264383331646533
+3366333837613731310a656462633638376432326365343135373863313665346566383933353630
+37303565323630633739396433323165326262363863386233343134636236646366633765616432
+33633165613239653762343935386637393437386431383961306436373765343736313634333933
+30376463646464303066613561613564353938306664373464333966383664383034616439343735
+38363966323366343465393530383736393364373361326234356365363163356632393834393464
+39393530356235383830323065636535383138353864373237333164323436623737383435313261
+64366362626232386438376131633533633162356432613835656465623762633464353936303236
+63353633633262633461353963653534663336396134373435303266386162393965343165303335
+65313436666334383965373837376664323861376162373834363439653539383231346634633737
+30626431373739633930313937643938343165383536373465613535366562313439396533643864
+36323032316131333962373732306334373939333363386564653465303261393337333466316130
+32326533353165393635393130396164636363623937313566343333386562616662383038613565
+35386638383365633362

ansible/host_vars/arcade/vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.111
+# vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/astro-orbiter/vars.yml

@@ -0,0 +1,25 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/host_vars/astro_orbiter/vars.yml
+# HOST: astro-orbiter (10.1.71.130)
+# ROLE: Ollama inference host with AMD RX 5700 GPU passthrough
+# ------------------------------------------------------------------------------
+
+ansible_host: 10.1.71.130
+ansible_user: wed
+ansible_become: true
+
+# LVM root expansion — xlarge template uses sda3 partition, standard VG/LV names
+common_expand_root_lvm: true
+common_root_pv: /dev/sda3
+common_root_vg: ubuntu-vg
+common_root_lv: ubuntu-lv
+
+# Ollama — all defaults apply; explicitly documented here for visibility
+ollama_rocm_version: "6.2"
+ollama_default_model: "qwen3:8b"
+ollama_hsa_override_gfx_version: "10.1.0"
+ollama_data_disk: /dev/sdb
+ollama_data_vg: ollama-vg
+ollama_data_lv: ollama-lv
+ollama_data_dir: /var/lib/ollama

ansible/host_vars/big-thunder-mountain/old_vars

@@ -0,0 +1,58 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.52
+vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/big-thunder-mountain/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.52
+vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/carousel-of-progress/vars.yml

@@ -0,0 +1,16 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/host_vars/astro_orbiter/vars.yml
+# HOST: astro-orbiter (10.1.71.130)
+# ROLE: Ollama inference host with AMD RX 5700 GPU passthrough
+# ------------------------------------------------------------------------------
+
+ansible_host: 10.1.71.131
+ansible_user: wed
+ansible_become: true
+
+# LVM root expansion — xlarge template uses sda3 partition, standard VG/LV names
+common_expand_root_lvm: true
+common_root_pv: /dev/sda3
+common_root_vg: ubuntu-vg
+common_root_lv: ubuntu-lv

ansible/host_vars/city-hall/vars

@@ -0,0 +1,48 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Fedora (42)
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+
+vm_clone_source: "fedora-42-small"
+
+# Proxmox storage target.
+
+vm_storage: "mk-general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.21
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/docker01/vars

@@ -1,9 +1,9 @@
 ---
-# file: host_vars/matchbox/vars
+# file: host_vars/docker01/vars
 
 # Networking
 # primary_interface: "enp1s0f0"
-mac_address: "BC:24:11:03:A9:7B"
+#mac_address: "BC:24:11:03:A9:7B"
 ip_address: 10.1.71.211
 hostname: "{{ inventory_hostname }}.{{ base_domain }}"
 

ansible/host_vars/guest-relations/vars

@@ -0,0 +1,12 @@
+---
+# file: host_vars/guest-relations/vars
+# guest-relations — Guest Relations
+# VM provisioned by Terraform (pre-pipeline bootstrap)
+
+# ─── Network ─────────────────────────────────────────────────────────────────
+ip_address: 10.1.71.40
+
+# ─── Application ─────────────────────────────────────────────────────────────
+app_role: identity_provider
+app_name: authentik
+app_deployment: docker_compose

ansible/host_vars/haunted-mansion/old_vars

@@ -0,0 +1,60 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.61
+vm_mac_address: 'BC:24:11:C9:3A:13'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/haunted-mansion/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.61
+vm_mac_address: 'BC:24:11:C9:3A:13'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/lightning_lane/vars

@@ -0,0 +1,12 @@
+---
+# file: host_vars/lightning_lane/vars
+# lightning-lane — Traefik Reverse Proxy / Load Balancer
+# VM provisioned by Terraform (pre-pipeline bootstrap)
+
+# ─── Network ─────────────────────────────────────────────────────────────────
+ip_address: 10.1.71.35
+
+# ─── Application ─────────────────────────────────────────────────────────────
+app_role: reverse_proxy
+app_name: traefik
+app_deployment: docker_compose

ansible/host_vars/main-street-station/main.yml

@@ -0,0 +1,16 @@
+---
+# Host-specific vars for main-street-station (JMRI headless server)
+# LCRR - Lake Country Railroad, Milwaukee Road Oct 1956, HO scale
+
+# JMRI profile ID — find with: ls ~/.jmri/profiles/ on the old box
+# Format: <name>.<8-char-hex>  e.g. LCRR.3d3f1dfc
+# TODO: fill in after restoring config from GitHub backup
+jmri_profile_id: ""
+
+# USB serial device for NCE command station
+# Verify after install: ls -la /dev/ttyUSB* /dev/ttyACM*
+jmri_serial_device: /dev/ttyUSB0
+
+# Path to JMRI config backup for restore task (leave empty to skip)
+# Point at a local checkout of the LCRR GitHub repo
+jmri_config_src: ""

ansible/host_vars/main-street-station/vars.yml

@@ -0,0 +1,10 @@
+---
+# main-street-station — JMRI / LCRR server
+jmri_profile_id: "Lake_Country_Railroad.3e8b1d4b"
+jmri_lcrr_repo: "ssh://git@gitea.mk-labs.cloud:2221/rblundon/LCRR.git"
+jmri_lcrr_branch: "clean-profile"
+jmri_leviton_email: "{{ leviton_email }}"
+jmri_leviton_password: "{{ leviton_password }}"
+jmri_ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnSM/9fO8rz/amqkyoGUzUKNNzzmtSXPwOCr1O9zKNO ansible"
+jmri_ssh_authorized_keys_extra:
+  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6HaK4Y21UwPRbAZ986L7I9QnUdyq53114+9kO8X4bL rblundon@laptop"

ansible/host_vars/peter-pans-flight/old_vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.62
+vm_mac_address: 'BC:24:11:AA:8F:3A'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/peter-pans-flight/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "xlarge"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.62
+vm_mac_address: 'BC:24:11:AA:8F:3A'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/space-mountain/old_vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.51
+vm_mac_address: 'BC:24:11:1A:E8:8C'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/space-mountain/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.51
+vm_mac_address: 'BC:24:11:1A:E8:8C'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/splash-mountain/old_vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.53
+vm_mac_address: 'BC:24:11:84:D7:2F'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/splash-mountain/vars

@@ -0,0 +1,99 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.53
+vm_mac_address: 'BC:24:11:84:D7:2F'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/splash/vars

@@ -0,0 +1,100 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts creation via clone or create.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "talos"
+vm_os_version: "1.11.5"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "liberty-tree"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "small"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "tomorrowland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+# Comment out vm_mac_address if new MAC address should be generated
+
+ip_address: 10.1.71.99
+vm_mac_address: 'BC:24:11:97:C3:AA'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+vm_definitions:
+  small:
+    cores: 2
+    memory: 2048
+    disk: 8
+  medium:
+    cores: 2
+    memory: 4096
+    disk: 16
+  large:
+    cores: 4
+    memory: 4096
+    disk: 32
+  large-plus:
+    cores: 4
+    memory: 4096
+    disk: 48
+  xlarge:
+    cores: 4
+    memory: 8192
+    disk: 64
+  xlarge-plus:
+    cores: 4
+    memory: 8192
+    disk: 128

ansible/host_vars/sundial/vars

@@ -0,0 +1,50 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Fedora (42)
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_clone_source: "fedora-42-small"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "fantasyland"
+proxmox_host_target: "fantasyland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.21
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/tiki-room/vars

@@ -0,0 +1,59 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts created via cloning.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+
+proxmox_clone_node: "fantasyland"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu 
+#    - 24.04
+# - Fedora
+#    - 42
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "pve03"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+
+ip_address: 10.1.71.23
+# vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/turnstile/vars

@@ -0,0 +1,27 @@
+---
+# file: host_vars/turnstile/vars
+# turnstile — Smallstep step-ca SSH Certificate Authority
+# VM provisioned by Terraform (pre-pipeline bootstrap)
+
+# ─── Network ─────────────────────────────────────────────────────────────────
+ip_address: 10.1.71.34
+
+# ─── Application ─────────────────────────────────────────────────────────────
+app_role: ssh_certificate_authority
+app_name: step-ca
+app_deployment: docker_compose
+
+# ─── step-ca Configuration ───────────────────────────────────────────────────
+stepca_hostname: turnstile.local.mk-labs.cloud
+stepca_dns_names: "turnstile.local.mk-labs.cloud,10.1.71.34"
+stepca_ssh_enabled: true
+stepca_listen_port: 9000
+
+# ─── OIDC Provisioner (Authentik) ────────────────────────────────────────────
+# Client ID and secret stored in vault
+stepca_oidc_provisioner_name: authentik
+stepca_oidc_configuration_endpoint: "https://authentik.local.mk-labs.cloud/application/o/step-ca/.well-known/openid-configuration"
+stepca_oidc_listen_address: ":10000"
+stepca_oidc_domains:
+  - "local.mk-labs.cloud"
+  - "protonmail.com"

ansible/host_vars/turnstile/vault

@@ -0,0 +1,17 @@
+$ANSIBLE_VAULT;1.1;AES256
+30383930323363386234333433636465393263613336646464666365643730386430353864616334
+3865343031653162313736656437373666636136653263360a613961646133376262633164393535
+31363434633634303035663133316230633538363936303266373931313661346563333832653032
+6239376363646530620a303231363333363233623038326165316463383662656565626534396232
+62333133623530643932643430663166373930353733363866336533643233373261333130613635
+31633337376337663833613634666436383862386431636537373363343333323932363761653366
+61353166613162346436396138316561646165303566376366323462663861616364336539313138
+30386430373566353761383636626335393463376661356666303861353564313832346333396134
+30653861363866336331336164323130623230666237356165613934333239386536373664643065
+33643139346562346663313533643433353462363665323166313364373335366665373435643935
+65303863663864393238393732303065343364306264396333376233666233346664323334336532
+38373164383835663163363137643531303163396236623565666436363261393563343133333161
+36663934303633663062346161636333396135336135616136303664636562363862353764343562
+39643430396636313139336130656363306562363430346233313530663963366238326334623135
+62383632613061316262323038303333323739303137363334626637666663666263613132336433
+65346266393733633632

ansible/host_vars/vm_template/vars

@@ -0,0 +1,104 @@
+---
+# file: host_vars/vm_template/vars
+# Ansible vars template for hosts creation via clone or create.
+
+# Supported hypervisors:
+# - Proxmox
+
+platform: "proxmox"
+
+# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
+# Current OS offerings are:
+# - Ubuntu (clone)
+#    - 24.04
+# - Fedora (clone)
+#    - 42
+# - Talos (create)
+#    - 1.11.5
+
+vm_os_distribution: "ubuntu"
+vm_os_version: "24.04"
+
+# VM ISO
+# Talos: talos-v1.11.5-nocloud-amd64.iso
+
+vm_iso_storage: "templates"
+vm_iso: "talos-v{{ vm_os_version }}-nocloud-amd64.iso"
+
+# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
+# Comment out for VM create
+
+proxmox_clone_node: "fantasyland"
+
+# Proxmox storage target.
+
+vm_storage: "general"
+
+# Current VM sizes are:
+# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
+# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
+# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
+# - Large Plus: 4 cores, 4GB memory, 48 GiB virtual disk
+# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
+# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
+
+vm_size: "large-plus"
+
+# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
+# and backup groups. (ha_group will be factored out in the next functionality update.)
+
+ha_group: "pve03"
+proxmox_host_target: "tomorrowland"
+
+# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
+# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
+# Comment out vm_mac_address if new MAC address should be generated
+
+ip_address: 10.1.71.249
+# vm_mac_address: 'BC:24:11:11:BC:58'
+
+# Software
+# Future enhancement will allow specification of additional software to automatically deploy to
+# the VM after creation.
+
+#terraform_version: "1.11.3"
+
+# ---
+
+vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
+hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn
+
+# Dictionaries for VM resources
+# - cores (quantity)
+# - memory (MB)
+# - virtual disk (GiB)
+
+small:
+  cores: 2
+  memory: 2048
+  disk: 8
+
+medium:
+  cores: 2
+  memory: 4096
+  disk: 16
+
+large:
+  cores: 4
+  memory: 4096
+  disk: 32
+
+large-plus:
+  cores: 4
+  memory: 4096
+  disk: 48
+
+xlarge:
+  cores: 4
+  memory: 8192
+  disk: 64
+
+xlarge-plus:
+  cores: 4
+  memory: 8192
+  disk: 128

ansible/inventory.yml

@@ -0,0 +1,125 @@
+# file: inventory.yml
+proxmox:
+  hosts:
+    main-street-usa:
+      ansible_host: 10.1.71.11
+      ansible_user: wed
+      ansible_become: true
+    tomorrowland:
+    fantasyland:
+
+magic_kingdom:
+  hosts:
+    main-street-usa:
+    tomorrowland:
+    fantasyland:
+
+dns_server:
+  hosts:
+    monorail:
+
+ntp_servers:
+  hosts:
+    sundial:
+    
+load_balancers:
+  hosts:
+    lightning-lane:
+      ansible_become: true
+
+step_ca_server:
+  hosts:
+    turnstile:
+      ansible_become: true
+
+authentik_server:
+  hosts:
+    guest-relations:
+      ansible_become: true
+
+gitea_servers:
+  hosts:
+    mad-tea-party:
+      ansible_user: wed
+      ansible_become: true
+
+nextcloud_server:
+  hosts:
+    the-grid:
+      ansible_become: true
+
+semaphore_server:
+  hosts:
+    figment:
+      ansible_host: 10.1.71.37
+      ansible_user: wed
+      ansible_become: true
+
+n8n_server:
+  hosts:
+    tiki-room:
+
+ollama_server:
+  hosts:
+    astro-orbiter:
+      ansible_host: 10.1.71.130
+      ansible_user: wed
+      ansible_become: true
+
+hermes_server:
+  hosts:
+    carousel-of-progress:
+      ansible_host: 10.1.71.131
+      ansible_user: wed
+      ansible_become: true
+
+honcho_server:
+  hosts:
+    lincoln:
+      ansible_host: 10.1.71.132
+      ansible_user: wed
+      ansible_become: true
+
+jmri_server:
+  hosts:
+    main-street-station:
+      ansible_host: 192.168.10.40
+      ansible_user: wed
+      ansible_become: true
+
+papermc_server:
+# ansible-galaxy role install engonzal.papermc
+  hosts:
+    arcade:
+
+dev_servers:
+  hosts:
+    scrim:
+    backstage:
+      ansible_host: 10.1.71.133
+      ansible_user: wed
+      ansible_become: true
+
+# dhcp_server:
+#   hosts:
+#     matchbox:
+
+backup_servers:
+  hosts:
+    timekeeper:
+
+talos_control:
+  hosts:
+    city-hall:
+      ansible_become: true
+  vars:
+    talosctl_version: "v1.12.4"
+    talos_cluster_name: "fastpass"
+
+# matchbox_server:
+#   hosts:
+#     matchbox:
+
+terraform_server:
+  hosts:
+    infra01:

ansible/mk

@@ -0,0 +1,5 @@
+space-mountain
+splash-mountain
+big-thunder-mountain
+peter-pans-flight
+haunted-mansion

ansible/playbooks/add_dhcp_reservation.yml

@@ -0,0 +1,84 @@
+---
+- name: Bind VM MAC address to IP address on Ubiquiti
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Set VM MAC address (if defined in vars)
+      delegate_to: "localhost"
+      community.proxmox.proxmox_kvm:
+        api_user: "{{ proxmox_user }}"
+        api_password: "{{ proxmox_password }}"
+        api_host: "{{ proxmox_host }}"
+        node: "{{ proxmox_clone_node }}"
+        vmid: "{{ vm_id }}"
+        net:
+          net0: "virtio={{ vm_mac_address }},bridge=vmbr0,firewall=1"
+        update: true
+        update_unsafe: true
+      when: vm_mac_address is defined
+
+    - name: Get VM MAC address from Proxmox (not defined in vars)
+      when: vm_mac_address is not defined
+      block:
+        - name: Retrieve information about specific VM by name and get current configuration
+          delegate_to: "localhost"
+          community.proxmox.proxmox_vm_info:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            name: "{{ inventory_hostname }}"
+            config: current
+          register: proxmox_vm_info
+
+        - name: Extract net0 information
+          ansible.builtin.set_fact:
+            vm_net0: "{{ proxmox_vm_info.proxmox_vms[0].config.net0 }}"
+
+        - name: Extract MAC address using regex
+          ansible.builtin.set_fact:
+            vm_mac_address: "{{ vm_net0 | regex_search('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}') }}"
+
+    - name: Assign VM MAC address to IP address on Ubiquiti with Terraform
+      when: vm_mac_address is defined
+      delegate_to: "{{ groups['terraform_server'][0] }}"
+      block:
+        - name: Create a directory if it does not exist
+          ansible.builtin.file:
+            path: "~/homelab/terraform/unifi-dhcp"
+            state: directory
+            mode: '0755'
+
+        - name: Create Unifi provider file from template
+          ansible.builtin.template:
+            src: templates/unifi_provider.tf.j2
+            dest: ~/homelab/terraform/unifi-dhcp/provider.tf
+            mode: '0644'
+
+        - name: Create Unifi user (host) file from template
+          ansible.builtin.template:
+            src: templates/unifi-user.tf.j2
+            dest: ~/homelab/terraform/unifi-dhcp/{{ inventory_hostname }}.tf
+            mode: '0644'
+
+        - name: Configure Unifi via Terraform
+          community.general.terraform:
+            project_path: ~/homelab/terraform/unifi-dhcp
+            state: present
+            force_init: true
+
+    # - name: Add line to hosts file
+    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
+    #   become: true
+    #   ansible.builtin.lineinfile:
+    #     path: /etc/dnsmasq.d/hosts.conf
+    #     regexp: "# {{ inventory_hostname }}$"
+    #     line: "dhcp-host={{ vm_mac_address | lower }},{{ ip_address }} # {{ inventory_hostname }}"
+    #     state: present
+    # # restart dnsmasq service
+    # - name: Restart service dnsmasq
+    #   delegate_to: "{{ groups['dhcp_server'][0] }}"
+    #   become: true
+    #   ansible.builtin.service:
+    #     name: dnsmasq
+    #     state: restarted

ansible/playbooks/add_dns_entry.yml

@@ -0,0 +1,13 @@
+---
+# Replacement for add_technitium_dns_entry.yml
+# This playbook uses the modular task file approach
+
+- name: Add DNS entry using Technitium DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Include Technitium DNS entry task
+      ansible.builtin.include_tasks: tasks/add_technitium_dns_entry.yml
+      vars:
+        host_name: "{{ inventory_hostname }}"

ansible/playbooks/add_service_route.yml

@@ -0,0 +1,95 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/add_service_route.yml
+# DESCRIPTION: Ensures all services in the Traefik dynamic config directory
+#              are routed and have DNS CNAME records on monorail.
+#
+#              1. Syncs boilerplates/traefik/dynamic/ to lightning-lane
+#              2. Scans the directory for service configs
+#              3. Extracts all hostnames from Host() rules (supports multi-host)
+#              4. Creates CNAME records for each hostname -> lightning-lane
+#
+# PREREQUISITES:
+#   - Service dynamic config YAML committed to boilerplates/traefik/dynamic/
+#   - vault_technitium_api_key defined in group_vars/all/vault
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/add_service_route.yml
+# ------------------------------------------------------------------------------
+
+- name: Sync Traefik routes and ensure DNS records
+  hosts: localhost
+  connection: local
+  gather_facts: false
+
+  vars:
+    base_domain: "local.mk-labs.cloud"
+    dns_server: "monorail"
+    traefik_host: "lightning-lane.local.mk-labs.cloud"
+    traefik_user: "wed"
+    traefik_dynamic_path: "/opt/docker/traefik/dynamic/"
+    dynamic_config_dir: "{{ playbook_dir }}/../../boilerplates/traefik/dynamic"
+
+    # Files in the dynamic directory that are NOT service routes
+    exclude_configs:
+      - default.yml
+
+  tasks:
+    # ── Step 1: Sync dynamic config to lightning-lane ──
+    - name: Sync Traefik dynamic configuration to lightning-lane
+      ansible.builtin.shell: >
+        rsync -av --delete
+        {{ dynamic_config_dir }}/
+        {{ traefik_user }}@{{ traefik_host }}:{{ traefik_dynamic_path }}
+      register: sync_result
+      changed_when: "'sending incremental file list' in sync_result.stdout"
+
+    # ── Step 2: Discover hostnames from Traefik router rules ──
+    - name: Find all dynamic config files
+      ansible.builtin.find:
+        paths: "{{ dynamic_config_dir }}"
+        patterns: "*.yml"
+      register: config_files
+
+    - name: Read config files
+      ansible.builtin.slurp:
+        src: "{{ item.path }}"
+      register: slurped_configs
+      loop: "{{ config_files.files }}"
+      when: item.path | basename not in exclude_configs
+
+    - name: Extract all hostnames from Host() rules
+      ansible.builtin.set_fact:
+        hostnames: >-
+          {% set hosts = [] -%}
+          {% for result in slurped_configs.results if result.content is defined -%}
+            {% set content = result.content | b64decode -%}
+            {% for match in content | regex_findall('Host\(`([^`]+)`\)') -%}
+              {% for h in match.split(' || ') -%}
+                {% set h = h | regex_replace('`', '') | trim -%}
+                {% if h.endswith('.local.mk-labs.cloud') and h not in hosts -%}
+                  {% set _ = hosts.append(h) -%}
+                {% endif -%}
+              {% endfor -%}
+            {% endfor -%}
+          {% endfor -%}
+          {{ hosts | unique | list }}
+
+    - name: Display hostnames to create
+      ansible.builtin.debug:
+        msg: "Hostnames found: {{ hostnames }}"
+
+    # ── Step 3: Create DNS CNAME records ──
+    - name: Create DNS CNAME record for each hostname
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        api_url: "http://{{ dns_server }}.{{ base_domain }}"
+        api_token: "{{ vault_technitium_api_key }}"
+        zone: "{{ base_domain }}"
+        name: "{{ item }}"
+        type: "CNAME"
+        cname: "lightning-lane.{{ base_domain }}"
+        ttl: 360
+        validate_certs: false
+      loop: "{{ hostnames }}"
+      loop_control:
+        label: "{{ item }}"

ansible/playbooks/add_technitium_dns_entry.yml.backup

@@ -0,0 +1,18 @@
+---
+- name: Add entry to Technitium DNS
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: "Create DNS entry for {{ inventory_hostname }}"
+      delegate_to: localhost
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        api_url: "http://{{ dns_server }}.{{ base_domain }}"
+        api_token: "{{ vault_technitium_api_key }}"
+        zone: "{{ base_domain }}"
+        name: "{{ inventory_hostname }}.{{ base_domain }}"
+        type: "A"
+        ipAddress: "{{ ip_address }}"
+        ptr: true
+        ttl: 360
+#        validate_certs: false

ansible/playbooks/configure_proxmox_oidc.yml

@@ -0,0 +1,20 @@
+---
+# ansible/playbooks/configure_proxmox_oidc.yml
+#
+# Configures Proxmox OIDC authentication with Authentik.
+# Only targets one node since realm config is cluster-wide.
+#
+# Usage:
+#   cd ansible
+#   ansible-playbook -i inventory.yml playbooks/configure_proxmox_oidc.yml
+#
+# To also set up ACL entries for your user:
+#   ansible-playbook -i inventory.yml playbooks/configure_proxmox_oidc.yml \
+#     -e '{"proxmox_oidc_acl_entries": [{"path": "/", "user": "rblundon@authentik", "role": "Administrator"}]}'
+
+- name: Configure Proxmox Authentik OIDC
+  hosts: main-street-usa
+  become: true
+  roles:
+    - role: proxmox
+      tags: [proxmox-oidc]

ansible/playbooks/configure_unbound.yml

@@ -0,0 +1,37 @@
+---
+- name: Master playbook to install and configure unbound
+  hosts: unbound_servers
+  become: true
+
+  tasks:
+    - name: Permit traffic in default zone for dns service
+      ansible.posix.firewalld:
+        service: dns
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Create the directory
+      ansible.builtin.file:
+        path: /etc/systemd/resolved.conf.d
+        state: directory
+        mode: '0755'
+        owner: root
+        group: root
+
+    - name: Put `unbound.conf` in the correct place
+      ansible.builtin.copy:
+        src: ../roles/common/files/unbound.conf
+        dest: /etc/systemd/resolved.conf.d/unbound.conf
+        mode: '0644'
+        owner: root
+        group: root
+
+    - name: Restart service systemd-resolved
+      ansible.builtin.service:
+        name: systemd-resolved
+        state: restarted
+
+    - name: Install unbound via role
+      ansible.builtin.import_role:
+        name: Anthony25.unbound

ansible/playbooks/create_vm.yml

@@ -0,0 +1,23 @@
+---
+- name: Master playbook to create VM
+  hosts: all
+  gather_facts: false
+
+- name: Proxmox Create VM Playbook
+  ansible.builtin.import_playbook: proxmox_create_vm.yml
+
+- name: Set cloud-init network
+  ansible.builtin.import_playbook: populate_cloud_init.yml
+  when: vm_os_distribution == "ubuntu"
+
+- name: DNS Playbook
+  ansible.builtin.import_playbook: add_dns_entry.yml
+
+- name: DHCP Playbook
+  ansible.builtin.import_playbook: add_dhcp_reservation.yml
+
+- name: Start VM Playbook
+  ansible.builtin.import_playbook: proxmox_start_vm.yml
+
+- name: Set Hostname Playbook
+  ansible.builtin.import_playbook: set_hostname.yml

ansible/playbooks/create_vm_from_clone.yml

@@ -6,11 +6,15 @@
 - name: Proxmox Clone VM Playbook
   ansible.builtin.import_playbook: proxmox_clone_vm.yml
 
+- name: Set cloud-init network
+  ansible.builtin.import_playbook: populate_cloud_init.yml
+  when: vm_os_distribution == "ubuntu"
+
 - name: DNS Playbook
   ansible.builtin.import_playbook: add_dns_entry.yml
 
 - name: DHCP Playbook
-  ansible.builtin.import_playbook: add_dhcp_entry.yml
+  ansible.builtin.import_playbook: add_dhcp_reservation.yml
 
 - name: Start VM Playbook
   ansible.builtin.import_playbook: proxmox_start_vm.yml

ansible/playbooks/day0_baseline.yml

@@ -0,0 +1,6 @@
+---
+- name: Apply day0 baseline
+  hosts: "{{ target | default('all') }}"
+  become: true
+  roles:
+    - day0-baseline

ansible/playbooks/day0_expand_root_lv.yml

@@ -0,0 +1,32 @@
+---
+# ============================================================================
+# day0_expand_root_lv.yml
+# ----------------------------------------------------------------------------
+# Reclaims unallocated PE on the root volume group, extending the root LV
+# to fill the VG and resizing the underlying filesystem (ext4 or xfs).
+#
+# Belongs to the day0 host-provisioning lifecycle. The Ubuntu Server
+# autoinstall template ships with the root LV at ~half the disk size by
+# default; this playbook is the canonical one-shot fix-up for that.
+#
+# Idempotent and safe to re-run. Hosts without LVM are no-op'd cleanly.
+#
+# Opt-out: set `expand_root_lv_skip: true` in host_vars/<host>.yml for
+# hosts where free PE should NOT be claimed by root (e.g. hosts with a
+# planned second LV in the same VG for application data).
+#
+# Usage:
+#   ansible-playbook playbooks/day0_expand_root_lv.yml
+#   ansible-playbook playbooks/day0_expand_root_lv.yml -e target=lincoln
+#   ansible-playbook playbooks/day0_expand_root_lv.yml -e target=honcho_server
+# ============================================================================
+
+- name: Expand root logical volume to fill VG
+  hosts: "{{ target | default('all') }}"
+  become: true
+  gather_facts: true
+  tasks:
+    - name: Apply expand_root_lv role unless host opts out
+      ansible.builtin.include_role:
+        name: expand_root_lv
+      when: not (expand_root_lv_skip | default(false) | bool)

ansible/playbooks/day0_linux_baseline.yml

@@ -0,0 +1,23 @@
+---
+# ============================================================================
+# day0_linux_baseline.yml
+# ----------------------------------------------------------------------------
+# Applies the mk-labs Linux baseline (linux-baseline role) to one or more
+# hosts. Idempotent and safe to re-run.
+#
+# Usage:
+#   ansible-playbook playbooks/day0_linux_baseline.yml
+#   ansible-playbook playbooks/day0_linux_baseline.yml -e target=figment
+#   ansible-playbook playbooks/day0_linux_baseline.yml -e target=semaphore_server
+#
+# To trigger an opt-in full system upgrade:
+#   ansible-playbook playbooks/day0_linux_baseline.yml \
+#     -e target=figment -e 'baseline_features={"full_upgrade": true}'
+# ============================================================================
+
+- name: Apply mk-labs Linux baseline
+  hosts: "{{ target | default('all') }}"
+  become: true
+  gather_facts: true
+  roles:
+    - linux-baseline

ansible/playbooks/day0_provision.yml

@@ -0,0 +1,30 @@
+---
+# ============================================================================
+# day0_provision.yml
+# ----------------------------------------------------------------------------
+# Umbrella day0 playbook. Runs the full host-provisioning lifecycle in
+# the correct order against newly-built VMs, so the operator runs ONE
+# command per new host rather than chaining day0 steps manually.
+#
+# Order matters:
+#   1. linux-baseline      — timezone, NTP, packages, SSH hardening, jarvis user
+#   2. expand_root_lv      — reclaim PE left unallocated by the Ubuntu
+#                            autoinstall template default
+#
+# Idempotent: every step is safe to re-run. Suitable to apply periodically
+# from Semaphore as a baseline-drift check.
+#
+# Usage:
+#   ansible-playbook playbooks/day0_provision.yml -e target=lincoln
+#   ansible-playbook playbooks/day0_provision.yml -e target=honcho_server
+#
+# For finer control over a single phase, the constituent playbooks are:
+#   playbooks/day0_linux_baseline.yml
+#   playbooks/day0_expand_root_lv.yml
+# ============================================================================
+
+- name: Import day0 linux baseline
+  ansible.builtin.import_playbook: day0_linux_baseline.yml
+
+- name: Import day0 expand root LV
+  ansible.builtin.import_playbook: day0_expand_root_lv.yml

ansible/playbooks/day1_configure_netbox_catalog.yml

@@ -0,0 +1,400 @@
+---
+# ansible/playbooks/day1_configure_netbox_catalog.yml
+#
+# Creates the tag taxonomy and custom fields in NetBox for service catalog
+# documentation. Run once (idempotent — uses name-based checks).
+#
+# Usage (from ansible/ directory):
+#   ansible-playbook playbooks/day1_configure_netbox_catalog.yml
+#
+# Requires:
+#   - vault_netbox_token in Ansible Vault
+#   - netbox reachable at http://fire-station.local.mk-labs.cloud
+
+- name: Configure NetBox service catalog taxonomy
+  hosts: localhost
+  gather_facts: false
+
+  vars_files:
+    - "{{ playbook_dir }}/../group_vars/all/vault"
+
+  vars:
+    netbox_url: "http://fire-station.local.mk-labs.cloud"
+    netbox_token: "{{ vault_netbox_token }}"
+    netbox_api: "{{ netbox_url }}/api"
+    headers:
+      Authorization: "Token {{ netbox_token }}"
+      Content-Type: "application/json"
+      Accept: "application/json"
+
+    # ── Tag definitions ───────────────────────────────────────────────────
+    tags:
+      # Infrastructure type
+      - name: k8s
+        slug: k8s
+        color: "2196f3"   # blue
+        description: "Workload running in the fastpass Kubernetes cluster"
+      - name: vm
+        slug: vm
+        color: "4caf50"   # green
+        description: "Traditional VM or LXC on Proxmox"
+      # Service tier
+      - name: platform
+        slug: platform
+        color: "9c27b0"   # purple
+        description: "Platform/infrastructure service (not user-facing)"
+      - name: application
+        slug: application
+        color: "ff9800"   # orange
+        description: "User-facing application workload"
+      # Service categories
+      - name: monitoring
+        slug: monitoring
+        color: "607d8b"   # grey
+        description: "Metrics, logging, alerting"
+      - name: auth
+        slug: auth
+        color: "607d8b"
+        description: "Authentication and SSO"
+      - name: gitops
+        slug: gitops
+        color: "607d8b"
+        description: "GitOps and CI/CD"
+      - name: dashboard
+        slug: dashboard
+        color: "607d8b"
+        description: "Dashboard and portal services"
+      - name: storage
+        slug: storage
+        color: "607d8b"
+        description: "Storage and file services"
+      - name: dns
+        slug: dns
+        color: "607d8b"
+        description: "DNS and name resolution"
+      - name: automation
+        slug: automation
+        color: "607d8b"
+        description: "Automation and orchestration"
+      - name: networking
+        slug: networking
+        color: "607d8b"
+        description: "Network infrastructure services"
+      - name: inference
+        slug: inference
+        color: "607d8b"
+        description: "AI/ML inference workloads"
+
+    # ── Custom field definitions ──────────────────────────────────────────
+    # object_types use app_label.model format
+    custom_fields:
+      - name: hostnames
+        label: Hostnames
+        type: longtext
+        object_types:
+          - ipam.ipaddress
+          - virtualization.virtualmachine
+        description: "All DNS names that resolve to this service (comma-separated)"
+        ui_visible: always
+        ui_editable: yes
+
+      - name: namespace
+        label: Namespace
+        type: text
+        object_types:
+          - ipam.ipaddress
+          - virtualization.virtualmachine
+        description: "Kubernetes namespace (blank for VM-based services)"
+        ui_visible: always
+        ui_editable: yes
+
+      - name: managed_by
+        label: Managed By
+        type: select
+        object_types:
+          - ipam.ipaddress
+          - virtualization.virtualmachine
+        description: "How this service is managed"
+        choices:
+          - ArgoCD
+          - Ansible
+          - Manual
+        ui_visible: always
+        ui_editable: yes
+
+      - name: thematic_name
+        label: Thematic Name
+        type: text
+        object_types:
+          - ipam.ipaddress
+          - virtualization.virtualmachine
+        description: "Disney/Magic Kingdom thematic hostname for this service"
+        ui_visible: always
+        ui_editable: yes
+
+  tasks:
+
+    # ── Tags ─────────────────────────────────────────────────────────────
+
+    - name: Fetch existing tags
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/tags/?limit=200"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: existing_tags_response
+
+    - name: Set existing tag slugs fact
+      ansible.builtin.set_fact:
+        existing_tag_slugs: "{{ existing_tags_response.json.results | map(attribute='slug') | list }}"
+
+    - name: Create tags
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/tags/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: "{{ item.name }}"
+          slug: "{{ item.slug }}"
+          color: "{{ item.color }}"
+          description: "{{ item.description }}"
+        status_code: 201
+      loop: "{{ tags }}"
+      when: item.slug not in existing_tag_slugs
+      register: tag_creation
+      changed_when: tag_creation.status == 201
+
+    # ── Custom Fields ─────────────────────────────────────────────────────
+
+    - name: Fetch existing custom fields
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/?limit=200"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: existing_cf_response
+
+    - name: Set existing custom field names fact
+      ansible.builtin.set_fact:
+        existing_cf_names: "{{ existing_cf_response.json.results | map(attribute='name') | list }}"
+
+    - name: Create custom field — hostnames
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: hostnames
+          label: Hostnames
+          type: longtext
+          object_types: "{{ custom_fields[0].object_types }}"
+          description: "{{ custom_fields[0].description }}"
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'hostnames' not in existing_cf_names"
+      register: cf_hostnames
+      changed_when: cf_hostnames.status == 201
+
+    - name: Create custom field — namespace
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: namespace
+          label: Namespace
+          type: text
+          object_types: "{{ custom_fields[1].object_types }}"
+          description: "{{ custom_fields[1].description }}"
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'namespace' not in existing_cf_names"
+      register: cf_namespace
+      changed_when: cf_namespace.status == 201
+
+    - name: Create choice set for managed_by field
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: managed-by-choices
+          extra_choices:
+            - - ArgoCD
+              - ArgoCD
+            - - Ansible
+              - Ansible
+            - - Manual
+              - Manual
+        status_code: [201, 400]
+      register: choice_set
+      changed_when: choice_set.status == 201
+
+    - name: Fetch choice set ID
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/?name=managed-by-choices"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: choice_set_response
+
+    - name: Create custom field — managed_by
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: managed_by
+          label: Managed By
+          type: select
+          object_types: "{{ custom_fields[2].object_types }}"
+          description: "{{ custom_fields[2].description }}"
+          choice_set: "{{ choice_set_response.json.results[0].id }}"
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'managed_by' not in existing_cf_names"
+      register: cf_managed_by
+      changed_when: cf_managed_by.status == 201
+
+    - name: Create custom field — thematic_name
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: thematic_name
+          label: Thematic Name
+          type: text
+          object_types: "{{ custom_fields[3].object_types }}"
+          description: "{{ custom_fields[3].description }}"
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'thematic_name' not in existing_cf_names"
+      register: cf_thematic_name
+      changed_when: cf_thematic_name.status == 201
+
+    # ── Provisioning Pipeline Fields ──────────────────────────────────────
+    # These fields drive the NetBox → n8n → Terraform pipeline.
+    # proxmox_datastore already exists — PATCH it to add utilidor choice.
+    # data_disk_enabled and data_disk_size_gb are new POSTs.
+
+    - name: Fetch proxmox_datastore field ID
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/?name=proxmox_datastore"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: proxmox_datastore_cf_response
+
+    - name: Fetch proxmox-datastore-choices choice set ID
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/?name=proxmox-datastore-choices"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: datastore_choice_set_response
+
+    - name: Create proxmox-datastore-choices choice set if missing
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: proxmox-datastore-choices
+          extra_choices:
+            - - liberty-tree
+              - liberty-tree
+            - - utilidor
+              - utilidor
+        status_code: [201, 400]
+      register: datastore_choice_set_create
+      changed_when: datastore_choice_set_create.status == 201
+      when: datastore_choice_set_response.json.count == 0
+
+    - name: Re-fetch proxmox-datastore-choices choice set ID after possible creation
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/?name=proxmox-datastore-choices"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: datastore_choice_set_response
+
+    - name: Patch proxmox_datastore field to use choice set with utilidor
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/{{ proxmox_datastore_cf_response.json.results[0].id }}/"
+        method: PATCH
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          choice_set: "{{ datastore_choice_set_response.json.results[0].id }}"
+        status_code: 200
+      when: proxmox_datastore_cf_response.json.count > 0
+      register: cf_datastore_patch
+      changed_when: cf_datastore_patch.status == 200
+
+    - name: Create custom field — data_disk_enabled
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: data_disk_enabled
+          label: Data Disk Enabled
+          type: boolean
+          object_types:
+            - virtualization.virtualmachine
+          description: "When true, Terraform provisions a second disk for application data storage."
+          default: false
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'data_disk_enabled' not in existing_cf_names"
+      register: cf_data_disk_enabled
+      changed_when: cf_data_disk_enabled.status == 201
+
+    - name: Create custom field — data_disk_size_gb
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: data_disk_size_gb
+          label: Data Disk Size (GB)
+          type: integer
+          object_types:
+            - virtualization.virtualmachine
+          description: "Size in GB for the optional second data disk. Only used when data_disk_enabled is true."
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'data_disk_size_gb' not in existing_cf_names"
+      register: cf_data_disk_size
+      changed_when: cf_data_disk_size.status == 201
+
+    # ── Summary ───────────────────────────────────────────────────────────
+
+    - name: Summary
+      ansible.builtin.debug:
+        msg:
+          - "Tags created: {{ tag_creation.results | selectattr('status', 'equalto', 201) | list | length }}"
+          - "Tags skipped (already exist): {{ tag_creation.results | selectattr('skipped', 'defined') | list | length }}"
+          - "Custom fields configured: hostnames, namespace, managed_by, thematic_name, proxmox_datastore (patched), data_disk_enabled, data_disk_size_gb"

ansible/playbooks/day1_deploy_authentik.yml

@@ -0,0 +1,18 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/deploy_authentik.yml
+# DESCRIPTION: Deploys Authentik identity provider on guest-relations.
+#              Installs Docker and configures Authentik with PostgreSQL and Redis.
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/deploy_authentik.yml
+# ------------------------------------------------------------------------------
+
+- name: Deploy Authentik identity provider
+  hosts: authentik_server
+  become: true
+
+  roles:
+    - common
+    - docker-host
+    - authentik

ansible/playbooks/day1_deploy_gitea.yml

@@ -0,0 +1,23 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/day1_deploy_gitea.yml
+# DESCRIPTION: Deploys Gitea + PostgreSQL on mad-tea-party (10.1.71.129)
+#              Role chain: common → docker-host → gitea
+#
+# USAGE:
+#   ansible-playbook -i ansible/inventory.yml ansible/playbooks/day1_deploy_gitea.yml
+#
+# SECRETS REQUIRED IN VAULT (group_vars/all/vault):
+#   vault_gitea_db_password
+# ------------------------------------------------------------------------------
+
+- name: Deploy Gitea on mad-tea-party
+  hosts: gitea_servers
+  become: true
+
+  vars:
+    gitea_db_password: "{{ vault_gitea_db_password }}"
+
+  roles:
+    - role: docker-host
+    - role: gitea

ansible/playbooks/day1_deploy_hermes.yml

@@ -0,0 +1,79 @@
+---
+# =============================================================================
+# day1_deploy_hermes.yml
+# Deploy Hermes Agent (Nous Research) on carousel-of-progress (10.1.71.131)
+#
+# FIRST-RUN WORKFLOW:
+#   1. Run this playbook:
+#        ansible-playbook playbooks/day1_deploy_hermes.yml
+#
+#   2. SSH to the host and run the setup wizard as the hermes user:
+#        ssh wed@carousel-of-progress.local.mk-labs.cloud
+#        sudo -u hermes hermes setup
+#
+#   3. Once configured, start and verify the service:
+#        sudo systemctl start hermes
+#        sudo systemctl status hermes
+#        sudo journalctl -u hermes -f
+#
+# VARIABLES:
+#   hermes_skip_browser: true   — set to skip Playwright/Chromium install
+#                                 (saves ~300MB if browser automation not needed)
+# =============================================================================
+
+- name: Deploy Hermes Agent on carousel-of-progress
+  hosts: carousel-of-progress
+  gather_facts: true
+
+  pre_tasks:
+    - name: Verify target is carousel-of-progress
+      ansible.builtin.assert:
+        that:
+          - inventory_hostname == "carousel-of-progress"
+        fail_msg: >
+          This playbook is scoped to carousel-of-progress only.
+          Got: {{ inventory_hostname }}
+
+    - name: Confirm OS is Ubuntu
+      ansible.builtin.assert:
+        that:
+          - ansible_distribution == "Ubuntu"
+        fail_msg: >
+          This playbook requires Ubuntu. Found: {{ ansible_distribution }}.
+          (If running Fedora, swap apt tasks for dnf and adjust Playwright deps.)
+
+  roles:
+    - role: hermes
+      vars:
+        hermes_skip_browser: false   # set true to skip Chromium install
+
+  post_tasks:
+    - name: Verify hermes binary is accessible system-wide
+      ansible.builtin.command: hermes --version
+      register: hermes_version_check
+      changed_when: false
+      failed_when: hermes_version_check.rc != 0
+
+    - name: Print hermes version
+      ansible.builtin.debug:
+        msg: "{{ hermes_version_check.stdout }}"
+
+    - name: Print post-install instructions
+      ansible.builtin.debug:
+        msg:
+          - "============================================================"
+          - "Hermes installed on carousel-of-progress (10.1.71.131)"
+          - "============================================================"
+          - "Next steps:"
+          - "  1. SSH to the host:"
+          - "       ssh wed@carousel-of-progress.local.mk-labs.cloud"
+          - "  2. Run the setup wizard as the hermes user:"
+          - "       sudo -u hermes hermes setup"
+          - "  3. After config, start the service:"
+          - "       sudo systemctl start hermes"
+          - "  4. Verify:"
+          - "       sudo systemctl status hermes"
+          - "       sudo journalctl -u hermes -f"
+          - "============================================================"
+          - "Service is ENABLED but NOT STARTED — config required first."
+          - "============================================================"

ansible/playbooks/day1_deploy_honcho.yml

@@ -0,0 +1,18 @@
+---
+# ============================================================================
+# day1_deploy_honcho.yml
+# ----------------------------------------------------------------------------
+# Deploys Honcho + pgvector PostgreSQL on the `lincoln` host. Assumes day0
+# host provisioning (linux-baseline + expand_root_lv) is already complete.
+#
+# Run via:
+#   ansible-playbook -i inventory.yml playbooks/day0_provision.yml -e target=lincoln
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_honcho.yml
+# ============================================================================
+
+- name: Deploy Honcho on lincoln
+  hosts: honcho_server
+  become: true
+  gather_facts: true
+  roles:
+    - honcho

ansible/playbooks/day1_deploy_jmri.yml

@@ -0,0 +1,24 @@
+---
+# ============================================================================
+# day1_deploy_jmri.yml
+# ----------------------------------------------------------------------------
+# Deploys JMRI JmriFaceless headless server on main-street-station.
+# Applies linux-baseline first, then the jmri role.
+#
+# Usage:
+#   ansible-playbook playbooks/day1_deploy_jmri.yml
+#   ansible-playbook playbooks/day1_deploy_jmri.yml -e target=main-street-station
+#
+# Prerequisites:
+#   1. Host is in inventory under jmri_server group
+#   2. jmri_profile_id is set in host_vars/main-street-station.yml
+#   3. SSH access as 'wed' with sudo
+# ============================================================================
+
+- name: Deploy JMRI headless server
+  hosts: "{{ target | default('jmri_server') }}"
+  become: true
+  gather_facts: true
+  roles:
+    - linux-baseline
+    - jmri

ansible/playbooks/day1_deploy_nextcloud.yml

@@ -0,0 +1,91 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/day1_deploy_nextcloud.yml
+# DESCRIPTION: Deploys Nextcloud on the-grid
+#              Runs: docker-host → nextcloud
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_nextcloud.yml
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_nextcloud.yml --limit the-grid
+#
+# SECRETS REQUIRED IN VAULT (group_vars/all/vault):
+#   vault_nextcloud_db_root_password
+#   vault_nextcloud_db_password
+#   vault_nextcloud_admin_user
+#   vault_nextcloud_admin_password
+# ------------------------------------------------------------------------------
+
+- name: Deploy Nextcloud on the-grid
+  hosts: the-grid
+  become: true
+
+  vars:
+    # NFS prerequisite
+    nfs_packages:
+      - nfs-common
+
+    # Compose stack location
+    nextcloud_base_dir: /opt/docker/nextcloud
+
+    # Secrets from vault
+    nextcloud_db_root_password: "{{ vault_nextcloud_db_root_password }}"
+    nextcloud_db_password:      "{{ vault_nextcloud_db_password }}"
+    nextcloud_admin_user:       "{{ vault_nextcloud_admin_user }}"
+    nextcloud_admin_password:   "{{ vault_nextcloud_admin_password }}"
+
+  pre_tasks:
+    - name: Install NFS client
+      ansible.builtin.apt:
+        name: "{{ nfs_packages }}"
+        state: present
+        update_cache: true
+
+  roles:
+    - role: docker-host
+
+  tasks:
+    - name: Create Nextcloud directory
+      ansible.builtin.file:
+        path: "{{ nextcloud_base_dir }}"
+        state: directory
+        owner: "{{ ansible_user }}"
+        group: docker
+        mode: "0775"
+
+    - name: Deploy Compose file
+      ansible.builtin.copy:
+        src: "{{ playbook_dir }}/../../boilerplates/nextcloud/compose.yml"
+        dest: "{{ nextcloud_base_dir }}/compose.yml"
+        owner: "{{ ansible_user }}"
+        group: docker
+        mode: "0644"
+
+    - name: Deploy .env from vault
+      ansible.builtin.copy:
+        content: |
+          # Managed by Ansible — do not edit manually
+          MYSQL_ROOT_PASSWORD={{ nextcloud_db_root_password }}
+          MYSQL_PASSWORD={{ nextcloud_db_password }}
+          NEXTCLOUD_ADMIN_USER={{ nextcloud_admin_user }}
+          NEXTCLOUD_ADMIN_PASSWORD={{ nextcloud_admin_password }}
+        dest: "{{ nextcloud_base_dir }}/.env"
+        owner: "{{ ansible_user }}"
+        group: docker
+        mode: "0600"
+
+    - name: Start Nextcloud stack
+      community.docker.docker_compose_v2:
+        project_src: "{{ nextcloud_base_dir }}"
+        state: present
+
+    - name: Wait for Nextcloud to become ready
+      ansible.builtin.uri:
+        url: "http://the-grid.local.mk-labs.cloud/status.php"
+        status_code: 200
+        return_content: true
+      register: nextcloud_status
+      until: >
+        nextcloud_status.status == 200 and
+        (nextcloud_status.content | from_json).installed == true
+      retries: 20
+      delay: 15

ansible/playbooks/day1_deploy_ollama.yml

@@ -0,0 +1,35 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/day1_deploy_ollama.yml
+# DESCRIPTION: Deploys Ollama with ROCm GPU acceleration on astro-orbiter.
+#              Assumes day0_baseline.yml has already run (common role complete).
+#              PCIe passthrough for the RX 5700 must be configured in Proxmox
+#              and the GPU must be visible to the VM before running this playbook.
+#
+# Pre-flight check:
+#   ssh wed@astro-orbiter 'lspci | grep -i amd'
+#   Should show the RX 5700 before proceeding.
+#
+# Usage (from ansible/ directory):
+#   ansible-playbook playbooks/day1_deploy_ollama.yml
+# ------------------------------------------------------------------------------
+
+- name: Deploy Ollama with ROCm on astro-orbiter
+  hosts: astro-orbiter
+  become: true
+
+  pre_tasks:
+    - name: Verify AMD GPU is visible to the VM
+      command: lspci
+      register: lspci_output
+      changed_when: false
+
+    - name: Fail if no AMD GPU detected
+      fail:
+        msg: >
+          No AMD GPU detected via lspci. Verify PCIe passthrough is configured
+          in Proxmox and the RX 5700 is visible to the VM before proceeding.
+      when: "'AMD' not in lspci_output.stdout and 'Radeon' not in lspci_output.stdout"
+
+  roles:
+    - ollama

ansible/playbooks/day1_deploy_semaphore.yml

@@ -0,0 +1,17 @@
+---
+# ============================================================================
+# day1_deploy_semaphore.yml
+# ----------------------------------------------------------------------------
+# Deploys SemaphoreUI + PostgreSQL on the imagineering host (figment).
+# Run AFTER day0_linux_baseline.yml has been applied to the target.
+#
+# Usage:
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_semaphore.yml
+# ============================================================================
+
+- name: Deploy SemaphoreUI on imagineering
+  hosts: semaphore_server
+  become: true
+  gather_facts: true
+  roles:
+    - semaphore

ansible/playbooks/day1_deploy_traefik.yml

@@ -0,0 +1,18 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/deploy_traefik.yml
+# DESCRIPTION: Deploys Traefik reverse proxy on lightning-lane.
+#              Installs Docker and configures Traefik with Cloudflare DNS-01
+#              certificate resolution for *.local.mk-labs.cloud
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/deploy_traefik.yml
+# ------------------------------------------------------------------------------
+
+- name: Deploy Traefik reverse proxy
+  hosts: load_balancers
+  become: true
+
+  roles:
+    - docker-host
+    - traefik

ansible/playbooks/day1_docker.yml

@@ -0,0 +1,7 @@
+---
+- name: Apply common role
+  hosts: "{{ target | default('all') }}"
+  become: true
+  roles:
+    - common
+    - docker-host

ansible/playbooks/day2_install_node_exporter.yml

@@ -0,0 +1,80 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/day2_install_node_exporter.yml
+# DESCRIPTION: Install and configure Prometheus Node Exporter on Linux hosts.
+#
+# Targets two groups with different firewall managers:
+#   - proxmox_nodes  : Proxmox hypervisors (Debian, firewalld not present,
+#                      uses iptables/no firewall — just open the port via UFW
+#                      if present, otherwise skip)
+#   - monitored_vms  : Ubuntu VMs managed by UFW
+#
+# After installing on new hosts, re-runs day1_deploy_monitoring.yml to refresh
+# the Prometheus scrape config is NOT needed — targets are already statically
+# defined in prometheus.yaml.j2 for the Proxmox nodes. For new VMs, add the
+# IP to the prometheus.yaml.j2 proxmox-vms job and re-run day1_deploy_monitoring.yml.
+#
+# Usage:
+#   ansible-playbook -i inventory.yml playbooks/day2_install_node_exporter.yml
+#   ansible-playbook -i inventory.yml playbooks/day2_install_node_exporter.yml --limit proxmox_nodes
+#   ansible-playbook -i inventory.yml playbooks/day2_install_node_exporter.yml --limit monitored_vms
+# ------------------------------------------------------------------------------
+
+# ── Play 1: Proxmox hypervisors ───────────────────────────────────────────────
+# Proxmox runs Debian. The prometheus.prometheus.node_exporter role installs
+# a binary + systemd service without touching apt, which is what we want on
+# hypervisors (keep the package footprint clean).
+# Note: Proxmox does not run UFW. Port 9100 is open by default on VLAN 71.
+
+- name: Install Node Exporter on Proxmox hypervisors
+  hosts: proxmox_nodes
+  become: true
+
+  vars:
+    node_exporter_version: "1.9.1"
+    node_exporter_web_listen_address: "0.0.0.0:9100"
+    node_exporter_enabled_collectors:
+      - systemd
+      - processes
+      - filesystem
+      - meminfo
+      - cpu
+      - diskstats
+      - netdev
+      - loadavg
+      - uname
+
+  roles:
+    - role: prometheus.prometheus.node_exporter
+
+# ── Play 2: Ubuntu VMs ────────────────────────────────────────────────────────
+# Standard Ubuntu hosts with UFW. Same role, adds UFW allow rule for 9100.
+
+- name: Install Node Exporter on monitored VMs
+  hosts: monitored_vms
+  become: true
+
+  vars:
+    node_exporter_version: "1.9.1"
+    node_exporter_web_listen_address: "0.0.0.0:9100"
+    node_exporter_enabled_collectors:
+      - systemd
+      - processes
+      - filesystem
+      - meminfo
+      - cpu
+      - diskstats
+      - netdev
+      - loadavg
+      - uname
+
+  pre_tasks:
+    - name: Open Node Exporter port in UFW
+      community.general.ufw:
+        rule: allow
+        port: "9100"
+        proto: tcp
+        comment: "Prometheus Node Exporter"
+
+  roles:
+    - role: prometheus.prometheus.node_exporter

ansible/playbooks/deploy_n8n_server.yml

@@ -0,0 +1,5 @@
+- name: 1. Deploy n8n server
+  hosts: n8n_server
+  gather_facts: true
+  roles:
+    - role: n8n

ansible/playbooks/deploy_ntp_servers.yml

@@ -0,0 +1,5 @@
+- name: 1. Deploy NTP servers
+  hosts: ntp_servers
+  gather_facts: true
+  roles:
+    - role: ntp-server

ansible/playbooks/deploy_step_ca.yml

@@ -0,0 +1,29 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/deploy_step_ca.yml
+# DESCRIPTION: Deploys Smallstep step-ca SSH Certificate Authority on turnstile.
+#              Installs Docker and configures step-ca with SSH certificate support.
+#
+# PREREQUISITES:
+#   - VM provisioned via Terraform
+#   - DNS record for turnstile.local.mk-labs.cloud on monorail
+#   - Authentik OIDC application created (for post-init provisioner setup)
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/deploy_step_ca.yml
+#
+# POST-DEPLOY:
+#   1. Note the CA fingerprint from the init output
+#   2. Add the OIDC provisioner (see docs/guides/step-ca-setup.md)
+#   3. Deploy Traefik route via update_traefik_routes.yml
+#   4. Bootstrap client workstations with: step ca bootstrap
+# ------------------------------------------------------------------------------
+
+- name: Deploy step-ca SSH Certificate Authority
+  hosts: step_ca_server
+  become: true
+
+  roles:
+    - common
+    - docker-host
+    - step-ca

ansible/playbooks/enroll_step_ca_client.yml

@@ -0,0 +1,7 @@
+---
+- name: Enroll host as step-ca SSH client
+  hosts: "{{ target | default('all') }}"
+  become: true
+  tasks:
+    - name: Include step-ca client enrollment
+      ansible.builtin.include_tasks: roles/common/tasks/step_ca_client.yml

ansible/playbooks/install_monitoring.yml

@@ -0,0 +1,67 @@
+---
+- name: Master playbook to install and configure prometheus
+  hosts: prometheus_server
+  become: true
+
+  tasks:
+    - name: Install prerequisite software
+      ansible.builtin.dnf:
+        name:
+          - tar
+          - python3-dnf
+        state: present
+
+    - name: Permit prometheus metrics in default zone for dns service
+      ansible.posix.firewalld:
+        port: 9100/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Permit traffic in default zone for dns service
+      ansible.posix.firewalld:
+        port: 9090/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Install prometheus via role
+      ansible.builtin.import_role:
+        name: prometheus.prometheus.prometheus
+      vars:
+        prometheus_targets:
+          node:
+          - targets:
+            - localhost:9100
+            labels:
+              env: mk-labs
+
+    - name: Permit grafana in default zone for dns service
+      ansible.posix.firewalld:
+        port: 3000/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Install grafana via role
+      ansible.builtin.import_role:
+        name: grafana.grafana.grafana
+
+    # - name: Create/Update Data sources
+    #   grafana.grafana.datasource:
+    #     dataSource: |
+    #       {
+    #         "name": "Prometheus",
+    #         "type": "prometheus",
+    #         "access": "proxy",
+    #         "url": "http://localhost:9090",
+    #         "jsonData": {
+    #           "httpMethod": "POST",
+    #           "manageAlerts": true,
+    #           "prometheusType": "Prometheus",
+    #           "cacheLevel": "High"
+    #         }
+    #       }
+    #     grafana_url: "{{ grafana_url }}"
+    #     grafana_api_key: "{{ grafana_api_key }}"
+    #     state: present

ansible/playbooks/install_talosctl.yml

@@ -0,0 +1,15 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/install_talosctl.yml
+# DESCRIPTION: Install talosctl on city-hall for managing the fastpass cluster.
+# USAGE:
+#   cd ansible
+#   ansible-playbook -i inventory.yml playbooks/install_talosctl.yml
+# ------------------------------------------------------------------------------
+
+- name: Install talosctl
+  hosts: talos_control
+  become: true
+
+  roles:
+    - talosctl

ansible/playbooks/node_explorer.yml

@@ -0,0 +1,16 @@
+---
+- name: Master playbook to install and configure prometheus node explorer
+  hosts: prometheus_server
+  become: true
+
+  tasks:
+    - name: Permit prometheus metrics in default zone for dns service
+      ansible.posix.firewalld:
+        port: 9100/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Install prometheus node exporter via role
+      ansible.builtin.import_role:
+        name: prometheus.prometheus.node_exporter

ansible/playbooks/populate_cloud_init.yml

@@ -0,0 +1,31 @@
+---
+- name: Create VM ID from IP address for Proxmox hosts
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Modify Proxmox Ubuntu VM
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      block:
+        - name: Update cloud-init file
+          community.proxmox.proxmox_kvm:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            node: "{{ proxmox_clone_node }}"
+            vmid: "{{ vm_id }}"
+            ipconfig:
+              ipconfig0: "ip=dhcp"
+            update: true
+
+        # - name: Add VM to HA group
+        #   community.proxmox.proxmox_cluster_ha_resources:
+        #     api_user: "{{ proxmox_user }}"
+        #     api_password: "{{ proxmox_password }}"
+        #     api_host: "{{ proxmox_host }}"
+        #     name: vm:"{{ vm_id }}"
+        #     state: "present"
+        #     group: "{{ ha_group }}"
+        #     max_relocate: 2
+        #     max_restart: 2

ansible/playbooks/prometheus_grafana_server.yml

@@ -0,0 +1,143 @@
+---
+- name: Install Prometheus and Grafana on control node
+  hosts: prometheus_server
+  become: true
+  # vars_files:
+  #   - vars.yml
+  tasks:
+    - name: Install prerequisite software
+      ansible.builtin.dnf:
+        name: 
+          - tar
+          - wget
+        state: present
+
+    - name: Download Prometheus
+      ansible.builtin.get_url:
+        url: "{{ prometheus_installer_download_url }}"
+        dest: "/tmp/{{ prometheus_installer_file }}"
+
+    - name: Extract Prometheus
+      ansible.builtin.unarchive:
+        src: "/tmp/{{ prometheus_installer_file }}"
+        dest: "/usr/local/bin/"
+        remote_src: true
+
+    - name: Create Prometheus user
+      user:
+        name: prometheus
+        shell: /bin/false
+        state: present
+
+    - name: Create Prometheus directories
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: directory
+        owner: prometheus
+        group: prometheus
+      with_items:
+        - /etc/prometheus
+        - /var/lib/prometheus
+
+    - name: Move Prometheus binaries
+      ansible.builtin.command: "mv /usr/local/bin/prometheus-{{ prometheus_version }}.linux-amd64/prometheus /usr/local/bin/prometheus"
+
+    - name: Move Prometheus tool
+      ansible.builtin.command: "mv /usr/local/bin/prometheus-{{ prometheus_version }}.linux-amd64/promtool /usr/local/bin/promtool"
+
+    - name: Create Prometheus configuration file
+      ansible.builtin.copy:
+        dest: "/etc/prometheus/prometheus.yml"
+        content: |
+          global:
+            scrape_interval: 15s
+            evaluation_interval: 15s
+
+          scrape_configs:
+            - job_name: 'prometheus'
+              static_configs:
+                - targets: ['localhost:9090']
+
+            - job_name: 'nodes'
+              static_configs:
+                - targets:
+                  {% for ip in prometheus_nodes %}
+                  - '{{ ip }}:9100'
+                  {% endfor %}
+
+    - name: Create Prometheus service file
+      ansible.builtin.copy:
+        dest: "/etc/systemd/system/prometheus.service"
+        content: |
+          [Unit]
+          Description=Prometheus
+          Wants=network-online.target
+          After=network-online.target
+
+          [Service]
+          User=prometheus
+          Group=prometheus
+          Type=simple
+          ExecStart=/usr/local/bin/prometheus \
+            --config.file=/etc/prometheus/prometheus.yml \
+            --storage.tsdb.path=/var/lib/prometheus/ \
+            --web.console.templates=/etc/prometheus/consoles \
+            --web.console.libraries=/etc/prometheus/console_libraries
+
+          [Install]
+          WantedBy=multi-user.target
+
+      register: prometheus_service_status
+      ignore_errors: true
+
+    - name: Check if Prometheus service is running
+      ansible.builtin.command: systemctl is-active prometheus
+      register: prometheus_status
+      changed_when: false
+      ignore_errors: true
+
+    - name: Permit prometheus endpoint in default zone for dns service
+      firewalld:
+        port: 9090/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Permit prometheus metrics in default zone for dns service
+      firewalld:
+        port: 9100/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Permit grafana traffic in default zone for dns service
+      firewalld:
+        port: 3000/tcp
+        permanent: true
+        immediate: true
+        state: enabled
+
+    - name: Manage Prometheus service state
+      systemd:
+        name: prometheus
+        state: "{{ 'restarted' if prometheus_status.rc == 0 else 'started' }}"
+        enabled: true
+
+    - name: Add repository
+      ansible.builtin.yum_repository:
+        name: grafana
+        description: Grafana OSS repo
+        baseurl: https://rpm.grafana.com
+        gpgkey: https://rpm.grafana.com/gpg.key
+
+    - name: Install Grafana
+      ansible.builtin.dnf:
+        name: 
+          - grafana
+        state: present
+
+    - name: Start Grafana service
+      systemd:
+        name: grafana-server
+        state: started
+        enabled: true

ansible/playbooks/proxmox_clone_vm.yml

@@ -22,7 +22,8 @@
             name: "{{ inventory_hostname }}"
             node: "{{ proxmox_clone_node }}"
             storage: "{{ vm_storage }}"
-            format: raw
+            format: qcow2 # raw
+            timeout: 600
 
         # - name: Add VM to HA group
         #   community.proxmox.proxmox_cluster_ha_resources:

ansible/playbooks/proxmox_create_vm.yml

@@ -0,0 +1,50 @@
+---
+- name: Create VM ID from IP address for Proxmox hosts
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Create Proxmox VMs
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      block:
+        - name: Create VM ID from IP address
+          ansible.builtin.set_fact:
+            vm_id: "{{ ip_address.split('.')[-2] }}{{ '%03d' % (ip_address.split('.')[-1] | int) }}"
+
+        - name: Create VM with an EFI disk, with Secure Boot disabled by default
+          community.proxmox.proxmox_kvm:
+            api_user: "{{ proxmox_user }}"
+            api_password: "{{ proxmox_password }}"
+            api_host: "{{ proxmox_host }}"
+            name: "{{ inventory_hostname }}"
+            node: "{{ proxmox_clone_node }}"
+            vmid: "{{ vm_id }}"
+            net:
+              net0: "virtio,bridge=vmbr0"
+            ide:
+              ide0: "{{ vm_iso_storage }}:iso/{{ vm_iso }},media=cdrom"
+            scsihw: "virtio-scsi-single"
+            scsi:
+              scsi0: "{{ vm_storage }}:{{ vm_definitions[vm_size]['disk'] }},format=qcow2"
+            bios: "ovmf"
+            cpu: "x86-64-v2"
+            cores: "{{ vm_definitions[vm_size]['cores'] }}"
+            memory: "{{ vm_definitions[vm_size]['memory'] }}"
+            efidisk0:
+              storage: "{{ vm_storage }}"
+              format: raw
+              efitype: 4m
+              pre_enrolled_keys: false
+            timeout: 600
+
+        # - name: Add VM to HA group
+        #   community.proxmox.proxmox_cluster_ha_resources:
+        #     api_user: "{{ proxmox_user }}"
+        #     api_password: "{{ proxmox_password }}"
+        #     api_host: "{{ proxmox_host }}"
+        #     name: vm:"{{ vm_id }}"
+        #     state: "present"
+        #     group: "{{ ha_group }}"
+        #     max_relocate: 2
+        #     max_restart: 2

ansible/playbooks/proxmox_start_vm.yml

@@ -0,0 +1,40 @@
+---
+- name: Create VM ID from IP address for Proxmox hosts
+  hosts: all
+  gather_facts: false
+
+  tasks:
+    - name: Start Proxmox VM
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      community.proxmox.proxmox_kvm:
+        api_user: "{{ proxmox_user }}"
+        api_password: "{{ proxmox_password }}"
+        api_host: "{{ proxmox_host }}"
+        name: "{{ inventory_hostname }}"
+        node: "{{ proxmox_clone_node }}"
+        state: started
+
+    - name: Wait for SSH service to be ready
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      ansible.builtin.wait_for:
+        port: 22
+        host: "{{ inventory_hostname }}"
+        search_regex: OpenSSH
+        timeout: 300
+        msg: "Waiting for SSH service to be ready on {{ inventory_hostname }}"
+
+    - name: Wait for VM to be fully booted and responsive
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      ansible.builtin.wait_for_connection:
+        connect_timeout: 10
+        sleep: 5
+        timeout: 300
+
+    - name: Display VM startup completion
+      delegate_to: "localhost"
+      when: platform is defined and platform == "proxmox"
+      ansible.builtin.debug:
+        msg: "✅ {{ inventory_hostname }} is now running and accessible via SSH"

ansible/playbooks/set_hostname.yml

@@ -9,4 +9,8 @@
       delegate_to: "{{ inventory_hostname }}"
       ansible.builtin.hostname:
         name: "{{ hostname }}"
-        #delay: 20
+
+    - name: Set timezone to US/Central
+      become: true
+      community.general.timezone:
+        name: US/Central

ansible/playbooks/templates/agent-config.yaml.j2

@@ -0,0 +1,42 @@
+apiVersion: v1alpha1
+kind: AgentConfig
+metadata:
+  name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
+rendezvousIP: {{ hostvars[groups[cluster_group][0]].ip_address }}
+bootArtifactsBaseURL: {{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/hub/
+hosts:
+{% for host in groups[cluster_group] %}
+  - hostname: {{ host }}
+    role: {{ hostvars[host].node_role | default('master') }}
+    interfaces:
+      - name: {{ hostvars[host].primary_interface }}
+        macAddress: {{ hostvars[host].install_mac_address }}
+    networkConfig:
+      interfaces:
+        - name: {{ hostvars[host].primary_interface }}
+          type: ethernet
+          state: up
+          identifier: mac-address
+          mac-address: {{ hostvars[host].install_mac_address }}
+          ipv4:
+            enabled: true
+            dhcp: true
+{% if hostvars[host].boot_mac_address != hostvars[host].install_mac_address %}
+        - name: {{ hostvars[host].boot_interface }}
+          type: ethernet
+          state: down
+          identifier: mac-address
+          mac-address: {{ hostvars[host].boot_mac_address }}
+{% endif %}
+      dns-resolver:
+        config:
+          server:
+            - 10.1.71.251
+            - 10.1.71.252
+      routes:
+        config:
+          - destination: 0.0.0.0/0
+            next-hop-address: 10.1.71.1
+            next-hop-interface: {{ hostvars[host].primary_interface }}
+            table-id: 254
+{% endfor %}

ansible/playbooks/templates/groups.tf.j2

@@ -0,0 +1,14 @@
+// Matcher group for OCP Internal machines
+{% for host in groups[cluster_group] %}
+resource "matchbox_group" "{{ host }}" {
+  name = "{{ host }}" # Physical Server
+  profile = matchbox_profile.openshift-agent-install.name
+  selector = {
+{% if hostvars[host].boot_mac_address == hostvars[host].install_mac_address %}
+    mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots and installs to same NIC
+{% else %}
+    mac = "{{ hostvars[host].boot_mac_address }}" # PXE boots to 1GbE NIC, installs to 10GbE NIC
+{% endif %}
+  }
+}
+{% endfor %}

ansible/playbooks/templates/install-config.yaml.j2

@@ -0,0 +1,33 @@
+apiVersion: v1
+baseDomain: {{ hostvars[groups[cluster_group][0]].base_domain }}
+compute:
+- name: worker
+  hyperthreading: Enabled
+  replicas: {{ hostvars[groups[cluster_group][0]].worker_node_count }}
+controlPlane:
+  hyperthreading: Enabled
+  name: master
+  replicas: {{ hostvars[groups[cluster_group][0]].master_node_count }}
+metadata:
+  name: {{ hostvars[groups[cluster_group][0]].cluster_name }}
+networking:
+  clusterNetwork:
+  - cidr: {{ hostvars[groups[cluster_group][0]].cluster_network }}
+    hostPrefix: {{ hostvars[groups[cluster_group][0]].cluster_network_host_prefix }}
+  machineNetwork:
+  - cidr: {{ hostvars[groups[cluster_group][0]].machine_network }}
+  networkType: OVNKubernetes
+  serviceNetwork:
+  - {{ hostvars[groups[cluster_group][0]].service_network }}
+platform:
+{% if hostvars[groups[cluster_group][0]].platform_type == 'none' %}
+  {{ hostvars[groups['hub_cluster'][0]].platform_type }}: {}
+{% endif %}
+{% if hostvars[groups[cluster_group][0]].platform_type == 'baremetal' %}
+  {{ hostvars[groups[cluster_group][0]].platform_type }}:
+    apiVIP: {{ hostvars[groups[cluster_group][0]].api_address }}
+    ingressVIP: {{ hostvars[groups[cluster_group][0]].app_address }}
+{% endif %}
+fips: false
+pullSecret: '{{ vault_pull_secret }}'
+sshKey: '{{ vault_ssh_key }}'

ansible/playbooks/templates/kubeadm-config.yaml.j2

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kubeadm-config
+  namespace: kube-system
+data:
+  ClusterConfiguration: |
+    apiServer: {}
+    apiVersion: kubeadm.k8s.io/v1beta4
+    caCertificateValidityPeriod: 87600h0m0s
+    certificateValidityPeriod: 8760h0m0s
+    certificatesDir: /etc/kubernetes/pki
+    clusterName: kubernetes
+    controllerManager: {}
+    dns: {}
+    encryptionAlgorithm: RSA-2048
+    etcd:
+      local:
+        dataDir: /var/lib/etcd
+    imageRepository: registry.k8s.io
+    kind: ClusterConfiguration
+    kubernetesVersion: {{ kubernetes_version | default('v1.33.4') }}
+    networking:
+      dnsDomain: cluster.local
+      serviceSubnet: {{ service_cidr | default('10.96.0.0/12') }}
+    proxy: {}
+    scheduler: {}
+    controlPlaneEndpoint: {{ control_plane_endpoint | default('fastpass.local.mk-labs.cloud') }}:{{ control_plane_port | default('6443') }}

ansible/playbooks/templates/profiles.tf.j2

@@ -0,0 +1,16 @@
+// Fedora CoreOS profile
+resource "matchbox_profile" "openshift-agent-install" {
+  name   = "{{ hostvars[groups[cluster_group][0]].cluster_name }}"
+  kernel = "/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-vmlinuz"
+  initrd = [
+    "--name initrd /assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-initrd.img"
+  ]
+
+  args = [
+    "initrd=initrd",
+    "coreos.live.rootfs_url={{ hostvars[groups['matchbox_server'][0]].http_endpoint }}/assets/{{ hostvars[groups[cluster_group][0]].cluster_name }}/agent.x86_64-rootfs.img",
+    "rw",
+    "ignition.firstboot",
+    "ignition.platform.id=metal",
+  ]
+}

ansible/playbooks/templates/provider.tf.j2

@@ -1,6 +1,6 @@
 // Configure the matchbox provider
 provider "matchbox" {
-  endpoint    = "{{ hostvars[groups['matchbox'][0]].rpc_endpoint }}"
+  endpoint    = "{{ hostvars[groups['matchbox_server'][0]].rpc_endpoint }}"
   client_cert = file("/etc/matchbox/client.crt")
   client_key  = file("/etc/matchbox/client.key")
   ca          = file("/etc/matchbox/ca.crt")

ansible/playbooks/templates/unifi-user.tf.j2

@@ -0,0 +1,8 @@
+resource "unifi_user" "{{ inventory_hostname }}" {
+  mac  = "{{ vm_mac_address }}"
+  name = "{{ inventory_hostname }}"
+#  note = "my note"
+
+  fixed_ip   = "{{ ip_address }}"
+  allow_existing         = true
+}

ansible/playbooks/templates/unifi_provider.tf.j2

@@ -0,0 +1,22 @@
+// Configure the unifi provider
+terraform {
+  required_providers {
+    unifi = {
+      source = "paultyng/unifi"
+      version = "0.41.0"
+    }
+  }
+}
+
+provider "unifi" {
+  username = "terraform" # optionally use UNIFI_USERNAME env var
+  password = "{{ vault_unifi_password }}" # optionally use UNIFI_PASSWORD env var
+  api_url  = "https://192.168.1.1"  # optionally use UNIFI_API env var
+
+  # you may need to allow insecure TLS communications unless you have configured
+  # certificates for your controller
+  allow_insecure = "true" # optionally use UNIFI_INSECURE env var
+
+  # if you are not configuring the default site, you can change the site
+  # site = "world-drive" # or optionally use UNIFI_SITE env var
+}

ansible/playbooks/test-dns-cname.yml

@@ -0,0 +1,11 @@
+---
+- name: Test DNS CNAME Creation
+  hosts: fastpass_control_plane[0]
+  gather_facts: false
+  tasks:
+    - name: Test DNS CNAME entry creation
+      ansible.builtin.include_role:
+        name: dns-manager
+      vars:
+        cluster_endpoint: "{{ control_plane_endpoint }}"
+        cluster_cname_target: "{{ traefik_server }}.{{ base_domain }}"

ansible/playbooks/test.yml

@@ -0,0 +1,25 @@
+---
+- name: Test Ansible Playbook
+  hosts: all
+  gather_facts: yes
+  become: false
+
+  tasks:
+    - name: Ping all hosts
+      ansible.builtin.ping:
+
+    - name: Display hostname
+      ansible.builtin.debug:
+        msg: "The hostname of this system is {{ inventory_hostname }}"
+
+    - name: Show OS distribution
+      ansible.builtin.debug:
+        msg: "This host is running {{ ansible_distribution }} {{ ansible_distribution_version }}"
+
+    - name: Run uptime command
+      ansible.builtin.command: uptime
+      register: uptime_result
+
+    - name: Display uptime result
+      ansible.builtin.debug:
+        var: uptime_result.stdout

ansible/playbooks/test_connectivity.yml

@@ -0,0 +1,16 @@
+---
+# FILE: playbooks/test_connectivity.yml
+# Simple test playbook to validate Semaphore can connect and run tasks
+
+- name: Test connectivity
+  hosts: all
+  gather_facts: true
+
+  tasks:
+    - name: Print hostname
+      ansible.builtin.debug:
+        msg: "Connected to {{ inventory_hostname }} ({{ ansible_hostname }})"
+
+    - name: Print OS info
+      ansible.builtin.debug:
+        msg: "{{ ansible_distribution }} {{ ansible_distribution_version }}"