Initial collection structure

Migrated from legacy playbook repo into Ansible collection format:

Roles (171 total):
- common: 44 roles (fact gathering, SSH setup, utilities)
- configuration: 32 roles (system config, networking, satellite)
- provisioning: 16 roles (VMware, Azure, physical server deployment)
- security: 15 roles (OpenSCAP hardening, certificates, AD integration)
- monitoring: 12 roles (Zabbix, logging agents, metrics)
- networking: 12 roles (DNS, DHCP, network interfaces)
- satellite: 4 roles (Pulp/Satellite management)
- misc: 36 roles (various utilities)

Playbooks (159 total):
- provisioning: 14 playbooks
- azure: 13 playbooks
- configuration: 22 playbooks
- maintenance: 10 playbooks
- security: 10 playbooks
- monitoring: 9 playbooks
- vcenter: 6 playbooks
- networking: 7 playbooks
- misc: 65 playbooks

playbooks/azure/azure-add-disk.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  gather_facts: no
+  connection: local
+  roles:
+    - azure-add-disk

playbooks/azure/azure-create-asg.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  gather_facts: no
+  connection: local
+  roles:
+    - azure-create-asg

playbooks/azure/azure-create-network-interface.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  gather_facts: no
+  connection: local
+  roles:
+    - azure-create-network-interface

playbooks/azure/azure-create-resource-group.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  gather_facts: no
+  connection: local
+  roles:
+    - azure-create-resource-group

playbooks/azure/azure-delete-vm.yml

@@ -0,0 +1,19 @@
+---
+- hosts: all
+  gather_facts: false
+  connection: local
+  become: false
+  roles:
+    - azure-delete-vm
+    - zabbix-agent-remove
+
+- hosts: all
+  gather_facts: True
+  connection: local
+  become: False
+  serial: 1
+  roles:
+    - determine-jump-host
+    - clear-host-from-known-hosts
+    - remove-dns-record
+    - remove-ad-group

playbooks/azure/azure-disable-omid-cron.yml

@@ -0,0 +1,5 @@
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - azure-disable-omid-cron

playbooks/azure/azure-expand-lvm.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - azure-expand-lvm

playbooks/azure/azure-expand-os-disk.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - azure-expand-os-disk

playbooks/azure/azure-fix-auditd.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  gather_facts: yes
+  become: yes
+  roles:
+    - azure-fix-auditd

playbooks/azure/azure-get-ip.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  gather_facts: false
+  connection: local
+  roles:
+    - azure-get-ip

playbooks/azure/azure-setup-repositories.yml

@@ -0,0 +1,7 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo 
+  roles:
+    - azure-setup-repositories
+

playbooks/azure/azure-shutdown-vm.yml

@@ -0,0 +1,8 @@
+---
+- hosts: all
+  gather_facts: true
+  connection: local
+  become: false
+  roles:
+    - azure-shutdown-vm
+

playbooks/azure/test-azure-prov.yml

@@ -0,0 +1,7 @@
+---
+- hosts: all
+  gather_facts: true
+  connection: local
+  roles:
+    - azure-provision-vm
+

playbooks/configuration/azure-configure-disk.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - azure-configure-disk

playbooks/configuration/configure-account-timeout.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: True
+  become_method: sudo
+  roles:
+    - configure-account-timeout

playbooks/configuration/configure-ad-authorized-keys.yml

@@ -0,0 +1,6 @@
+- hosts: all
+  gather_facts: True
+  become: True
+  roles:
+  - determine-jump-host
+  - configure-ad-authorized-keys

playbooks/configuration/configure-ad-users-and-sudoers.yml

@@ -0,0 +1,6 @@
+- hosts: all
+  gather_facts: True
+  become: True
+  roles:
+  - determine-jump-host
+  - configure-ad-users-and-sudoers

playbooks/configuration/configure-artifactory-docker-registry.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo 
+  roles:
+    - configure-artifactory-docker-registry

playbooks/configuration/configure-fips-policies.yml

@@ -0,0 +1,8 @@
+- hosts: all
+  become: true
+  become_method: sudo
+  become_user: root
+  remote_user: infra
+
+  roles:
+    - configure-fips-policies

playbooks/configuration/configure-inspec-access.yml

@@ -0,0 +1,6 @@
+- hosts: all
+  gather_facts: True
+  become: True
+  roles:
+    - determine-jump-host
+    - configure-inspec-access

playbooks/configuration/configure-module-sig-enforce.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: True
+  become_method: sudo
+  roles:
+    - configure-module-sig-enforce

playbooks/configuration/configure-skat-certificate-trust.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo
+  roles:
+    - configure-skat-certificate-trust

playbooks/configuration/configure-skat-wifi.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo
+  roles:
+    - workstation/configure-skat-wifi

playbooks/configuration/configure-ssh-additional-security.yml

@@ -0,0 +1,5 @@
+- hosts: all
+  gather_facts: True
+  become: True
+  roles:
+  - configure-ssh-additional-security

playbooks/configuration/configure-user-ssh-key-and-passwordless-sudo.yml

@@ -0,0 +1,5 @@
+- hosts: all
+  gather_facts: True
+  become: True
+  roles:
+  - configure-user-ssh-key-and-passwordless-sudo

playbooks/configuration/ntp-client-setup.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo
+  roles:
+    - ntp-client-setup

playbooks/configuration/satellite-set-environment.yml

@@ -0,0 +1,7 @@
+---
+- hosts: all 
+  gather_facts: no
+  roles:
+    - satellite-create-cli-config
+    - satellite-set-environment
+    - satellite-delete-cli-config

playbooks/configuration/satellite-set-host-group.yml

@@ -0,0 +1,7 @@
+---
+- hosts: all 
+  gather_facts: no
+  roles:
+    - satellite-create-cli-config
+    - satellite-set-host-group
+    - satellite-delete-cli-config

playbooks/configuration/set-azure-facts.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - set-azure-facts

playbooks/configuration/set-nameserver-facts.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - set-nameserver-facts

playbooks/configuration/set-netbox-tags.yml

@@ -0,0 +1,10 @@
+---
+- name: Set NetBox tags on virtual machines
+  hosts: all
+  gather_facts: no
+  connection: local
+  vars:
+    NETBOX_API: "{{ lookup('env', 'NETBOX_API') | default('https://netbox.example.EXAMPLE-CORP.COM') }}"
+    NETBOX_TOKEN: "{{ lookup('env', 'NETBOX_TOKEN') }}"
+  roles:
+    - set-netbox-tag

playbooks/configuration/set-onprem-facts.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - set-onprem-facts

playbooks/configuration/sssd_simple_access_provider.yml

@@ -0,0 +1,7 @@
+---
+- hosts: all
+  become: True
+  become_method: sudo
+  roles:
+    - sssd_simple_access_provider
+    - ssh-deny-root

playbooks/configuration/vmware-set-ip.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  gather_facts: false
+  connection: local
+  roles:
+    - vmware-set-ip

playbooks/configuration/vmware-set-vmstoragepolicy.yml

@@ -0,0 +1,7 @@
+---
+- hosts: all
+  gather_facts: false
+  connection: local
+  roles:
+    - set-vxrail-facts  
+    - vxrail-storage-policy

playbooks/maintenance/backup_etcd.yml

@@ -0,0 +1,12 @@
+---
+- hosts: backup
+  become: yes
+  become_method: sudo
+  roles:
+    - backup_certs_and_keys
+
+- hosts: backup_master
+  become: yes
+  become_method: sudo
+  roles:
+    - backup_etcd

playbooks/maintenance/reboot-host.yml

@@ -0,0 +1,7 @@
+---
+- hosts: all
+  gather_facts: false
+  become: yes
+  tasks:
+    - name: reboot | any/all systems but not sequenced
+      command: /sbin/reboot

playbooks/maintenance/shutdown-vm.yml

@@ -0,0 +1,34 @@
+---
+- hosts: all
+  connection: local
+  gather_facts: true
+  become: false
+  roles:
+    - determine-location
+      # If shutting down VM, these are run. This is the default
+#    - {role: set-netbox-status, status_to_set: 'decommissioning', when: ( delete is undefined or delete == false)}
+    - {role: zabbix-agent-disable, when: ( delete is undefined or delete == false)}
+
+    - {role: azure-shutdown-vm, when: ((is_azure == true) and (delete is undefined or delete == false))}
+
+    - {role: lookforvm, when: (is_azure == false)}
+    - {role: set-vxrail-facts, when: (is_azure == false and vm_info.cluster == "VxRail")}
+    - {role: vxrail-decommission, delete_or_poweroff: "poweroff", when: ((is_azure == false) and (delete is undefined or delete == false))}
+
+      # If deleting, these are run. This has to be specified with a flag
+#    - {role: set-netbox-status, status_to_set: 'offline', when: (delete is defined and delete == true)}
+    - {role: azure-delete-vm, when: (is_azure == true and (delete is defined and delete == true))}
+    - {role: vxrail-decommission, delete_or_poweroff: "delete", when: ((is_azure == false) and (delete is defined and delete == true))}
+    - {role: zabbix-agent-remove, when: (delete is defined and delete == true)}
+
+- hosts: all
+  gather_facts: true
+  connection: local
+  become: false
+  serial: 1
+  roles:
+    - {role: determine-jump-host, when: (delete is defined and delete == true)}
+    - {role: clear-host-from-known-hosts, when: (delete is defined and delete == true)}
+    - {role: remove-dns-record, when: (delete is defined and delete == true)}
+    - {role: remove-ad-group, when: (delete is defined and delete == true)}
+

playbooks/maintenance/update-netbox.yml

@@ -0,0 +1,27 @@
+---
+# Orchestrator: use NetBox inventory, determine cloud provider per-host, and run update-netbox-fatcs role
+- name: Update NetBox inventory (orchestrator)
+  hosts: all
+  gather_facts: false
+  vars:
+    ansible_python_interpreter: /usr/bin/python3.11
+  vars_files:
+    - roles/update-netbox-fatcs/vars/main.yml
+  tasks:
+    - name: Run lookforvm role to detect if host exists in vCenter or Azure
+      include_role:
+        name: lookforvm
+      vars:
+        ansible_connection: local
+
+    - name: Set vmware_datacenter based on lookforvm results
+      set_fact:
+        vmware_datacenter: >-
+          {% if vm_found_azure | default(false) %}azure{% elif vm_found_vcenter | default(false) %}onprem{% else %}onprem{% endif %}
+
+    - name: Run update-netbox-fatcs role to collect facts and update NetBox
+      include_role:
+        name: update-netbox-fatcs
+  # vmware_datacenter is set above via set_fact; do not re-pass a self-referential
+  # template here (it caused recursive templating). The role will inherit the var.
+

playbooks/maintenance/update-package-list.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+     - update-package-list

playbooks/maintenance/update-satellite.yml

@@ -0,0 +1,59 @@
+---
+#
+# Update Red Hat Satellite and Capsules using ansible.
+#
+#
+#
+
+- hosts: satellite
+  remote_user: root
+  tasks:
+  - name: Updating OS on Satellite
+    yum: 
+      name: '*'
+      state: latest
+
+  - name: Updating Satellite 6 to latest
+    command: satellite-installer --scenario satellite --upgrade
+
+  - name: Rebooting Satellite
+    command: sleep 2; systemctl reboot
+    async: 1
+    poll: 0
+    ignore_errors: true
+
+  - name: Wait for server to restart
+    local_action:
+      module: wait_for
+        host={{ inventory_hostname }}
+        port=22
+        delay=1
+        timeout=300
+
+- hosts: capsules
+  remote_user: root
+  tasks:
+  - name: Updating OS on Capsule
+    yum: name='*' state=latest
+
+  - name: Updating Capsule 6 to latest
+    command: satellite-installer --scenario capsule --upgrade
+
+  - name: Rebooting Satellite
+    command: sleep 2; systemctl reboot
+    async: 1
+    poll: 0
+    ignore_errors: true
+
+  - name: Wait for server to restart
+    local_action:
+      module: wait_for
+        host={{ inventory_hostname }}
+        port=22
+        delay=1
+        timeout=300
+
+
+
+
+

playbooks/maintenance/upgrade-gluster.yml

@@ -0,0 +1,8 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+     - upgrade-gluster
+     - yum-update
+     - start-gluster

playbooks/maintenance/yum-cron-security.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+     - yum-cron-security

playbooks/maintenance/yum-cron-update.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+     - yum-cron-update

playbooks/maintenance/yum-update.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+     - yum-update

playbooks/misc/add-allowed-group.yml

@@ -0,0 +1,5 @@
+---
+- hosts: all 
+  become: True
+  roles:
+    - add-allowed-group

playbooks/misc/add-subscription-pool.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo
+  roles:
+    - add-subscription-pool

playbooks/misc/add-sudo-and-ssh-group.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: True
+  roles:
+    - add-allowed-group
+    - add-sudoers-group

playbooks/misc/add-sudoers-group.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: True
+  roles:
+    - determine-jump-host
+    - add-sudoers-group

playbooks/misc/add-to-sudoers-group.yml

@@ -0,0 +1,8 @@
+- hosts: all
+  gather_facts: True
+  connection: local
+  become: False
+  serial: 1
+  roles:
+  - determine-jump-host
+  - add-to-sudoers-group

playbooks/misc/add-to-users-group.yml

@@ -0,0 +1,7 @@
+- hosts: all
+  gather_facts: True
+  connection: local
+  become: False
+  serial: 1
+  roles:
+  - add-to-users-group

playbooks/misc/add-users-to-ad-group.yml

@@ -0,0 +1,13 @@
+- hosts: all
+  gather_facts: True
+  connection: local
+  become: False
+  roles:
+  - determine-jump-host
+
+- hosts: all
+  gather_facts: True
+  connection: local
+  become: False
+  roles:
+  - add-users-to-ad-group

playbooks/misc/adhoc-aap-test.yml

@@ -0,0 +1,8 @@
+---
+- hosts: all
+  become: false
+  gather_facts: false
+  tasks:
+    - name: Test message
+      ansible.builtin.debug:
+        msg: "This is a playbook for testing AAP"

playbooks/misc/adhoc-copy-scap-reports.yml

@@ -0,0 +1,40 @@
+---
+- hosts: all
+  gather_facts: true
+  become: true
+  pre_tasks:
+    - name: Set dc_domain from hostname
+      ansible.builtin.set_fact:
+        dc_domain: "{{ inventory_hostname | regex_replace('.+?\\.(.+)$', '\\g<1>') | lower }}"
+    - name: Remediate OpenSCAP policy
+      command: |
+        oscap xccdf eval --datastream-id scap_org.open-scap_datastream_from_xccdf_ssg-rhel9-xccdf.xml \
+        --xccdf-id scap_org.open-scap_cref_ssg-rhel9-xccdf.xml \
+        --tailoring-file /usr/share/xml/scap/skat/ssg-rhel9-ds-tailoring.xml \
+        --profile xccdf_org.ssgproject.content_profile_ospp_customized \
+        --oval-results \
+        --report /tmp/report.html \
+        /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
+      register: result
+      changed_when: result is failed
+      #failed_when: false
+
+    - name:
+      ansible.builtin.stat:
+        path: /tmp/report.html
+        get_attributes: true
+        get_checksum: false
+      register: file_stat
+
+    - name: Set report name
+      set_fact:
+        report_name: "{{ inventory_hostname }}.{{ '%Y-%m-%d.%H:%M:%S'|strftime(file_stat.stat.ctime) }}_no_remediate_review.html"
+
+    - name: Download report
+      fetch:
+        src: /tmp/report.html
+        dest: /tmp/{{ report_name }}
+        flat: true
+
+  roles:
+    - upload-skat-openscap

playbooks/misc/adhocvmwaretag.yml

@@ -0,0 +1,37 @@
+---
+- hosts: all
+  connection: local
+  become: false
+  gather_facts: false
+  vars:
+    - vcenter_host: vcsa01.EXAMPLE-CORP.COM
+  pre_tasks:
+    - name: Import vxrail credentials
+      ansible.builtin.include_vars:
+        file: roles/vxrail-provision/vars/credentials.yml
+
+  tasks:
+    - name: Remove vmware tag from host
+      community.vmware.vmware_tag_manager:
+        hostname: "{{ vcenter_host }}"
+        username: "{{ vmware_user }}"
+        password: "{{ vmware_pass }}"
+        tag_names:
+          - RPO24-Linux-03
+        object_name: "{{ inventory_hostname }}"
+        object_type: VirtualMachine
+        state: remove
+        validate_certs: false
+
+    - name: Add vmware tag to host
+      community.vmware.vmware_tag_manager:
+        hostname: "{{ vcenter_host }}"
+        username: "{{ vmware_user }}"
+        password: "{{ vmware_pass }}"
+        tag_names:
+          - RPO24-Linux-05
+        object_name: "{{ inventory_hostname }}"
+        object_type: VirtualMachine
+        state: add
+        validate_certs: false
+

playbooks/misc/allow-root.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+     - ssh-allow-root

playbooks/misc/bmc-discovery.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: True 
+  serial: 5
+  roles:
+    - bmc-discovery

playbooks/misc/change-hostname.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+     - change-hostname

playbooks/misc/change-infra-pass.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: True
+  become_method: sudo
+  roles:
+    - change-infra-pass

playbooks/misc/change-ssh-host-keys.yml

@@ -0,0 +1,8 @@
+- hosts: all
+  become: true
+  become_method: sudo
+  become_user: root
+  remote_user: infra
+
+  roles:
+    - change-ssh-host-keys

playbooks/misc/check-ssh-services.yml

@@ -0,0 +1,8 @@
+- name: Check SSH and SSSD service state and logs
+  hosts: all
+  gather_facts: false
+  become: true
+
+  roles:
+    - check-ssh-services
+

playbooks/misc/cockpit.yml

@@ -0,0 +1,9 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo   
+  roles:
+    - cockpit
+
+# Run like this
+# ansible-playbook -i hosts -l cockpit cockpit.yml --ask-pass --ask-become -u mjadm 

playbooks/misc/create-ad-group.yml

@@ -0,0 +1,13 @@
+- hosts: all
+  gather_facts: True
+  connection: local
+  become: False
+  roles:
+  - determine-jump-host
+
+- hosts: deploy.EXAMPLE-CORP.COM
+  gather_facts: True
+  connection: local
+  become: False
+  roles:
+  - create-ad-group

playbooks/misc/create-infra-user.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - create-infra-user

playbooks/misc/def-automatic.yml

@@ -0,0 +1,8 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+     - determine-jump-host
+     - check-dns-name
+     - dnf-automatic

playbooks/misc/deny-root.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+     - ssh-deny-root

playbooks/misc/disable-repository.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo
+  roles:
+    - disable-repository

playbooks/misc/disk-extend.yml

@@ -0,0 +1,13 @@
+- hosts: all
+  become: true
+  become_method: sudo
+  become_user: root
+  remote_user: infra
+
+  vars_prompt:
+    - name: "raw_disks"
+      prompt: "Raw disk used for create a Physical Volume"
+      private: false
+
+  roles:
+    - disk-extend

playbooks/misc/disk-lvm-extend.yml

@@ -0,0 +1,14 @@
+- hosts: all
+  become: true
+  become_method: sudo
+  become_user: root
+  remote_user: infra
+
+  vars_prompt:
+    - name: "raw_disks"
+      prompt: "Raw disk used for create a Physical Volume"
+      private: false
+
+  roles:
+    - disk-extend
+    - vg-extend

playbooks/misc/display-host-facts.yml

@@ -0,0 +1,8 @@
+---
+- name: Display facts
+  hosts: all
+
+  tasks:
+    - name: Display all known host facts
+      ansible.builtin.debug:
+        var: ansible_facts

playbooks/misc/enable-repository.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo
+  roles:
+    - enable-repository

playbooks/misc/enable-swappiness.yml

@@ -0,0 +1,5 @@
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - enable-swappiness

playbooks/misc/fix--audit-logs-in-message.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: True 
+  serial: 5
+  roles:
+    - fix--audit-logs-in-message

playbooks/misc/fix-audit-logs-in-message.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: True
+  become_method: sudo
+  roles:
+    - fix--audit-logs-in-message

playbooks/misc/get-hp-oneview.yml

@@ -0,0 +1,15 @@
+---
+# File: gather_hp_oneview_enclosure.yml
+- name: Gather and display HP OneView server hardware details
+  hosts: localhost
+  gather_facts: false
+  connection: local
+
+  vars:
+    oneview_url: "https://hpeoneview01.EXAMPLE-CORP.COM"
+    oneview_user: "wXXXXXXadm"
+    oneview_pass: "your-password-here"
+    oneview_api_version: "300"
+
+  roles:
+    - gather_hp_oneview_enclosure

playbooks/misc/ili-add-sudo-access.yml

@@ -0,0 +1,174 @@
+---
+- name: ILI - Add sudo access from Jira ticket
+  hosts: all
+  gather_facts: false
+  connection: local
+  collections:
+    - community.general
+
+  # lookforjira_issue_key is provided by the AAP survey as an extra variable
+  # Credentials (service_user_ccta/clcta/dmz23/dmz24, schrodingers_password,
+  # lookforjira_api_token) are injected by AAP credential types.
+
+  roles:
+    - lookforjira
+
+  tasks:
+    - name: Extract fields from Jira description
+      ansible.builtin.set_fact:
+        # Servers and users: values are on the same line as the label.
+        # (?i) handles inconsistent capitalisation of "Servernavne" in the form.
+        # Users are extracted by matching the exact username pattern, so any
+        # separator (comma, space, or both) between multiple usernames is handled.
+        server_ccta: >-
+          {{ jira_result.meta.fields.description
+             | regex_findall('(?i)Oplys Servernavne - CCTA:[ ]*([^\n]+)')
+             | first | default('') | trim }}
+        server_clcta: >-
+          {{ jira_result.meta.fields.description
+             | regex_findall('(?i)Oplys Servernavne - CLCTA:[ ]*([^\n]+)')
+             | first | default('') | trim }}
+        server_dmz23: >-
+          {{ jira_result.meta.fields.description
+             | regex_findall('(?i)Oplys Servernavne - DMZ23:[ ]*([^\n]+)')
+             | first | default('') | trim }}
+        server_dmz24: >-
+          {{ jira_result.meta.fields.description
+             | regex_findall('(?i)Oplys Servernavne - DMZ24:[ ]*([^\n]+)')
+             | first | default('') | trim }}
+        users_ccta: >-
+          {{ (jira_result.meta.fields.description
+              | regex_findall('Oplys admin users[^\n]* - CCTA:[ ]*([^\n]+)')
+              | first | default(''))
+             | regex_findall('(?i)w\d{5}adm') }}
+        users_clcta: >-
+          {{ (jira_result.meta.fields.description
+              | regex_findall('Oplys admin users[^\n]* - CLCTA:[ ]*([^\n]+)')
+              | first | default(''))
+             | regex_findall('(?i)w\d{5}adm') }}
+        users_dmz23: >-
+          {{ (jira_result.meta.fields.description
+              | regex_findall('Oplys admin users[^\n]* - DMZ23:[ ]*([^\n]+)')
+              | first | default(''))
+             | regex_findall('(?i)z23w\d{5}adm') }}
+        users_dmz24: >-
+          {{ (jira_result.meta.fields.description
+              | regex_findall('Oplys admin users[^\n]* - DMZ24:[ ]*([^\n]+)')
+              | first | default(''))
+             | regex_findall('(?i)z24w\d{5}adm') }}
+
+    # ── CCTA ─────────────────────────────────────────────────────────────────
+    - name: Determine jump host for CCTA
+      ansible.builtin.set_fact:
+        dc_domain: "EXAMPLE-CORP.COM"
+      when: server_ccta != '' and users_ccta | length > 0
+
+    - name: Include determine-jump-host role for CCTA
+      ansible.builtin.include_role:
+        name: determine-jump-host
+      when: server_ccta != '' and users_ccta | length > 0
+
+    - name: Show CCTA sudo access
+      ansible.builtin.debug:
+        msg: "Users: {{ users_ccta | join(', ') }} -> Group: {{ server_ccta.split('.')[0] }}_sudoers via {{ winjump_host }}"
+      when: server_ccta != '' and users_ccta | length > 0
+
+    - name: Add CCTA users to sudoers group
+      microsoft.ad.group:
+        identity: "{{ server_ccta.split('.')[0] }}_sudoers"
+        members:
+          add: "{{ users_ccta }}"
+      delegate_to: "{{ winjump_host }}"
+      vars:
+        ansible_user: "{{ service_user_ccta }}"
+        ansible_password: "{{ schrodingers_password }}"
+        ansible_connection: ssh
+        ansible_shell_type: powershell
+      when: server_ccta != '' and users_ccta | length > 0
+
+    # ── CLCTA ────────────────────────────────────────────────────────────────
+    - name: Determine jump host for CLCTA
+      ansible.builtin.set_fact:
+        dc_domain: "clcta.dk"
+      when: server_clcta != '' and users_clcta | length > 0
+
+    - name: Include determine-jump-host role for CLCTA
+      ansible.builtin.include_role:
+        name: determine-jump-host
+      when: server_clcta != '' and users_clcta | length > 0
+
+    - name: Show CLCTA sudo access
+      ansible.builtin.debug:
+        msg: "Users: {{ users_clcta | join(', ') }} -> Group: {{ server_clcta.split('.')[0] }}_sudoers via {{ winjump_host }}"
+      when: server_clcta != '' and users_clcta | length > 0
+
+    - name: Add CLCTA users to sudoers group
+      microsoft.ad.group:
+        identity: "{{ server_clcta.split('.')[0] }}_sudoers"
+        members:
+          add: "{{ users_clcta }}"
+      delegate_to: "{{ winjump_host }}"
+      vars:
+        ansible_user: "{{ service_user_clcta }}"
+        ansible_password: "{{ schrodingers_password }}"
+        ansible_connection: ssh
+        ansible_shell_type: powershell
+      when: server_clcta != '' and users_clcta | length > 0
+
+    # ── DMZ23 ────────────────────────────────────────────────────────────────
+    - name: Determine jump host for DMZ23
+      ansible.builtin.set_fact:
+        dc_domain: "DMZ23.EXAMPLE.COM"
+      when: server_dmz23 != '' and users_dmz23 | length > 0
+
+    - name: Include determine-jump-host role for DMZ23
+      ansible.builtin.include_role:
+        name: determine-jump-host
+      when: server_dmz23 != '' and users_dmz23 | length > 0
+
+    - name: Show DMZ23 sudo access
+      ansible.builtin.debug:
+        msg: "Users: {{ users_dmz23 | join(', ') }} -> Group: {{ server_dmz23.split('.')[0] }}_sudoers via {{ winjump_host }}"
+      when: server_dmz23 != '' and users_dmz23 | length > 0
+
+    - name: Add DMZ23 users to sudoers group
+      microsoft.ad.group:
+        identity: "{{ server_dmz23.split('.')[0] }}_sudoers"
+        members:
+          add: "{{ users_dmz23 }}"
+      delegate_to: "{{ winjump_host }}"
+      vars:
+        ansible_user: "{{ service_user_dmz23 }}"
+        ansible_password: "{{ schrodingers_password }}"
+        ansible_connection: ssh
+        ansible_shell_type: powershell
+      when: server_dmz23 != '' and users_dmz23 | length > 0
+
+    # ── DMZ24 ────────────────────────────────────────────────────────────────
+    - name: Determine jump host for DMZ24
+      ansible.builtin.set_fact:
+        dc_domain: "DMZ.EXAMPLE.COM"
+      when: server_dmz24 != '' and users_dmz24 | length > 0
+
+    - name: Include determine-jump-host role for DMZ24
+      ansible.builtin.include_role:
+        name: determine-jump-host
+      when: server_dmz24 != '' and users_dmz24 | length > 0
+
+    - name: Show DMZ24 sudo access
+      ansible.builtin.debug:
+        msg: "Users: {{ users_dmz24 | join(', ') }} -> Group: {{ server_dmz24.split('.')[0] }}_sudoers via {{ winjump_host }}"
+      when: server_dmz24 != '' and users_dmz24 | length > 0
+
+    - name: Add DMZ24 users to sudoers group
+      microsoft.ad.group:
+        identity: "{{ server_dmz24.split('.')[0] }}_sudoers"
+        members:
+          add: "{{ users_dmz24 }}"
+      delegate_to: "{{ winjump_host }}"
+      vars:
+        ansible_user: "{{ service_user_dmz24 }}"
+        ansible_password: "{{ schrodingers_password }}"
+        ansible_connection: ssh
+        ansible_shell_type: powershell
+      when: server_dmz24 != '' and users_dmz24 | length > 0

playbooks/misc/ili-add-user-access.yml

@@ -0,0 +1,156 @@
+---
+- name: ILI - Add user to server AD group from Jira ticket
+  hosts: all
+  gather_facts: false
+  connection: local
+  collections:
+    - community.general
+
+  # lookforjira_issue_key is provided by the AAP survey as an extra variable
+  # Credentials (service_user_ccta/dmz23/dmz24, schrodingers_password,
+  # lookforjira_api_token) are injected by AAP credential types.
+
+  roles:
+    - lookforjira
+
+  tasks:
+    - name: Extract fields from Jira description
+      ansible.builtin.set_fact:
+        # The Jira form has the field label on one line and the value on the next.
+        # regex_findall captures the value line after the label. The [ ]* matches
+        # any trailing spaces after the colon before the newline. [^\n]+ ensures
+        # we only capture non-empty lines, so empty fields return no match.
+        # | first gets the value, | default('') handles the case where the field
+        # is empty (no match found).
+        server_ccta: >-
+          {{ jira_result.meta.fields.description
+             | regex_findall('Oplys Servernavne - CCTA:[ ]*\n([^\n]+)')
+             | first | default('') | trim }}
+        server_dmz23: >-
+          {{ jira_result.meta.fields.description
+             | regex_findall('Oplys Servernavne? - DMZ23:[ ]*\n([^\n]+)')
+             | first | default('') | trim }}
+        server_dmz24: >-
+          {{ jira_result.meta.fields.description
+             | regex_findall('Oplys Servernavne - DMZ24:[ ]*\n([^\n]+)')
+             | first | default('') | trim }}
+        admin_user: >-
+          {{ jira_result.meta.fields.description
+             | regex_findall('W-nummer eller DMZ-bruger:[ ]*\n(\S+)')
+             | first | default('') | trim }}
+
+    - name: Show user
+      ansible.builtin.debug:
+        msg: "User: {{ admin_user }}"
+      when: admin_user != ''
+
+    # ── CCTA ─────────────────────────────────────────────────────────────────
+    - name: Determine jump host for CCTA
+      ansible.builtin.set_fact:
+        dc_domain: "EXAMPLE-CORP.COM"
+      when: server_ccta != '' and admin_user != ''
+
+    - name: Include determine-jump-host role for CCTA
+      ansible.builtin.include_role:
+        name: determine-jump-host
+      when: server_ccta != '' and admin_user != ''
+
+    - name: Show CCTA group
+      ansible.builtin.debug:
+        msg: "User: {{ admin_user }} -> Group: {{ server_ccta.split('.')[0] }} via {{ winjump_host }}"
+      when: server_ccta != '' and admin_user != ''
+
+    - name: Add user to CCTA server AD group
+      microsoft.ad.group:
+        identity: "{{ server_ccta.split('.')[0] }}"
+        members:
+          add:
+            - "{{ admin_user }}"
+      delegate_to: "{{ winjump_host }}"
+      vars:
+        ansible_user: "{{ service_user_ccta }}"
+        ansible_password: "{{ schrodingers_password }}"
+        ansible_connection: ssh
+        ansible_shell_type: powershell
+      when: server_ccta != '' and admin_user != ''
+      register: group_result_ccta
+      failed_when: false
+
+    - name: Warn if CCTA AD group does not exist
+      ansible.builtin.debug:
+        msg: "WARNING: AD group {{ server_ccta.split('.')[0] }} not found - group may need to be created first"
+      when: group_result_ccta is defined and group_result_ccta.failed | default(false)
+
+    # ── DMZ23 ────────────────────────────────────────────────────────────────
+    - name: Determine jump host for DMZ23
+      ansible.builtin.set_fact:
+        dc_domain: "DMZ23.EXAMPLE.COM"
+      when: server_dmz23 != '' and admin_user != ''
+
+    - name: Include determine-jump-host role for DMZ23
+      ansible.builtin.include_role:
+        name: determine-jump-host
+      when: server_dmz23 != '' and admin_user != ''
+
+    - name: Show DMZ23 group
+      ansible.builtin.debug:
+        msg: "User: {{ admin_user }} -> Group: {{ server_dmz23.split('.')[0] }} via {{ winjump_host }}"
+      when: server_dmz23 != '' and admin_user != ''
+
+    - name: Add user to DMZ23 server AD group
+      microsoft.ad.group:
+        identity: "{{ server_dmz23.split('.')[0] }}"
+        members:
+          add:
+            - "{{ admin_user }}"
+      delegate_to: "{{ winjump_host }}"
+      vars:
+        ansible_user: "{{ service_user_dmz23 }}"
+        ansible_password: "{{ schrodingers_password }}"
+        ansible_connection: ssh
+        ansible_shell_type: powershell
+      when: server_dmz23 != '' and admin_user != ''
+      register: group_result_dmz23
+      failed_when: false
+
+    - name: Warn if DMZ23 AD group does not exist
+      ansible.builtin.debug:
+        msg: "WARNING: AD group {{ server_dmz23.split('.')[0] }} not found - group may need to be created first"
+      when: group_result_dmz23 is defined and group_result_dmz23.failed | default(false)
+
+    # ── DMZ24 ────────────────────────────────────────────────────────────────
+    - name: Determine jump host for DMZ24
+      ansible.builtin.set_fact:
+        dc_domain: "DMZ.EXAMPLE.COM"
+      when: server_dmz24 != '' and admin_user != ''
+
+    - name: Include determine-jump-host role for DMZ24
+      ansible.builtin.include_role:
+        name: determine-jump-host
+      when: server_dmz24 != '' and admin_user != ''
+
+    - name: Show DMZ24 group
+      ansible.builtin.debug:
+        msg: "User: {{ admin_user }} -> Group: {{ server_dmz24.split('.')[0] }} via {{ winjump_host }}"
+      when: server_dmz24 != '' and admin_user != ''
+
+    - name: Add user to DMZ24 server AD group
+      microsoft.ad.group:
+        identity: "{{ server_dmz24.split('.')[0] }}"
+        members:
+          add:
+            - "{{ admin_user }}"
+      delegate_to: "{{ winjump_host }}"
+      vars:
+        ansible_user: "{{ service_user_dmz24 }}"
+        ansible_password: "{{ schrodingers_password }}"
+        ansible_connection: ssh
+        ansible_shell_type: powershell
+      when: server_dmz24 != '' and admin_user != ''
+      register: group_result_dmz24
+      failed_when: false
+
+    - name: Warn if DMZ24 AD group does not exist
+      ansible.builtin.debug:
+        msg: "WARNING: AD group {{ server_dmz24.split('.')[0] }} not found - group may need to be created first"
+      when: group_result_dmz24 is defined and group_result_dmz24.failed | default(false)

playbooks/misc/inspec-prep.yml

@@ -0,0 +1,17 @@
+# Needs 3 parameters
+# username for the inspec service account
+# username=svcdevopsinspec
+# SSH public key file path
+# ssh_public_key_path=ssh/inspec.pub
+# List of users to add to sudoers
+# ad_group_sudoers=['svcdevopsinspec']
+# dc_domain has to be set to the domain of the server to be configured
+# dc_domain=DMZ.EXAMPLE.COM
+
+- hosts: all
+  gather_facts: True
+  become: True
+  roles:
+  - determine-jump-host
+  - configure-inspec-access
+

playbooks/misc/install-ansible.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo 
+  roles:
+    - install-ansible

playbooks/misc/install-docker-ce.yml

@@ -0,0 +1,7 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo 
+  roles:
+    - install-docker-ce
+    - configure-artifactory-docker-registry

playbooks/misc/install-microsoft-defender.yml

@@ -0,0 +1,9 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+#     - { role: set-onprem-facts, when: datacenter == 'onpremise' }
+#     - { role: subscription-manager-setup, when: datacenter == 'onpremise' }
+     - {role: install-microsoft-defender, become: yes }
+     - fix--audit-logs-in-message

playbooks/misc/install-openscap-requirements.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo 
+  roles:
+    - install-openscap-requirements

playbooks/misc/install-useful-stuff.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo 
+  roles:
+    - install-useful-stuff

playbooks/misc/list-netbox-vm.yml

@@ -0,0 +1,8 @@
+- name: Show one specific VM from NetBox
+  hosts: localhost
+  gather_facts: false
+  roles:
+    - role: list-netbox-vm
+      vars:
+        vm_name: "nboxaap01.EXAMPLE-CORP.COM"
+

playbooks/misc/list-netbox-vms.yml

@@ -0,0 +1,6 @@
+- name: List all VMs in NetBox
+  hosts: localhost
+  gather_facts: false
+  roles:
+    - list-netbox-vms 
+

playbooks/misc/lookforjira.yml

@@ -0,0 +1,16 @@
+---
+- name: Lookup Jira Issue
+  hosts: localhost
+  gather_facts: false
+  connection: local
+
+  vars_files:
+    - roles/lookforjira/vars/main.yml
+
+  vars_prompt:
+    - name: "lookforjira_issue_key"
+      prompt: "Enter Jira issue number (e.g., 725 or ILI-725)"
+      private: false
+
+  roles:
+    - lookforjira

playbooks/misc/lookforvm.yml

@@ -0,0 +1,8 @@
+---
+- name: Run Search VM Role
+  hosts: all
+  connection: local
+  gather_facts: no
+  roles:
+#    - set-vxrail-facts
+    - lookforvm

playbooks/misc/netbox.yml

@@ -0,0 +1,9 @@
+plugin: netbox.netbox.nb_inventory
+api_endpoint: https://netbox.example.EXAMPLE-CORP.COM
+token: !vault |
+      $ANSIBLE_VAULT;1.2.6;AES256
+      REDACTED_FOR_PUBLIC_SHARING
+validate_certs: false
+flatten_custom_fields: true
+query_filters:
+  - status: active

playbooks/misc/netbox_inventory.yml

@@ -0,0 +1,7 @@
+# netbox_inventory.yml
+plugin: netbox.netbox.nb_inventory
+api_endpoint: "https://netbox.example.EXAMPLE-CORP.COM"
+api_token: !vault |
+      $ANSIBLE_VAULT;1.2.6;AES256
+      REDACTED_FOR_PUBLIC_SHARING
+validate_certs: false

playbooks/misc/netbox_test.yml

@@ -0,0 +1,9 @@
+plugin: netbox.netbox.nb_inventory
+api_endpoint: https://netbox.example.EXAMPLE-CORP.COM
+token: !vault |
+      $ANSIBLE_VAULT;1.2.6;AES256
+      REDACTED_FOR_PUBLIC_SHARING
+validate_certs: false
+flatten_custom_fields: true
+query_filters:
+  - status: active

playbooks/misc/ntpadhoc.yml

@@ -0,0 +1,20 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo
+  tasks:
+    - name: Get current chrony.conf
+      ansible.builtin.shell: grep server /etc/chrony.conf | grep -v ^#
+      register: chronyconf
+
+    - name: Output servers of chrony.conf
+      ansible.builtin.debug:
+        var: chronyconf.stdout
+
+    - name: Get chronyc sources
+      ansible.builtin.shell: sudo chronyc -n sources|grep ^=== -A3|grep -v ^===
+      register: chronysources
+
+    - name: Output chronyc sources
+      ansible.builtin.debug:
+        var: chronysources.stdout

playbooks/misc/oms-logrotate-fix.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - oms-logrotate-fix

playbooks/misc/realm-join-rhel9.yml

@@ -0,0 +1,9 @@
+---
+- hosts: all
+  become: True
+  become_method: sudo
+  roles:
+    - realm-join-rhel9
+    - ssh-deny-root
+    - { role: add-sudoers-group, when: group_name is defined }
+    - { role: add-allowed-group, when: group_name is defined }

playbooks/misc/realm-join.yml

@@ -0,0 +1,9 @@
+---
+- hosts: all
+  become: True
+  become_method: sudo
+  roles:
+    - realm-join
+    - ssh-deny-root
+    - { role: add-sudoers-group, when: group_name is defined }
+    - { role: add-allowed-group, when: group_name is defined }

playbooks/misc/remove-ad-group.yml

@@ -0,0 +1,13 @@
+- hosts: all
+  gather_facts: True
+  connection: local
+  become: False
+  roles:
+  - determine-jump-host
+
+- hosts: deploy.EXAMPLE-CORP.COM
+  gather_facts: True
+  connection: local
+  become: False
+  roles:
+  - remove-ad-group

playbooks/misc/remove-computer-object.yml

@@ -0,0 +1,6 @@
+- hosts: all
+  gather_facts: False
+  become: True
+  roles:
+  - determine-jump-host
+  - remove-computer-object

playbooks/misc/remove-malware.yml

@@ -0,0 +1,5 @@
+- hosts: all
+  become: yes
+  become_method: sudo
+  roles:
+    - remove-malware

playbooks/misc/remove-netbox-tags.yml

@@ -0,0 +1,10 @@
+---
+- name: Remove NetBox tags from virtual machines
+  hosts: all
+  gather_facts: no
+  connection: local
+  vars:
+    NETBOX_API: "{{ lookup('env', 'NETBOX_API') | default('https://netbox.example.EXAMPLE-CORP.COM') }}"
+    NETBOX_TOKEN: "{{ lookup('env', 'NETBOX_TOKEN') }}"
+  roles:
+    - remove-netbox-tag

playbooks/misc/remove-subscription-pool.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo
+  roles:
+    - remove-subscription-pool

playbooks/misc/revoke-wifi-certificate.yml

@@ -0,0 +1,6 @@
+---
+- hosts: all 
+  become: yes
+  become_method: sudo
+  roles:
+    - workstation/revoke-wifi-certificate