Update storage and Keycloak config

.ansible-lint

@@ -0,0 +1,34 @@
+---
+profile: basic
+
+# Paths to exclude from linting
+exclude_paths:
+  - .ansible/
+  - collections/ansible_collections/
+  - roles/geerlingguy.java/
+  - roles/oatakan.rhel_ovirt_template/
+  - roles/oatakan.rhel_template_build/
+  - roles/oatakan.windows_template_build/
+  - roles/oatakan.windows_update/
+  - roles/oatakan.windows_virtio/
+  - roles/ikke_t.container_image_cleanup/
+  - roles/ikke_t.podman_container_systemd/
+  - roles/sage905.mineos/
+  - roles/sage905.waterfall/
+
+# Warn rather than fail on these during initial adoption
+warn_list:
+  - yaml[line-length]
+  - name[casing]
+  - fqcn[action-core]
+  - no-changed-when
+
+# Use progressive mode: only flag new violations on changed files
+# (useful for gradual adoption in existing projects)
+# progressive: true
+
+mock_modules:
+  - community.proxmox.proxmox_kvm
+  - community.proxmox.proxmox_vm_info
+
+mock_roles: []

.claude/settings.json

@@ -0,0 +1,7 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(du:*)"
+    ]
+  }
+}

.devcontainer/devcontainer.json

@@ -0,0 +1,24 @@
+{
+  "name": "ansible-dev-container-codespaces",
+  "image": "ghcr.io/ansible/community-ansible-dev-tools:latest",
+  "containerUser": "root",
+  "runArgs": [
+    "--security-opt",
+    "seccomp=unconfined",
+    "--security-opt",
+    "label=disable",
+    "--cap-add=SYS_ADMIN",
+    "--cap-add=SYS_RESOURCE",
+    "--device",
+    "/dev/fuse",
+    "--security-opt",
+    "apparmor=unconfined",
+    "--hostname=ansible-dev-container"
+  ],
+  "updateRemoteUserUID": true,
+  "customizations": {
+    "vscode": {
+      "extensions": ["redhat.ansible","redhat.vscode-redhat-account"]
+    }
+  }
+}

.devcontainer/docker/devcontainer.json

@@ -0,0 +1,24 @@
+{
+  "name": "ansible-dev-container-docker",
+  "image": "ghcr.io/ansible/community-ansible-dev-tools:latest",
+  "containerUser": "root",
+  "runArgs": [
+    "--security-opt",
+    "seccomp=unconfined",
+    "--security-opt",
+    "label=disable",
+    "--cap-add=SYS_ADMIN",
+    "--cap-add=SYS_RESOURCE",
+    "--device",
+    "/dev/fuse",
+    "--security-opt",
+    "apparmor=unconfined",
+    "--hostname=ansible-dev-container"
+  ],
+  "updateRemoteUserUID": true,
+  "customizations": {
+    "vscode": {
+      "extensions": ["redhat.ansible","redhat.vscode-redhat-account"]
+    }
+  }
+}

.devcontainer/podman/devcontainer.json

@@ -0,0 +1,38 @@
+{
+  "name": "ansible-dev-container-podman",
+  "image": "ghcr.io/ansible/community-ansible-dev-tools:latest",
+  "containerUser": "root",
+  "containerEnv": {
+    "REGISTRY_AUTH_FILE": "/container-auth.json"
+  },
+  "runArgs": [
+    "--cap-add=CAP_MKNOD",
+    "--cap-add=NET_ADMIN",
+    "--cap-add=SYS_ADMIN",
+    "--cap-add=SYS_RESOURCE",
+    "--device",
+    "/dev/fuse",
+    "--security-opt",
+    "seccomp=unconfined",
+    "--security-opt",
+    "label=disable",
+    "--security-opt",
+    "apparmor=unconfined",
+    "--security-opt",
+    "unmask=/sys/fs/cgroup",
+    "--userns=host",
+    "--hostname=ansible-dev-container",
+    "--env-file",
+    ".env"
+  ],
+  "customizations": {
+    "vscode": {
+      "extensions": ["redhat.ansible","redhat.vscode-redhat-account"]
+    }
+  },
+  "mounts": [
+    "source=${localEnv:XDG_RUNTIME_DIR}/containers/auth.json,target=/container-auth.json,type=bind,consistency=cached",
+    "source=${localEnv:HOME}/Dev/inventories/toallab-inventory,target=/workspaces/inventory,type=bind,consistency=cached",
+    "source=${localEnv:HOME}/Dev/ansible_collections/,target=/workspaces/collections/,type=bind,consistency=cached",
+  ]
+}

.gitignore

@@ -107,7 +107,18 @@ venv.bak/
 
 # Ansible
 *.retry
+ansible-navigator.log
+.ansible/
 
-roles/toallab.infrastructure/backup/
-roles/lightbulb-ansiblered-deck/
+# Vendor roles (install via roles/requirements.yml)
+roles/geerlingguy.*
+roles/oatakan.*
+roles/ikke_t.*
+roles/sage905.*
 
+.vscode/
+keys/
+collections/ansible_collections/
+.vaultpw
+context/
+ansible-navigator.yml

.pre-commit-config.yaml

@@ -0,0 +1,28 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.2
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.35.1
+    hooks:
+      - id: yamllint
+        args: [--config-file, .yamllint]
+        exclude: |
+          (?x)^(
+            roles/geerlingguy\..*/|
+            roles/oatakan\..*/|
+            roles/ikke_t\..*/|
+            roles/sage905\..*/|
+            \.ansible/|
+            collections/ansible_collections/
+          )
+
+  - repo: https://github.com/ansible/ansible-lint
+    rev: v25.1.3
+    hooks:
+      - id: ansible-lint
+        # ansible-lint reads .ansible-lint for configuration
+        additional_dependencies:
+          - ansible-core>=2.15

.vscode/settings.json

@@ -1 +0,0 @@
-{}

.yamllint

@@ -0,0 +1,39 @@
+---
+extends: default
+
+rules:
+  # Allow longer lines for readability in tasks
+  line-length:
+    max: 160
+    level: warning
+
+  # Allow both true/false and yes/no boolean styles
+  truthy:
+    allowed-values: ['true', 'false', 'yes', 'no']
+    check-keys: false
+
+  # Ansible uses double-bracket Jinja2 - allow in strings
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+
+  # Allow some indentation flexibility for Ansible block style
+  indentation:
+    spaces: 2
+    indent-sequences: true
+    check-multi-line-strings: false
+
+  # Comments should have a space after #
+  comments:
+    min-spaces-from-content: 1
+
+  # Don't require document-start marker on every file
+  document-start: disable
+
+ignore: |
+  roles/geerlingguy.*
+  roles/oatakan.*
+  roles/ikke_t.*
+  roles/sage905.*
+  .ansible/
+  collections/ansible_collections/

CLAUDE.md

@@ -0,0 +1,42 @@
+# CLAUDE.md
+
+## Session Start
+
+Read the latest handoff in docs/summaries/ if one exists. Load only the files that handoff references — not all summaries. If no handoff exists, ask: what is the project, what type of work, what is the target deliverable.
+
+Before starting work, state: what you understand the project state to be, what you plan to do this session, and any open questions.
+
+## Identity
+
+You work with Pat, a Senior Solutions Architect at Red Hat building automation for a HomeLab.
+
+## Rules
+
+1. Do not mix unrelated project contexts in one session.
+2. Write state to disk, not conversation. After completing meaningful work, write a summary to docs/summaries/ using templates from templates/claude-templates.md. Include: decisions with rationale, exact numbers, file paths, open items.
+3. Before compaction or session end, write to disk: every number, every decision with rationale, every open question, every file path, exact next action.
+4. When switching work types (research → writing → review), write a handoff to docs/summaries/handoff-[date]-[topic].md and suggest a new session.
+5. Do not silently resolve open questions. Mark them OPEN or ASSUMED.
+6. Do not bulk-read documents. Process one at a time: read, summarize to disk, release from context before reading next. For the detailed protocol, read docs/context/processing-protocol.md.
+7. Sub-agent returns must be structured, not free-form prose. Use output contracts from templates/claude-templates.md.
+
+## Where Things Live
+
+- templates/claude-templates.md — summary, handoff, decision, analysis, task, output contract templates (read on demand)
+- docs/summaries/ — active session state (latest handoff + project brief + decision records + source summaries)
+- docs/context/ — reusable domain knowledge, loaded only when relevant to the current task
+  - processing-protocol.md — full document processing steps
+  - archive-rules.md — summary lifecycle and file archival rules
+- playbooks/ -- Main ansible playbooks
+- roles/ -- Both custom, and external Ansible roles
+- collections/ -- should only contain requirements.yml
+- docs/archive/ — processed raw files. Do not read unless explicitly told.
+- output/deliverables/ — final outputs
+
+## Error Recovery
+
+If context degrades or auto-compact fires unexpectedly: write current state to docs/summaries/recovery-[date].md, tell the user what may have been lost, suggest a fresh session.
+
+## Before Delivering Output
+
+Verify: exact numbers preserved, open questions marked OPEN, output matches what was requested (not assumed), claims backed by specific data, output consistent with stored decisions in docs/context/, summary written to disk for this session's work.

TODO.txt

@@ -0,0 +1 @@
+- Replace alvaroaleman.freeipa-client with https://galaxy.ansible.com/freeipa/ansible_freeipa

ansible.cfg

@@ -0,0 +1,44 @@
+[defaults]
+# Inventory - override with -i or ANSIBLE_INVENTORY env var
+inventory              = /home/ptoal/Dev/inventories/toallab-inventory/static.yml
+
+# Role and collection paths
+roles_path             = roles
+collections_path       = ./collections:/workspaces/collections:~/.ansible/collections:/usr/share/ansible/collections
+
+# Interpreter discovery
+interpreter_python     = auto_silent
+
+# Performance
+gathering              = smart
+fact_caching           = jsonfile
+fact_caching_connection = /tmp/ansible_fact_cache
+fact_caching_timeout   = 3600
+
+# Output
+stdout_callback        = yaml
+bin_ansible_callbacks  = True
+callbacks_enabled      = profile_tasks
+
+# SSH settings
+host_key_checking      = False
+timeout                = 30
+
+# Vault
+vault_password_file    = vault-id-from-op-client.sh
+
+# Misc
+retry_files_enabled    = False
+nocows                 = True
+
+[inventory]
+# Enable inventory plugins
+enable_plugins = host_list, yaml, ini, auto, toml
+
+[privilege_escalation]
+become         = False
+become_method  = sudo
+
+[ssh_connection]
+pipelining     = True
+ssh_args       = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no

bootstrap.yml

@@ -1,15 +0,0 @@
-# Note: need to specify extra_vars, providing ansible_ssh_user, and ansible_ssh_pass
-- name: Set up IPA Client
-  hosts: lab-ipa-client
-  become: yes
-  roles:
-    - role: debian-freeipa-client
-      when: ansible_facts['os_family'] == "Debian"
-    - role: alvaroaleman.freeipa-client
-      when: ansible_facts['os_family'] == "RedHat"
-
-- name: Set up Basic Lab Packages
-  hosts: all
-  become: yes
-  roles:
-    - role: toal-common

collections/requirements.old

@@ -0,0 +1,10 @@
+---
+collections:
+  - name: davidban77.gns3
+  - name: netbox.netbox
+  - name: freeipa.ansible_freeipa
+  - name: redhat.satellite
+  - name: community.general
+  - name: redhat.satellite
+  - name: community.crypto
+  - name: onepassword.connect

collections/requirements.yml

@@ -0,0 +1,16 @@
+---
+collections:
+  - name: community.general
+  - name: community.proxmox
+  - name: community.crypto
+  - name: netbox.netbox
+  - name: freeipa.ansible_freeipa
+  - name: redhat.satellite
+  - name: onepassword.connect
+  - name: davidban77.gns3
+  - name: oxlorg.opnsense
+    source: https://github.com/O-X-L/ansible-opnsense
+    type: git
+    version: latest
+  - name: middleware_automation.keycloak
+  - name: infra.aap_configuration

docs/summaries/2026-02-26-aap-keycloak-oidc.md

@@ -0,0 +1,54 @@
+# Session Summary: AAP Keycloak OIDC Configuration
+Date: 2026-02-26
+
+## Work Done
+Added Keycloak OIDC authentication support for AAP 2.6 using the correct approach:
+`infra.aap_configuration.gateway_authenticators` (AAP Gateway API) instead of CR extra_settings (wrong for 2.6).
+
+## Files Changed
+- `collections/requirements.yml` — Added `infra.aap_configuration`
+- `playbooks/deploy_aap.yml` — Full rewrite:
+  - Play 0 (`aap_configure_keycloak`): Creates Keycloak OIDC client with correct callback URI `/accounts/profile/callback/`
+  - Play 1: Unchanged (installs AAP via `aap_operator` role)
+  - Play 2 (`aap_configure_oidc`): Fetches admin password from K8s secret, calls `infra.aap_configuration.gateway_authenticators`
+- `roles/aap_operator/defaults/main.yml` — Removed OIDC vars (not role responsibility)
+- `roles/aap_operator/meta/argument_specs.yml` — Removed OIDC var docs
+- `roles/aap_operator/tasks/main.yml` — Removed OIDC include task (was wrong approach)
+- `roles/aap_operator/tasks/configure_oidc.yml` — Replaced with redirect comment
+
+## Key Decisions
+- **OIDC must be configured via AAP Gateway API** (not CR extra_settings). AAP 2.5+ Gateway uses Django-based auth with `ansible_base.authentication` plugins.
+- **authenticator type**: `ansible_base.authentication.authenticator_plugins.generic_oidc`
+- **Callback URL**: `{aap_gateway_url}/accounts/profile/callback/` (not `/social/complete/oidc/`)
+- **Admin password**: Fetched dynamically from K8s secret `{platform_name}-admin-password` (not stored separately in vault)
+- **OIDC not in `aap_operator` role**: Kept as a separate playbook play (post-install concern)
+
+## Variables Required in `aap` host_vars
+```yaml
+aap_gateway_url: "https://aap.apps.<cluster>.<domain>"
+aap_oidc_issuer: "https://keycloak.toal.ca/realms/<realm>"
+aap_oidc_client_id: aap   # optional, default: aap
+```
+
+## Vault Variables
+```
+vault_aap_oidc_client_secret  — OIDC client secret from Keycloak
+vault_aap_deployer_token      — K8s SA token (already required)
+vault_keycloak_admin_password — required for Play 0
+```
+
+## Usage
+```bash
+# Step 1: Create Keycloak client (once, idempotent)
+ansible-navigator run playbooks/deploy_aap.yml --tags aap_configure_keycloak
+
+# Step 2: Deploy AAP
+ansible-navigator run playbooks/deploy_aap.yml
+
+# Step 3: Register OIDC authenticator in AAP Gateway
+ansible-navigator run playbooks/deploy_aap.yml --tags aap_configure_oidc
+```
+
+## Open Items
+- ASSUMED: `infra.aap_configuration` + its dependency `ansible.platform` are available or installable in `aap.toal.ca/ee-demo:latest`. If not, a custom EE rebuild is needed.
+- The `aap-deployer` SA has `get` on secrets in `aap` namespace — confirmed via RBAC in `deploy_openshift.yml` Play 9.

filter_plugins/netbox_filters.py

@@ -0,0 +1,42 @@
+# I started this to create a filter that would translate netbox to linux-system-roles/network.
+
+from ansible.utils.display import Display
+from ansible.parsing.yaml import dumper
+display = Display()
+
+def get_type(intf_type):
+  # This is not ideal.  Fix it.
+  # https://github.com/netbox-community/netbox/blob/3eb2d45e8deedfc71cfba9a3c2f919df760b6dca/netbox/dcim/migrations/0082_3569_interface_fields.py
+  if intf_type['id'] == 0:
+    return 'vlan'
+  elif 799 < intf_type['id'] < 2000:
+    return 'ethernet'
+  elif intf_type['id'] == 200:
+    return 'bond'
+
+
+def translate_interface(interface):
+
+  lsrint = {
+    'name': interface['name'],
+    'interface_name': interface['name'],
+    'state': 'up' if interface['enabled'] else 'down',
+    'persistent_state': 'present' if interface['enabled'] else 'absent',
+  }
+  lsrint['type'] = get_type(interface['type'])
+
+  if lsrint['type'] == "vlan":
+    #Interface name must be in the format <intf>.<vlan>
+    lsrint['parent'] = interface['name'].split('.',1)[0]
+
+  if interface.get('ip_address'):
+    lsrint['ip']['address'] = [ ip['address'] for ip in interface['ip_addresses'] ]
+
+  return lsrint
+
+def nbint_to_lsr_network(interfaces):
+  return [ translate_interface(netif) for netif in interfaces ]
+
+class FilterModule(object):
+    def filters(self):
+      return {'nbint_to_lsr_network': nbint_to_lsr_network}

netbox.yml

@@ -1,23 +0,0 @@
-plugin: netbox
-validate_certs: False
-config_context: True
-group_by:
-  - device_roles
-
-    #query_filters:
-    #  - role: core-switch
-    
-#query_filters:
-#  - role: network-edge-router
-
-# Query filters are passed directly as an argument to the fetching queries.
-# You can repeat tags in the query string.
-
-    #query_filters:
-    #  - role: server
-    #  - tag: web
-    #  - tag: production
-
-    #compose:
-    #  foo: last_updated
-    #  bar: display_name

pi-dhcp.yml

@@ -1,22 +0,0 @@
----
-- name: Set Up DHCP System
-  hosts: dhcp-server
-  become: true
-
-  tasks:
-    - name: DHCP Daemon is installed
-      apt:
-        name: isc-dhcp-server
-        state: latest
-      notify: Restart DHCPD
-
-    - name: Generate dhcpd.conf
-      template:
-        src: dhcpd.conf.j2
-        dest: "{{ dhcpd_conf_path }}"
-
-  handlers:
-    - name: Restart DHCPD
-      service: 
-        name: isc-dhcpd-server
-        state: restarted

playbooks/bootstrap.yml

@@ -0,0 +1,36 @@
+# Note: need to specify extra_vars, providing ansible_ssh_user, and ansible_ssh_pass
+
+- name: Set up IPA Client
+  hosts: tag_ipa_client
+  become: yes
+  collections:
+    - freeipa.ansible_freeipa
+  pre_tasks:
+    - name: Set hostname
+      hostname:
+        name: "{{inventory_hostname}}"
+
+    - name: Attach subscriptions
+      command: '/usr/bin/subscription-manager attach'
+      register: result
+      changed_when:
+        - '"All installed products are covered by valid entitlements. No need to update subscriptions at this time." not in result.stdout'
+      when: ansible_distribution == "RedHat"
+
+
+  roles:
+    - role: debian-freeipa-client
+      when: ansible_os_family == "Debian"
+    - role: ipaclient
+      state: present
+      when: ansible_os_family == "RedHat"
+
+- name: Packages
+  hosts: all
+  become: yes
+  tasks:
+
+    - name: Host Packages
+      package:
+        state: present
+        name: "{{ host_packages }}"

playbooks/build_rhel_template.yml

@@ -0,0 +1,29 @@
+---
+- name: Create Build Host in Satellite
+  hosts: localhost
+  connection: localhost
+
+  tasks:
+    - name: Build Host
+      redhat.satellite.host:
+        architecture: x86_64
+        build: true
+        comment: "RHEL 8 Template"
+        compute_profile: "4c8g"
+        compute_attributes:  
+          start: "1"
+        compute_resource: "ToalLab"
+        content_view: "composite-rhel8"
+        domain: "sandbox.toal.ca"
+        enabled: true
+        hostgroup: "RHEL8"
+        lifecycle_environment: "Library"
+        location: "Lab"
+        name: "rhel8build.sandbox.toal.ca"
+        operatingsystem: "RedHat 8.3"
+        organization: "Toal.ca"
+        server_url: "https://satellite1.mgmt.toal.ca/"
+        subnet: "sandbox"
+        username: "{{ satellite_admin_user }}"
+        password: "{{ satellite_admin_pass }}"
+        validate_certs: no

playbooks/buildvm.yml

@@ -0,0 +1,233 @@
+# Playbook to build new VMs in RHV Cluste
+# Currently only builds RHEL VMs
+
+# Create Host
+
+- name: Preflight checks
+  hosts: tag_build
+  gather_facts: false
+  tasks:
+    - assert:
+        that:
+          - site == "sagely_dc"
+          - is_virtual
+
+- name: Ensure Primary IP exists and is in DNS
+  hosts: tag_build
+  gather_facts: false
+  collections:
+    - netbox.netbox
+    - freeipa.ansible_freeipa
+    - redhat.rhv
+
+  tasks:
+
+    - name: Obtain SSO token for RHV
+      ovirt_auth:
+        url: "{{ ovirt_url }}"
+        username: "{{ ovirt_username }}"
+        insecure: true
+        password: "{{ ovirt_password }}"
+      delegate_to: localhost
+
+    - name: Get unused IP Address from pool
+      netbox_ip_address:
+        netbox_url: "{{ netbox_api }}"
+        netbox_token: "{{ netbox_token }}"
+        data:
+          prefix: 192.168.16.0/20
+          assigned_object:
+            name: eth0
+            virtual_machine: "{{ inventory_hostname }}"
+        state: new
+      register: new_ip
+      when: primary_ip4 is undefined
+      delegate_to: localhost
+
+    - set_fact:
+        primary_ip4: "{{ new_ip.ip_address.address|ipaddr('address') }}"
+        vm_hostname: "{{ inventory_hostname.split('.')[0] }}"
+        vm_domain: "{{ inventory_hostname.split('.',1)[1] }}"
+      delegate_to: localhost
+      when: primary_ip4 is undefined
+
+    - name: Primary IPv4 Assigned in Netbox
+      netbox_virtual_machine:
+        netbox_url: "{{ netbox_api }}"
+        netbox_token: "{{ netbox_token }}"
+        data:
+          primary_ip4: "{{ primary_ip4 }}"
+          name: "{{ inventory_hostname }}"
+      delegate_to: localhost
+
+    - name: Primary IPv4 Address
+      debug:
+        var: primary_ip4
+
+    - name: Ensure IP Address in IdM
+      ipadnsrecord:
+        records:
+          - name: "{{ vm_hostname }}"
+            zone_name: "{{ vm_domain }}"
+            record_type: A
+            record_value:
+              - "{{ new_ip.ip_address.address|ipaddr('address') }}"
+            create_reverse: true
+        ipaadmin_password: "{{ ipaadmin_password }}"
+      delegate_to: idm1.mgmt.toal.ca
+
+- name: Create VMs
+  hosts: tag_build
+  connection: local
+  gather_facts: no
+  collections:
+    - netbox.netbox
+    - redhat.rhv
+  vars:
+    # Workaround to get correct venv python interpreter
+    ansible_python_interpreter: "{{ ansible_playbook_python }}"
+
+
+  tasks:
+    - name: Basic Disk Profile
+      set_fact:
+        vm_disks:
+        -  name: '{{ inventory_hostname }}_boot'
+           bootable: true
+           sparse: true
+           descr: '{{ inventory_hostname }} Boot / Root disk'
+           interface: virtio
+           size: '{{ disk|default(40) }}'
+           state: present
+           storage_domain: "{{ rhv_storage_domain }}"
+           activate: true
+      when: vm_disks is not defined
+
+    - name: Create VM Disks
+      ovirt_disk:
+        auth: '{{ ovirt_auth }}'
+        name: '{{ item.name }}'
+        description: '{{ item.descr }}'
+        interface: '{{ item.interface }}'
+        size: '{{ item.size|int * 1024000 }}'
+        state: '{{ item.state }}'
+        sparse: '{{ item.sparse }}'
+        wait: true
+        storage_domain: '{{ item.storage_domain }}'
+      async: 300
+      poll: 15
+      loop: '{{ vm_disks }}'
+
+    - set_fact:
+        nb_query_filter: "slug={{ platform }}"
+    - debug: msg='{{ query("netbox.netbox.nb_lookup", "platforms", api_filter=nb_query_filter, api_endpoint=netbox_api, token=netbox_token)[0].value.name }}'
+
+    - name: Create VM in RHV
+      ovirt_vm:
+        auth: '{{ ovirt_auth }}'
+        name: '{{ inventory_hostname }}'
+        state: present
+        memory: '{{ memory }}MiB'
+        memory_guaranteed: '{{ (memory / 2)|int }}MiB'
+        disks: '{{ vm_disks }}'
+        cpu_cores: '{{ vcpus }}'
+        cluster: '{{ cluster }}'
+        # This is ugly Can we do better?
+        operating_system: '{{ query("netbox.netbox.nb_lookup", "platforms", api_filter=nb_query_filter, api_endpoint=netbox_api, token=netbox_token)[0].value.name }}'
+        type: server
+        graphical_console:
+          protocol:
+            - vnc
+            - spice
+        boot_devices:
+          - hd
+      async: 300
+      poll: 15
+      notify: PXE Boot
+      register: vm_result
+
+    - name: Assign NIC
+      ovirt_nic:
+        auth: '{{ ovirt_auth }}'
+        interface: virtio
+        mac_address: '{{ item.mac_address|default(omit) }}'
+        name: '{{ item.name }}'
+        profile: '{{ item.untagged_vlan.name }}'
+        network: '{{ item.untagged_vlan.name }}' # This is fragile
+        state: '{{ (item.enabled == True) |ternary("plugged","unplugged") }}'
+        linked: yes
+        vm: '{{ inventory_hostname }}'
+      loop: '{{ interfaces }}'
+      register: interface_result
+
+    - debug: var=interface_result 
+
+    - name: Host configured in Satellite
+      redhat.satellite.host:
+        username: "{{ satellite_admin_user }}"
+        password: "{{ satellite_admin_pass }}"
+        server_url: "{{ satellite_url }}"
+        name: "{{ inventory_hostname }}"
+        hostgroup: "RHEL8/RHEL8 Sandbox"
+        organization: Toal.ca
+        location: Lab
+        ip: "{{ primary_ip4 }}"
+        mac: "{{ interface_result.results[0].nic.mac.address }}" #fragile
+        build: "{{ vm_result.changed |ternary(true,false) }}"
+        validate_certs: no
+
+    - name: Assign interface MACs to Netbox
+      netbox_vm_interface:
+        netbox_url: "{{ netbox_api }}"
+        netbox_token: "{{ netbox_token }}"
+        data:
+          name: "{{ item.nic.name }}"
+          mac_address: "{{ item.nic.mac.address }}"
+          virtual_machine: "{{ inventory_hostname }}"
+      loop: "{{ interface_result.results }}"
+
+  handlers:
+    - name: PXE Boot
+      ovirt_vm:
+        auth: "{{ ovirt_auth }}"
+        name: "{{ inventory_hostname }}"
+        boot_devices:
+         - network
+        state: running
+      register: vm_build_result
+
+- name: Ensure VM is running and reachable
+  hosts: tag_build
+  gather_facts: no
+  connection: local
+  collections:
+    - redhat.rhv
+  vars:
+    # Hack to work around virtualenv python interpreter
+    ansible_python_interpreter: "{{ ansible_playbook_python }}"
+
+  tasks:
+    - name: VM is running
+      ovirt_vm:
+          auth: "{{ ovirt_auth }}"
+          name: "{{ inventory_hostname }}"
+          state: running
+          boot_devices:
+          - hd
+
+    - name: Wait for SSH to be ready
+      wait_for_connection:
+        timeout: 1800
+        sleep: 5
+
+    # - name: Ensure IP address is correct in Netbox
+    #   netbox_virtual_machine:
+    #     data:
+    #       name: "{{ inventory_hostname }}"
+    #       primary_ip4: "{{ primary_ip4 }}"
+    #     netbox_url: "{{ netbox_api }}"
+    #     netbox_token: "{{ netbox_token }}"
+    #     state: present      
+    #   delegate_to: localhost
+
+#TODO: Clear Build tag

playbooks/create_gitea.yml

@@ -0,0 +1,31 @@
+---
+- name: Create Gitea Server
+  hosts: gitea
+  gather_facts: false
+
+  vars:
+    dnsmadeeasy_hostname: "{{ service_dns_name.split('.') | first }}"
+    dnsmadeeasy_domain: "{{ service_dns_name.split('.',1) |last }}"
+    dnsmadeeasy_record_type: CNAME
+    dnsmadeeasy_record_value: gate.toal.ca.
+    dnsmadeeasy_record_ttl: 600
+    opnsense_service_hostname: "{{ dnsmadeeasy_hostname }}"
+    opnsense_service_domain: "{{ dnsmadeeasy_domain }}"
+
+  tasks:
+    - name: Configure DNS
+      ansible.builtin.import_role:
+        name: toallab.infra.dnsmadeeasy
+        tasks_from: provision.yml
+
+    - name: Configure Service
+      ansible.builtin.import_role:
+        name: toallab.infra.opnsense_service
+        tasks_from: provision.yml
+      module_defaults:
+        group/oxlorg.opnsense.all:
+          firewall: "{{ opnsense_host }}"
+          api_key: "{{ opnsense_api_key }}"
+          api_secret: "{{ opnsense_api_secret }}"
+          ssl_verify: "{{ opnsense_ssl_verify }}"
+          api_port: "{{ opnsense_api_port|default(omit) }}"

playbooks/create_host.yml

@@ -0,0 +1,33 @@
+---
+# Create Host
+- name: Get IP Address from pool
+  hosts: localhost
+
+  tasks:
+    - name: Get unused IP Address from pool
+      netbox.netbox.netbox_ip_address:
+        netbox_url: "{{ netbox_api }}"
+        netbox_token: "{{ netbox_token }}"
+        data:
+          prefix: 192.168.16.0/20
+        state: new
+      register: new_ip
+
+    - debug: var=new_ip
+
+    - name: Create IP Address in IdM
+      freeipa.ansible_freeipa.ipadnsrecord:
+        records:
+          - name: test1
+            zone_name: sandbox.toal.ca
+            record_type: A
+            record_value:
+              - "{{ new_ip.ip_address.address|ipaddr('address') }}"
+            create_reverse: true
+        ipaadmin_password: "{{ ipaadmin_password }}"
+      delegate_to: idm1.mgmt.toal.ca
+
+# Test Comment
+    # - name: Create Satellite Host
+    # - name: Create RHV VM
+    # - name:

playbooks/create_satellite_host.yml

@@ -0,0 +1,25 @@
+---
+- name: Create new VM / Host in Satellite
+  hosts: sat6.lab.toal.ca
+  vars:
+    sat6_fqdn: "sat6.lab.toal.ca"
+    sat6_user: "{{ vault_sat6_user }}"
+    sat6_pass: "{{ vault_sat6_pass }}"
+    sat6_organization: "Toal.ca"
+    sat6_fail_on_existing: True
+    sat6_power_on_delay: 60
+    sat6_hosts:
+      #VM
+      - name: "rhel1"
+        host_group: "Lab RHEL Hosts/RHEL 8"
+        location: "Lab"
+        ipv4: "192.168.16.10"
+        domain: "sandbox.toal.ca"
+        comment: "Demo Server"
+        compute_resource: "Home Lab"
+        compute_profile: "2-Medium"
+        parameters:
+          - name: "build_type"
+            value: "httpd"
+  roles:
+    - ahuffman.sat6_create_hosts

playbooks/debug.yml

@@ -5,25 +5,25 @@
       vars:
         msg: |
             Module Variables ("vars"):
-            -------------------------- 
+            --------------------------
             {{ vars | to_nice_json }}
-    
+
             Environment Variables ("environment"):
             --------------------------------------
             {{ environment | to_nice_json }}
-    
+
             GROUP NAMES Variables ("group_names"):
             -------------------------------------
             {{ group_names | to_nice_json }}
-    
+
             GROUPS Variables ("groups"):
             ----------------------------
             {{ groups | to_nice_json }}
-    
+
             HOST Variables ("hostvars"):
             ----------------------------
             {{ hostvars | to_nice_json }}
-    
-      debug:
+
+      ansible.builtin.debug:
         msg: "{{ msg.split('\n') }}"
       tags: debug_info

playbooks/deploy_aap.yml

@@ -0,0 +1,219 @@
+---
+# Deploy Ansible Automation Platform on OpenShift
+#
+# Authenticates via the aap-deployer ServiceAccount token (not kubeadmin).
+# The token is stored in 1Password and loaded via vault_aap_deployer_token.
+#
+# Prerequisites:
+#   - OpenShift cluster deployed (deploy_openshift.yml)
+#   - aap-deployer ServiceAccount provisioned:
+#       ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+#   - SA token saved to 1Password as vault_aap_deployer_token
+#
+# Keycloak OIDC prerequisites (--tags aap_configure_keycloak,aap_configure_oidc):
+#   - Keycloak realm exists (configured via deploy_openshift.yml)
+#   - vault_aap_oidc_client_secret in 1Password (or it will be generated and displayed)
+#   - In host_vars for the aap host:
+#       aap_gateway_url: "https://aap.apps.<cluster>.<domain>"
+#       aap_oidc_client_id: aap
+#       aap_oidc_issuer: "https://keycloak.example.com/realms/<realm>"
+#       aap_oidc_public_key: "<RS256 public key from Keycloak realm Keys tab>"
+#
+# Play order:
+#   Play 0: aap_configure_keycloak  — Create Keycloak OIDC client for AAP Gateway
+#   Play 1: (default)               — Install AAP via aap_operator role
+#   Play 2: aap_configure_oidc      — Configure OIDC Authentication Method in AAP Gateway
+#
+# Usage:
+#   ansible-navigator run playbooks/deploy_aap.yml
+#   ansible-navigator run playbooks/deploy_aap.yml --tags aap_configure_keycloak
+#   ansible-navigator run playbooks/deploy_aap.yml --tags aap_configure_oidc
+#   ansible-navigator run playbooks/deploy_aap.yml --tags aap_configure_keycloak,aap_configure_oidc
+
+# ---------------------------------------------------------------------------
+# Play 0: Create Keycloak OIDC client for AAP (optional)
+# Runs on openshift hosts to access keycloak_url/keycloak_realm host vars.
+# Creates the OIDC client in Keycloak with the correct AAP Gateway callback URI.
+# ---------------------------------------------------------------------------
+- name: Configure Keycloak OIDC client for AAP
+  hosts: openshift
+  gather_facts: false
+  connection: local
+
+  tags:
+    - never
+    - aap_configure_keycloak
+
+  vars:
+    __aap_keycloak_api_url: "{{ keycloak_url }}{{ keycloak_context | default('') }}"
+    __aap_oidc_client_id: "{{ aap_oidc_client_id | default('aap') }}"
+    # AAP operator generates the Gateway route as {platform_name}-{namespace}.apps.{cluster}.{domain}
+    # e.g. platform 'aap' in namespace 'aap' → aap-aap.apps.openshift.toal.ca
+    __aap_platform_name: "{{ aap_operator_platform_name | default('aap') }}"
+    __aap_namespace: "{{ aap_operator_namespace | default('aap') }}"
+    __aap_oidc_redirect_uris:
+      - "https://{{ __aap_platform_name }}-{{ __aap_namespace }}.apps.{{ ocp_cluster_name }}.{{ ocp_base_domain }}/accounts/profile/callback/"
+
+  module_defaults:
+    middleware_automation.keycloak.keycloak_client:
+      auth_client_id: admin-cli
+      auth_keycloak_url: "{{ __aap_keycloak_api_url }}"
+      auth_realm: master
+      auth_username: "{{ keycloak_admin_user }}"
+      auth_password: "{{ vault_keycloak_admin_password }}"
+      validate_certs: "{{ keycloak_validate_certs | default(true) }}"
+
+  tasks:
+    - name: Set AAP OIDC client secret (vault value or generated)
+      ansible.builtin.set_fact:
+        __aap_oidc_client_secret: "{{ vault_aap_oidc_client_secret | default(lookup('community.general.random_string', length=32, special=false)) }}"
+        __aap_oidc_secret_generated: "{{ vault_aap_oidc_client_secret is not defined }}"
+      no_log: true
+
+    - name: Create AAP OIDC client in Keycloak
+      middleware_automation.keycloak.keycloak_client:
+        realm: "{{ keycloak_realm }}"
+        client_id: "{{ __aap_oidc_client_id }}"
+        name: "Ansible Automation Platform"
+        description: "OIDC client for AAP Gateway on {{ ocp_cluster_name }}.{{ ocp_base_domain }}"
+        enabled: true
+        protocol: openid-connect
+        public_client: false
+        standard_flow_enabled: true
+        implicit_flow_enabled: false
+        direct_access_grants_enabled: false
+        service_accounts_enabled: false
+        secret: "{{ __aap_oidc_client_secret }}"
+        redirect_uris: "{{ __aap_oidc_redirect_uris }}"
+        web_origins:
+          - "+"
+        protocol_mappers:
+          - name: groups
+            protocol: openid-connect
+            protocolMapper: oidc-group-membership-mapper
+            config:
+              full.path: "false"
+              id.token.claim: "true"
+              access.token.claim: "true"
+              userinfo.token.claim: "true"
+              claim.name: groups
+        state: present
+      no_log: "{{ keycloak_no_log | default(true) }}"
+
+    - name: Display generated client secret (save this to vault!)
+      ansible.builtin.debug:
+        msg:
+          - "*** GENERATED AAP OIDC CLIENT SECRET — SAVE THIS TO VAULT ***"
+          - "vault_aap_oidc_client_secret: {{ __aap_oidc_client_secret }}"
+          - ""
+          - "Save to 1Password and reference as vault_aap_oidc_client_secret."
+      when: __aap_oidc_secret_generated | bool
+
+    - name: Display Keycloak AAP OIDC configuration summary
+      ansible.builtin.debug:
+        msg:
+          - "Keycloak AAP OIDC client configured:"
+          - "  Realm    : {{ keycloak_realm }}"
+          - "  Client   : {{ __aap_oidc_client_id }}"
+          - "  Issuer   : {{ __aap_keycloak_api_url }}/realms/{{ keycloak_realm }}"
+          - "  Redirect : {{ __aap_oidc_redirect_uris | join(', ') }}"
+          - ""
+          - "Set in host_vars for the aap host:"
+          - "  aap_gateway_url: https://{{ __aap_platform_name }}-{{ __aap_namespace }}.apps.{{ ocp_cluster_name }}.{{ ocp_base_domain }}"
+          - "  aap_oidc_issuer: {{ __aap_keycloak_api_url }}/realms/{{ keycloak_realm }}"
+          - ""
+          - "Then run: --tags aap_configure_oidc to register the authenticator in AAP."
+        verbosity: 1
+
+# ---------------------------------------------------------------------------
+# Play 1: Install Ansible Automation Platform
+# ---------------------------------------------------------------------------
+- name: Install Ansible Automation Platform
+  hosts: aap
+  gather_facts: false
+  connection: local
+
+  pre_tasks:
+    - name: Verify aap-deployer token is available
+      ansible.builtin.assert:
+        that:
+          - vault_aap_deployer_token is defined
+          - vault_aap_deployer_token | length > 0
+        fail_msg: >-
+          vault_aap_deployer_token is not set. Provision the ServiceAccount with:
+          ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+          Then save the displayed token to 1Password as vault_aap_deployer_token.
+
+#  environment:
+#    K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
+#    K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"
+
+  roles:
+    - role: aap_operator
+
+# ---------------------------------------------------------------------------
+# Play 2: Configure Keycloak OIDC Authentication Method in AAP Gateway (optional)
+# Uses infra.aap_configuration.gateway_authenticators to register the OIDC
+# provider via the AAP Gateway API. Run after Play 1 (AAP must be Running).
+#
+# Requires in host_vars for the aap host:
+#   aap_gateway_url:      "https://aap.apps.<cluster>.<domain>"
+#   aap_oidc_issuer:      "https://keycloak.example.com/realms/<realm>"
+#   aap_oidc_client_id:   aap   (optional, default: aap)
+#   aap_oidc_public_key:  "<RS256 public key from Keycloak realm Keys tab>"
+# Vault:
+#   vault_aap_oidc_client_secret  — OIDC client secret from Keycloak
+# ---------------------------------------------------------------------------
+- name: Configure Keycloak OIDC Authentication in AAP Gateway
+  hosts: aap
+  gather_facts: false
+  connection: local
+
+  tags:
+    - never
+    - aap_configure_oidc
+
+  vars:
+    __aap_namespace: "{{ aap_operator_namespace | default('aap') }}"
+    __aap_platform_name: "{{ aap_operator_platform_name | default('aap') }}"
+
+  environment:
+    K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
+    K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"
+
+  pre_tasks:
+    - name: Fetch AAP admin password from K8s secret
+      kubernetes.core.k8s_info:
+        api_version: v1
+        kind: Secret
+        namespace: "{{ __aap_namespace }}"
+        name: "{{ __aap_platform_name }}-admin-password"
+      register: __aap_admin_secret
+      no_log: false
+
+    - name: Set AAP admin password fact
+      ansible.builtin.set_fact:
+        __aap_admin_password: "{{ __aap_admin_secret.resources[0].data.password | b64decode }}"
+      no_log: true
+
+  tasks:
+    - name: Configure Keycloak OIDC authenticator in AAP Gateway
+      ansible.builtin.include_role:
+        name: infra.aap_configuration.gateway_authenticators
+      vars:
+        aap_hostname: "{{ aap_gateway_url }}"
+        aap_username: "{{ aap_operator_admin_user | default('admin') }}"
+        aap_password: "{{ __aap_admin_password }}"
+        gateway_authenticators:
+          - name: Keycloak
+            type: ansible_base.authentication.authenticator_plugins.keycloak
+            slug: keycloak
+            enabled: true
+            configuration:
+              KEY: "{{ aap_oidc_client_id | default('aap') }}"
+              SECRET: "{{ vault_aap_oidc_client_secret }}"
+              PUBLIC_KEY: "{{ aap_oidc_public_key }}"
+              ACCESS_TOKEN_URL: "{{ aap_oidc_issuer }}/protocol/openid-connect/token"
+              AUTHORIZATION_URL: "{{ aap_oidc_issuer }}/protocol/openid-connect/auth"
+              GROUPS_CLAIM: "groups"
+            state: present

playbooks/deploy_openshift.yml

@@ -0,0 +1,364 @@
+---
+# Deploy and configure Single Node OpenShift (SNO) on Proxmox
+#
+# Prerequisites:
+#   ansible-galaxy collection install -r collections/requirements.yml
+#   openshift-install is downloaded automatically during the sno_deploy_install play
+#
+# Inventory requirements:
+#   sno.openshift.toal.ca  - in 'openshift' group
+#     host_vars: ocp_cluster_name, ocp_base_domain, ocp_version, sno_ip,
+#                sno_gateway, sno_nameserver, sno_prefix_length, sno_machine_network,
+#                sno_vm_name, sno_vnet, sno_storage_ip, sno_storage_ip_prefix_length,
+#                sno_storage_vnet, proxmox_node, keycloak_url, keycloak_realm,
+#                oidc_admin_groups, sno_deploy_letsencrypt_email, ...
+#     secrets:  vault_ocp_pull_secret, vault_keycloak_admin_password,
+#               vault_oidc_client_secret (optional)
+#     optional: ocp_kubeconfig (defaults to ~/.kube/config; set to
+#               sno_install_dir/auth/kubeconfig for fresh installs)
+#   proxmox_api            - inventory host (ansible_host, ansible_port)
+#   proxmox_host           - inventory host (ansible_host, ansible_connection: ssh)
+#   gate.toal.ca           - in 'opnsense' group
+#     host_vars: opnsense_host, opnsense_api_key, opnsense_api_secret,
+#                opnsense_api_port, haproxy_public_ip
+#   group_vars/all:        dme_account_key, dme_account_secret
+#
+# Play order (intentional — DNS must precede VM boot):
+#   Play 1: sno_deploy_vm       — Create SNO VM
+#   Play 2: opnsense            — Configure OPNsense local DNS overrides
+#   Play 3: dns                 — Configure public DNS records in DNS Made Easy
+#   Play 4: sno_deploy_install  — Generate ISO, boot VM, wait for install
+#   Play 5: keycloak            — Configure Keycloak OIDC client
+#   Play 6: sno_deploy_oidc / sno_deploy_certmanager / sno_deploy_delete_kubeadmin
+#   Play 7: sno_deploy_lvms            — Install LVM Storage for persistent volumes
+#   Play 8: sno_deploy_nfs             — Deploy in-cluster NFS provisioner (RWX StorageClass)
+#   Play 9: sno_deploy_service_accounts — Provision ServiceAccounts for app deployers
+#
+# AAP deployment is in a separate playbook: deploy_aap.yml
+#
+# Usage:
+#   ansible-navigator run playbooks/deploy_openshift.yml
+#   ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_vm
+#   ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_install
+#   ansible-navigator run playbooks/deploy_openshift.yml --tags opnsense,dns
+#   ansible-navigator run playbooks/deploy_openshift.yml --tags keycloak,sno_deploy_oidc
+#   ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_certmanager
+#   ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_lvms
+#   ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_nfs
+#   ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
+
+# ---------------------------------------------------------------------------
+# Play 1: Create SNO VM in Proxmox
+# ---------------------------------------------------------------------------
+- name: Create SNO VM in Proxmox
+  hosts: sno.openshift.toal.ca
+  gather_facts: false
+  connection: local
+  tags: sno_deploy_vm
+
+  tasks:
+    - name: Create VM
+      ansible.builtin.include_role:
+        name: sno_deploy
+        tasks_from: create_vm.yml
+
+# ---------------------------------------------------------------------------
+# Play 2: Configure OPNsense - Local DNS Overrides
+# Must run BEFORE booting the VM so that api.openshift.toal.ca resolves
+# from within the SNO node during bootstrap.
+# ---------------------------------------------------------------------------
+- name: Configure OPNsense DNS overrides for OpenShift
+  hosts: gate.toal.ca
+  gather_facts: false
+  connection: local
+
+  module_defaults:
+    group/oxlorg.opnsense.all:
+      firewall: "{{ opnsense_host }}"
+      api_key: "{{ opnsense_api_key }}"
+      api_secret: "{{ opnsense_api_secret }}"
+      ssl_verify: "{{ opnsense_ssl_verify | default(false) }}"
+      api_port: "{{ opnsense_api_port | default(omit) }}"
+
+  vars:
+    __deploy_ocp_cluster_name: "{{ hostvars['sno.openshift.toal.ca']['ocp_cluster_name'] }}"
+    __deploy_ocp_base_domain: "{{ hostvars['sno.openshift.toal.ca']['ocp_base_domain'] }}"
+    __deploy_sno_ip: "{{ hostvars['sno.openshift.toal.ca']['sno_ip'] }}"
+
+  tags: opnsense
+
+  roles:
+    - role: opnsense_dns_override
+      opnsense_dns_override_entries:
+        - hostname: "api.{{ __deploy_ocp_cluster_name }}"
+          domain: "{{ __deploy_ocp_base_domain }}"
+          value: "{{ __deploy_sno_ip }}"
+          type: host
+        - hostname: "api-int.{{ __deploy_ocp_cluster_name }}"
+          domain: "{{ __deploy_ocp_base_domain }}"
+          value: "{{ __deploy_sno_ip }}"
+          type: host
+        - domain: "apps.{{ __deploy_ocp_cluster_name }}.{{ __deploy_ocp_base_domain }}"
+          value: "{{ __deploy_sno_ip }}"
+          type: forward
+
+# ---------------------------------------------------------------------------
+# Play 3: Configure Public DNS Records in DNS Made Easy
+# ---------------------------------------------------------------------------
+- name: Configure public DNS records for OpenShift
+  hosts: sno.openshift.toal.ca
+  gather_facts: false
+  connection: local
+
+  vars:
+    __deploy_public_ip: "{{ hostvars['gate.toal.ca']['haproxy_public_ip'] }}"
+
+  tags: dns
+
+  roles:
+    - role: dnsmadeeasy_record
+      dnsmadeeasy_record_account_key: "{{ dme_account_key }}"
+      dnsmadeeasy_record_account_secret: "{{ dme_account_secret }}"
+      dnsmadeeasy_record_entries:
+        - domain: "{{ ocp_base_domain }}"
+          record_name: "api.{{ ocp_cluster_name }}"
+          record_type: A
+          record_value: "{{ __deploy_public_ip }}"
+          record_ttl: "{{ ocp_dns_ttl }}"
+        - domain: "{{ ocp_base_domain }}"
+          record_name: "*.apps.{{ ocp_cluster_name }}"
+          record_type: A
+          record_value: "{{ __deploy_public_ip }}"
+          record_ttl: "{{ ocp_dns_ttl }}"
+
+# ---------------------------------------------------------------------------
+# Play 4: Generate Agent ISO and Deploy SNO
+# ---------------------------------------------------------------------------
+- name: Generate Agent ISO and Deploy SNO
+  hosts: sno.openshift.toal.ca
+  gather_facts: false
+  connection: local
+  tags: sno_deploy_install
+
+  tasks:
+    - name: Install SNO
+      ansible.builtin.include_role:
+        name: sno_deploy
+        tasks_from: install.yml
+
+# ---------------------------------------------------------------------------
+# Play 5: Configure Keycloak OIDC client for OpenShift
+# ---------------------------------------------------------------------------
+- name: Configure Keycloak OIDC client for OpenShift
+  hosts: openshift
+  gather_facts: false
+  connection: local
+
+  tags: keycloak
+
+  vars:
+    keycloak_context: ""
+    oidc_client_id: openshift
+    oidc_redirect_uri: "https://oauth-openshift.apps.{{ ocp_cluster_name }}.{{ ocp_base_domain }}/oauth2callback/{{ oidc_provider_name }}"
+    __oidc_keycloak_api_url: "{{ keycloak_url }}{{ keycloak_context }}"
+
+  module_defaults:
+    middleware_automation.keycloak.keycloak_realm:
+      auth_client_id: admin-cli
+      auth_keycloak_url: "{{ __oidc_keycloak_api_url }}"
+      auth_realm: master
+      auth_username: "{{ keycloak_admin_user }}"
+      auth_password: "{{ vault_keycloak_admin_password }}"
+      validate_certs: "{{ keycloak_validate_certs | default(true) }}"
+    middleware_automation.keycloak.keycloak_client:
+      auth_client_id: admin-cli
+      auth_keycloak_url: "{{ __oidc_keycloak_api_url }}"
+      auth_realm: master
+      auth_username: "{{ keycloak_admin_user }}"
+      auth_password: "{{ vault_keycloak_admin_password }}"
+      validate_certs: "{{ keycloak_validate_certs | default(true) }}"
+
+  tasks:
+
+    - name: Set OIDC client secret (use vault value or generate random)
+      ansible.builtin.set_fact:
+        __oidc_client_secret: "{{ vault_oidc_client_secret | default(lookup('community.general.random_string', length=32, special=false)) }}"
+        __oidc_secret_generated: "{{ vault_oidc_client_secret is not defined }}"
+      no_log: true
+
+    - name: Ensure Keycloak realm exists
+      middleware_automation.keycloak.keycloak_realm:
+        realm: "{{ keycloak_realm }}"
+        id: "{{ keycloak_realm }}"
+        display_name: "{{ keycloak_realm_display_name | default(keycloak_realm | title) }}"
+        enabled: true
+        state: present
+      no_log: "{{ keycloak_no_log | default(true) }}"
+
+    - name: Create OpenShift OIDC client in Keycloak
+      middleware_automation.keycloak.keycloak_client:
+        realm: "{{ keycloak_realm }}"
+        client_id: "{{ oidc_client_id }}"
+        name: "OpenShift - {{ ocp_cluster_name }}"
+        description: "OIDC client for OpenShift cluster {{ ocp_cluster_name }}.{{ ocp_base_domain }}"
+        enabled: true
+        protocol: openid-connect
+        public_client: false
+        standard_flow_enabled: true
+        implicit_flow_enabled: false
+        direct_access_grants_enabled: false
+        service_accounts_enabled: false
+        secret: "{{ __oidc_client_secret }}"
+        redirect_uris:
+          - "{{ oidc_redirect_uri }}"
+        web_origins:
+          - "+"
+        protocol_mappers:
+          - name: groups
+            protocol: openid-connect
+            protocolMapper: oidc-group-membership-mapper
+            config:
+              full.path: "false"
+              id.token.claim: "true"
+              access.token.claim: "true"
+              userinfo.token.claim: "true"
+              claim.name: groups
+        state: present
+      no_log: "{{ keycloak_no_log | default(true) }}"
+
+    - name: Display generated client secret (save this to vault!)
+      ansible.builtin.debug:
+        msg:
+          - "*** GENERATED OIDC CLIENT SECRET — SAVE THIS TO VAULT ***"
+          - "vault_oidc_client_secret: {{ __oidc_client_secret }}"
+          - ""
+          - "Set this in host_vars or pass as --extra-vars on future runs."
+      when: __oidc_secret_generated | bool
+
+    - name: Display Keycloak configuration summary
+      ansible.builtin.debug:
+        msg:
+          - "Keycloak OIDC client configured:"
+          - "  Realm   : {{ keycloak_realm }}"
+          - "  Client  : {{ oidc_client_id }}"
+          - "  Issuer  : {{ keycloak_url }}{{ keycloak_context }}/realms/{{ keycloak_realm }}"
+          - "  Redirect: {{ oidc_redirect_uri }}"
+        verbosity: 1
+
+# ---------------------------------------------------------------------------
+# Play 6: Post-install OpenShift configuration
+# Configure OIDC OAuth, cert-manager, and delete kubeadmin
+# ---------------------------------------------------------------------------
+- name: Configure OpenShift post-install
+  hosts: sno.openshift.toal.ca
+  gather_facts: false
+  connection: local
+
+  environment:
+    KUBECONFIG: "{{ ocp_kubeconfig | default('~/.kube/config') }}"
+    K8S_AUTH_VERIFY_SSL: "false"
+
+  tags:
+    - sno_deploy_oidc
+    - sno_deploy_certmanager
+    - sno_deploy_delete_kubeadmin
+
+  tasks:
+    - name: Configure OpenShift OAuth with OIDC
+      ansible.builtin.include_role:
+        name: sno_deploy
+        tasks_from: configure_oidc.yml
+      tags: sno_deploy_oidc
+
+    - name: Configure cert-manager and LetsEncrypt certificates
+      ansible.builtin.include_role:
+        name: sno_deploy
+        tasks_from: configure_certmanager.yml
+      tags: sno_deploy_certmanager
+
+    - name: Delete kubeadmin user
+      ansible.builtin.include_role:
+        name: sno_deploy
+        tasks_from: delete_kubeadmin.yml
+      tags:
+        - never
+        - sno_deploy_delete_kubeadmin
+
+# ---------------------------------------------------------------------------
+# Play 7: Install LVM Storage for persistent volumes
+# ---------------------------------------------------------------------------
+- name: Configure LVM Storage for persistent volumes
+  hosts: sno.openshift.toal.ca
+  gather_facts: false
+  connection: local
+  tags: sno_deploy_lvms
+
+  environment:
+    KUBECONFIG: "{{ ocp_kubeconfig | default('~/.kube/config') }}"
+    K8S_AUTH_VERIFY_SSL: "false"
+
+  roles:
+    - role: lvms_operator
+
+# ---------------------------------------------------------------------------
+# Play 8: Deploy NFS provisioner for ReadWriteMany storage
+# Set nfs_provisioner_external_server / nfs_provisioner_external_path to use
+# a pre-existing NFS share (e.g. 192.168.129.100:/mnt/BIGPOOL/NoBackups/OCPNFS).
+# When those are unset, an in-cluster NFS server is deployed; LVMS (Play 7) must
+# have run first to provide the backing RWO PVC.
+# ---------------------------------------------------------------------------
+- name: Deploy in-cluster NFS provisioner
+  hosts: sno.openshift.toal.ca
+  gather_facts: false
+  connection: local
+  tags: sno_deploy_nfs
+
+  environment:
+    KUBECONFIG: "{{ ocp_kubeconfig | default('~/.kube/config') }}"
+    K8S_AUTH_VERIFY_SSL: "false"
+
+  roles:
+    - role: nfs_provisioner
+
+# ---------------------------------------------------------------------------
+# Play 9: Provision ServiceAccounts for application deployers
+# ---------------------------------------------------------------------------
+- name: Provision OpenShift service accounts
+  hosts: sno.openshift.toal.ca
+  gather_facts: false
+  connection: local
+
+  environment:
+    KUBECONFIG: "{{ ocp_kubeconfig | default('~/.kube/config') }}"
+    K8S_AUTH_VERIFY_SSL: "false"
+
+  tags:
+    - never
+    - sno_deploy_service_accounts
+
+  roles:
+    - role: ocp_service_account
+      ocp_service_account_name: aap-deployer
+      ocp_service_account_namespace: aap
+      ocp_service_account_cluster_role_rules:
+        - apiGroups: [""]
+          resources: ["namespaces"]
+          verbs: ["get", "list", "create", "patch"]
+        - apiGroups: [""]
+          resources: ["secrets"]
+          verbs: ["get", "list", "watch", "create", "patch"]
+        - apiGroups: [""]
+          resources: ["serviceaccounts"]
+          verbs: ["get", "list", "watch"]
+        - apiGroups: ["apps"]
+          resources: ["deployments"]
+          verbs: ["get", "list", "watch"]
+        - apiGroups: ["operators.coreos.com"]
+          resources: ["operatorgroups", "subscriptions", "clusterserviceversions"]
+          verbs: ["get", "list", "create", "patch", "watch"]
+        - apiGroups: ["apiextensions.k8s.io"]
+          resources: ["customresourcedefinitions"]
+          verbs: ["get", "list", "watch"]
+        - apiGroups: ["aap.ansible.com"]
+          resources: ["ansibleautomationplatforms"]
+          verbs: ["get", "list", "create", "patch", "watch"]

playbooks/opnsense.yml

@@ -0,0 +1,64 @@
+---
+- name: Configure DHCP
+  hosts: opnsense
+  gather_facts: false
+  module_defaults:
+    group/oxlorg.opnsense.all:
+      firewall: "{{ opnsense_host }}"
+      api_key: "{{ opnsense_api_key }}"
+      api_secret: "{{ opnsense_api_secret }}"
+      ssl_verify: false
+      api_port: "{{ opnsense_api_port|default(omit) }}"
+
+  tasks:
+    - name: Install packages
+      oxlorg.opnsense.package:
+        name:
+          - os-acme-client
+        action: install
+      delegate_to: localhost
+
+    - name: Setup ACME Client
+      ansible.builtin.include_role:
+        name: toallab.infra.opnsense_service
+        tasks_from: setup.yml
+
+    - name: Configure KEA DHCP Server
+      oxlorg.opnsense.dhcp_general:
+        enabled: "{{ dhcp_enabled }}"
+        interfaces: "{{ dhcp_interfaces }}"
+      delegate_to: localhost
+
+    - name: Add subnet
+      oxlorg.opnsense.dhcp_subnet:
+        subnet: "{{ item.subnet }}"
+        pools: "{{ item.pools }}"
+        auto_options: false
+        gateway: '{{ item.gateway }}'
+        dns: '{{ item.dns }}'
+        domain: '{{ item.domain }}'
+        reload: false
+      delegate_to: localhost
+      loop: "{{ dhcp_subnets }}"
+
+    - name: Get all dhcp_reservations_* variables from hostvars
+      ansible.builtin.set_fact:
+        all_dhcp_reservations: >-
+          {{
+            hostvars[inventory_hostname] | dict2items
+            | selectattr('key', 'match', '^dhcp_reservations_')
+            | map(attribute='value')
+            | flatten
+            | selectattr('type', 'match', 'static')
+          }}
+
+    - name: Add DHCP Reservations
+      oxlorg.opnsense.dhcp_reservation:
+        hostname: "{{ item.hostname }}"
+        mac: "{{ item.mac }}"
+        ip: "{{ item.address }}"
+        subnet: "{{ item.address | ansible.utils.ipsubnet(24) }}"
+        description: "{{ item.description | default('') }}"
+        reload: false
+      delegate_to: localhost
+      loop: "{{ all_dhcp_reservations }}"

playbooks/publish_cvs.yml

@@ -0,0 +1,16 @@
+---
+- name: Publish CVs
+  hosts: sat6.lab.toal.ca
+  connection: local
+
+  tasks:
+    - name: Publish Content View
+      redhat.satellite.content_view_version:
+        username: "{{ vault_sat6_user }}"
+        password: "{{ vault_sat6_pass }}"
+        server_url: "https://{{ inventory_hostname }}"
+        validate_certs: false
+        content_view: "RHEL8"
+        organization: "Toal.ca"
+        lifecycle_environments:
+        - Library

playbooks/satellite.yml

@@ -0,0 +1,310 @@
+# Playbook to install Satellite server on RHV
+
+#TODO: Fix Partitioning, as /var/lib/pulp doesn't get it's own partition now.
+
+- name: Preflight Setup
+  hosts: "{{ vm_name }}"
+  gather_facts: no
+  tasks:
+    - name: Obtain SSO token from username / password credentials
+      redhat.rhv.ovirt_auth:
+        url: "{{ ovirt_url }}"
+        username: "{{ ovirt_username }}"
+        password: "{{ ovirt_password }}"
+      delegate_to: localhost
+
+    - name: Add host to satellite group
+      add_host:
+        hostname: '{{ vm_name }}'
+        groups: satellite
+      changed_when: false
+
+    - name: Get VM Tags
+      ovirt.ovirt.ovirt_tag_info:
+        vm: "{{ vm_name }}"
+      register: vmtags_result
+      delegate_to: localhost
+      ignore_errors: true
+
+    - name: Add host to provisioned group
+      add_host:
+        hostname: '{{ vm_name }}'
+        groups: provisioned
+      when:
+        - vmtags_result.ovirt_tags is defined
+        - vmtags_result.ovirt_tags|length > 0
+        - "'provisioned' in vmtags_result.ovirt_tags|map(attribute='name')|list"
+
+- name: Build VM
+  hosts: "{{ vm_name }}:!provisioned"
+  gather_facts: no
+  tasks:
+    - name: ISO is uploaded to RHV
+      redhat.rhv.ovirt_disk:
+        name: "{{ rhel_iso_filename }}"
+        upload_image_path: "{{ rhel_iso_path }}/{{ rhel_iso_filename }}"
+        storage_domain: ssdvdo0
+        size: 5 GiB
+        wait: true
+        bootable: true
+        format: raw
+        content_type: iso
+      register: iso_disk
+      delegate_to: localhost
+
+    - name: Remove known_hosts entry
+      known_hosts:
+        name: "{{ item }}"
+        state: absent
+      loop:
+        - "{{ vm_name }}"
+        - "{{ ansible_host }}"
+      delegate_to: localhost
+
+    - name: Create VM disk
+      ovirt_disk:
+        name: "{{ vm_name }}_Disk0"
+        description: '{{ vm_name }} Primary Disk'
+        interface: 'virtio_scsi'
+        size: '{{ disk }}GiB'
+        state: attached
+        sparse: yes
+        wait: true
+        storage_domain: "ssdvdo0"
+      async: 300
+      poll: 15
+      delegate_to: localhost
+
+    - name: Create Satellite VM in RHV
+      ovirt_vm:
+        name: "{{ vm_name }}"
+        state: present
+        memory: "{{ memory}}GiB"
+        disks:
+          - name: "{{ vm_name }}_Disk0"
+            activate: yes
+            bootable: yes
+        cpu_cores: "{{ vcpus }}"
+        cluster: "{{ cluster }}"
+        operating_system: "rhel_7x64"
+        type: server
+        graphical_console:
+          protocol:
+            - vnc
+        boot_devices:
+          - hd
+      async: 300
+      poll: 15
+      register: vm_result
+      delegate_to: localhost
+
+    - name: Assign NIC
+      ovirt_nic:
+        interface: virtio
+        name: nic1
+        profile: ovirtmgmt
+        network: ovirtmgmt
+        state: plugged
+        vm: "{{ vm_name }}"
+      register: nic_result
+      delegate_to: localhost
+
+    - name: Create directory for initial boot files
+      tempfile:
+        state: directory
+      register: kstmpdir
+      delegate_to: localhost
+
+    - name: Extract ISO files
+      community.general.iso_extract:
+        image: "{{ rhel_iso_path }}/{{ rhel_iso_filename }}"
+        dest: "{{ kstmpdir.path }}"
+        files:
+          - isolinux/vmlinuz
+          - isolinux/initrd.img
+      delegate_to: localhost
+
+    - name: Generate Kickstart File
+      template:
+        src: templates/ks.cfg
+        dest: "/var/www/ks/{{ vm_name }}.cfg"
+      become: yes
+      delegate_to: webserver.mgmt.toal.ca
+
+    - name: Temporary Directory
+      file:
+        path: "/tmp/{{ vm_name }}"
+        state: directory
+        mode: 0755
+      delegate_to: "{{ vm_host }}"
+
+    - name: Transfer files to Hypervisor
+      copy:
+        src: "{{ hostvars[vm_name].kstmpdir.path }}/{{ item }}"
+        dest: "/tmp/{{ vm_name }}/{{ item }}"
+      loop:
+        - vmlinuz
+        - initrd.img
+      delegate_to: "{{ vm_host }}"
+
+# NOTE: This is not idempotent
+- name: First Boot
+  hosts: "{{ vm_name }}:!provisioned"
+  gather_facts: no
+
+  tasks:
+    - block:
+      - name: Start VM with first-boot parameters
+        ovirt_vm:
+          name: "{{ vm_name }}"
+          host: "{{ vm_host }}"
+          kernel_params_persist: false
+          cd_iso: "{{ iso_disk.id }}"
+          kernel_path: "/tmp/{{ vm_name }}/vmlinuz"
+          kernel_params: "ks=http://192.168.1.199/ks/{{ vm_name }}.cfg inst.stage2=hd:LABEL=RHEL-7.9\\x20Server.x86_64"
+          initrd_path: "/tmp/{{ vm_name }}/initrd.img"
+          state: running
+        delegate_to: localhost
+
+
+      - name: Wait for system to shut down after installation
+        ovirt_vm_info:
+          pattern: "name={{ vm_name }}"
+        register: vm_info
+        until: vm_info['ovirt_vms'][0]['status'] == "down"
+        delay: 20
+        retries: 60
+        delegate_to: localhost
+
+      when: hostvars[vm_name].vm_result.vm.status != 'up'
+
+    - name: Power up VM
+      ovirt_vm:
+        name: "{{ vm_name }}"
+        state: running
+      delegate_to: localhost
+
+    - name: VM is running
+      ovirt_vm:
+          name: "{{ vm_name }}"
+          state: running
+          boot_devices:
+          - hd
+      delegate_to: localhost
+
+    - name: Set provisioned tag
+      ovirt_tag:
+        name: provisioned
+        vms:
+          - "{{ vm_name }}"
+        state: present
+      delegate_to: localhost
+
+- name: OS Preparation
+  hosts: "{{ vm_name }}"
+  gather_facts: no
+
+  tasks: 
+    - name: Set authentication for bootstrap
+      no_log: True
+      set_fact:
+        ansible_ssh_user: "root"
+        ansible_ssh_pass: "{{ initial_root_pass }}"
+
+    - name: Wait for SSH to be ready
+      wait_for_connection:
+        timeout: 1800
+        sleep: 5
+
+    - name: Register System to Red Hat
+      redhat_subscription:
+        state: present
+        username: "{{ rhn_username }}"
+        password: "{{ rhn_password }}"
+        # TODO This shouldn't be hard-coded
+        pool_ids: 8a85f99c727637ad0172e1ba2856736d
+
+    - name: Firewall
+      firewalld:
+        port: "{{ item }}"
+        state: enabled
+        permanent: yes
+      loop:
+        - "80/tcp"
+        - "81/tcp"
+        - "443/tcp"
+        - "5647/tcp"
+        - "8000/tcp"
+        - "8140/tcp"
+        - "9090/tcp"
+        - "53/udp"
+        - "53/tcp"
+        - "67/udp"
+        - "69/udp"
+        - "5000/tcp"
+      notify: Reload Firewall
+
+  handlers:
+    - name: Reload Firewall
+      service:
+        name: firewalld
+        state: reloaded
+
+- name: Set up IPA Client
+  hosts: "{{ vm_name }}"
+  become: yes
+  vars:
+    ipaclient_realm: IDM.TOAL.CA
+    ipaclient_mkhomedir: true
+    ipaclient_domain: "mgmt.toal.ca"
+    ipaclient_ssh_trust_dns: yes
+    ipaclient_all_ip_addresses: yes
+
+  collections:
+    - freeipa.ansible_freeipa
+  pre_tasks:
+    - name: Hostname is set
+      hostname:
+        name: "{{ vm_name }}"
+  roles:
+    - role: ipaclient
+      state: present
+
+#TODO Automatically set up DNS GSSAPI per:  https://access.redhat.com/documentation/en-us/red_hat_satellite/6.8/html/installing_satellite_server_from_a_connected_network/configuring-external-services#configuring-external-idm-dns_satellite
+
+- name: Install Satellite Servers
+  hosts: "{{ vm_name }}"
+  become: true
+
+  roles:
+    - role: jjaswanson4.install_satellite.install_satellite
+
+- name: Configure Satellite Servers
+  hosts: "{{ vm_name }}"
+  collections:
+    - jjaswanson4.configure_satellite
+
+  tasks:
+    - name: include configure_foreman role with katello independent pieces
+      include_role:
+        name: configure_satellite_foreman
+    - name: build satellite by organization
+      include_role:
+        name: configure_satellite_katello
+      loop_control:
+        loop_var: organization
+      loop: "{{ satellite.katello }}"
+    - name: do that again but for katello dependent pieces
+      include_role:
+        name: configure_satellite_foreman
+      vars:
+        requires_katello_content: true
+
+# - name: Customize Satellite Installation
+#   hosts: "{{ vm_name }}"
+
+#   collections:
+#     - freeipa.ansible_freeipa
+
+#   tasks:
+#     - name:

playbooks/site.yml

@@ -0,0 +1,63 @@
+# Toal Lab Site Playbook
+- name: Common Lab Machine Setup
+  hosts: platform_linux,platform_fedora_linux
+  become: true
+  roles:
+
+   - name: linux-system-roles.network
+     when: network_connections is defined
+
+- name: Set Network OS from Netbox info.
+  gather_facts: no
+  hosts: switch01
+  tasks:
+    - name: Set network os type for Cisco
+      set_fact: ansible_network_os="ios"
+      when: "'Cisco IOS' in platforms"
+
+- name: Configure infrastructure
+  hosts: switch01
+  become_method: enable
+  connection: network_cli
+  gather_facts: no
+
+  roles:
+    - toallab.infrastructure
+
+- name: DHCP Server
+  hosts: service_dhcp
+  become: yes
+
+  pre_tasks:
+    # - name: Gather interfaces for dhcp service
+    #   set_fact:
+    #     dhcp_interfaces:
+    # - name: Gather subnets
+    #   set_fact:
+    #     subnets: ""
+    #     prefixes: "{{ query('netbox.netbox.nb_lookup', 'prefixes', api_endpoint=netbox_api, token=netbox_token) }}"
+
+    # - ip: 192.168.222.0
+    #   netmask: 255.255.255.128
+    #   domain_name_servers:
+    #     - 10.0.2.3
+    #     - 10.0.2.4
+    #   range_begin: 192.168.222.50
+    #   range_end: 192.168.222.127
+    # - ip: 192.168.222.128
+    #   default_lease_time: 3600
+    #   max_lease_time: 7200
+    #   netmask: 255.255.255.128
+    #   domain_name_servers: 10.0.2.3
+    #   routers: 192.168.222.129
+  roles:
+    - name: sage905.netbox-to-dhcp
+
+- name: Include Minecraft tasks
+  import_playbook: minecraft.yml
+
+# - name: Include Gitea tasks
+#   import_playbook: gitea.yml
+
+# - name: Include Pod Host
+#   include: podhost.yml

playbooks/switch_config.yml

@@ -0,0 +1,23 @@
+---
+- name: Collect Netbox Data
+  hosts: role_core-switch
+  gather_facts: false
+  vars:
+    api_endpoint: "{{ lookup('env','NETBOX_API') }}"
+    api_token: "{{ lookup('env', 'NETBOX_TOKEN') }}"
+
+  tasks:
+  # - name: Gather Device Information
+  #   set_fact:
+  #     device_info: "{{ query('netbox.netbox.nb_lookup', 'devices', api_filter='name=' + inventory_hostname, api_endpoint=api_endpoint,\
+  #     token=api_token )[0] }}"
+    - name: Dump debug info
+      ansible.builtin.debug:
+        var: interfaces
+
+  # - name: Obtain list of devices from Netbox
+  #   debug:
+  #     var: >
+  #       "Device {{ item.value.display_name }} (ID: {{ item.key }}) was
+  #        manufactured by {{ item.value.device_type.manufacturer.name }}"
+  #   loop: "{{ query('netbox.netbox.nb_lookup', 'devices', api_endpoint=api_endpoint, token=api_token ) }}"

playbooks/test.yml

@@ -0,0 +1,15 @@
+---
+- name: Create 1Password Secret
+  hosts: localhost
+  tasks:
+    - onepassword.connect.generic_item:
+        vault_id: "e63n3krpqx7qpohuvlyqpn6m34"
+        title: Lab Secrets Test
+        state: created
+        fields:
+          - label: Codeword
+            value: "hunter2"
+            section: "Personal Info"
+            field_type: concealed
+      # no_log: true
+      register: op_item

playbooks/windows_ad.yml

@@ -0,0 +1,16 @@
+- name: Create Windows AD Server
+  hosts: WinAD
+  gather_facts: false
+  connection: local
+  become: false
+
+  vars:
+    ansible_python_interpreter: "{{ ansible_playbook_python }}"
+
+  roles:
+    - oatakan.ansible-role-ovirt
+
+- name: Configure AD Controller
+  hosts: WinAD
+  become: false
+    - oatakan.ansible-role-windows-ad-controller

rhv_setup.yml

@@ -1,21 +0,0 @@
----
-- name: Create RHV/ovirt VLANs
-  hosts: rhv.lab.toal.ca
-  connection: local
-  vars:
-    # Hack to work around virtualenv python interpreter
-    ansible_python_interpreter: "{{ ansible_playbook_python }}"
-  tasks:
-    - ovirt_network:
-        auth: "{{ ovirt_auth }}"
-        fetch_nested: true
-        data_center: "{{ item.data_center }}"
-        name: "{{ item.name }}"
-        vlan_tag: "{{ item.vlan_tag }}"
-        vm_network: "{{ item.vm_network }}"
-        mtu: "{{ item.mtu }}"
-        description: "{{ item.description }}"
-      loop: "{{ ovirt_networks }}"
-      register: networkinfo
-
-    - debug: msg="{{networkinfo}}"

roles/aap_operator/defaults/main.yml

@@ -0,0 +1,29 @@
+---
+# --- OLM subscription ---
+aap_operator_namespace: aap
+aap_operator_channel: "stable-2.6"
+aap_operator_source: redhat-operators
+aap_operator_name: ansible-automation-platform-operator
+aap_operator_wait_timeout: 1800
+
+# --- AnsibleAutomationPlatform CR ---
+aap_operator_platform_name: aap
+
+# --- Components (set disabled: true to skip) ---
+aap_operator_controller_disabled: false
+aap_operator_hub_disabled: false
+aap_operator_eda_disabled: false
+
+# --- Storage ---
+# RWO StorageClass for PostgreSQL (all components)
+aap_operator_storage_class: lvms-vg-data
+# RWX StorageClass for Hub file/artifact storage
+aap_operator_hub_file_storage_class: nfs-client
+aap_operator_hub_file_storage_size: 10Gi
+
+# --- Admin ---
+aap_operator_admin_user: admin
+
+# --- Routing (optional) ---
+# Set to a custom hostname to override the auto-generated Controller route
+# aap_operator_controller_route_host: aap.example.com

roles/aap_operator/meta/argument_specs.yml

@@ -0,0 +1,67 @@
+---
+argument_specs:
+  main:
+    short_description: Install AAP via OpenShift OLM operator (AnsibleAutomationPlatform CR)
+    description:
+      - Installs the Ansible Automation Platform operator via OLM and creates a
+        single AnsibleAutomationPlatform CR that manages Controller, Hub, and EDA.
+    options:
+      aap_operator_namespace:
+        description: Namespace for the AAP operator and platform instance.
+        type: str
+        default: aap
+      aap_operator_channel:
+        description: OLM subscription channel.
+        type: str
+        default: "stable-2.6"
+      aap_operator_source:
+        description: OLM catalog source name.
+        type: str
+        default: redhat-operators
+      aap_operator_name:
+        description: Operator package name in the catalog.
+        type: str
+        default: ansible-automation-platform-operator
+      aap_operator_wait_timeout:
+        description: Seconds to wait for operator and platform to become ready.
+        type: int
+        default: 1800
+      aap_operator_platform_name:
+        description: Name of the AnsibleAutomationPlatform CR.
+        type: str
+        default: aap
+      aap_operator_controller_disabled:
+        description: Set true to skip deploying Automation Controller.
+        type: bool
+        default: false
+      aap_operator_hub_disabled:
+        description: Set true to skip deploying Automation Hub.
+        type: bool
+        default: false
+      aap_operator_eda_disabled:
+        description: Set true to skip deploying Event-Driven Ansible.
+        type: bool
+        default: false
+      aap_operator_storage_class:
+        description: StorageClass for PostgreSQL persistent volumes (RWO).
+        type: str
+        default: lvms-vg-data
+      aap_operator_hub_file_storage_class:
+        description: StorageClass for Hub file/artifact storage (RWX).
+        type: str
+        default: nfs-client
+      aap_operator_hub_file_storage_size:
+        description: Size of the Hub file storage PVC.
+        type: str
+        default: 10Gi
+      aap_operator_admin_user:
+        description: Admin username for the platform.
+        type: str
+        default: admin
+      aap_operator_controller_route_host:
+        description: >
+          Custom hostname for the Automation Controller Route.
+          When set, overrides the auto-generated route hostname (e.g. aap.example.com).
+          Leave unset to use the default apps subdomain route.
+        type: str
+        required: false

roles/aap_operator/meta/main.yml

@@ -0,0 +1,18 @@
+---
+galaxy_info:
+  author: ptoal
+  description: Install Ansible Automation Platform via OpenShift OLM operator
+  license: MIT
+  min_ansible_version: "2.16"
+  platforms:
+    - name: GenericLinux
+      versions:
+        - all
+  galaxy_tags:
+    - openshift
+    - aap
+    - operator
+    - olm
+    - ansible
+
+dependencies: []

roles/aap_operator/tasks/configure_oidc.yml

@@ -0,0 +1,4 @@
+---
+# OIDC is configured via the AAP Gateway API, not via this role.
+# See: playbooks/deploy_aap.yml --tags aap_configure_keycloak,aap_configure_oidc
+# Uses: infra.aap_configuration.gateway_authenticators

roles/aap_operator/tasks/main.yml

@@ -0,0 +1,166 @@
+---
+# Install Ansible Automation Platform via OpenShift OLM operator.
+#
+# Deploys the AAP operator, then creates a single AnsibleAutomationPlatform
+# CR that manages Controller, Hub, and EDA as a unified platform.
+# All tasks are idempotent (kubernetes.core.k8s state: present).
+
+# ------------------------------------------------------------------
+# Step 1: Install AAP operator via OLM
+# ------------------------------------------------------------------
+- name: Create AAP namespace
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: "{{ aap_operator_namespace }}"
+
+- name: Read global pull secret
+  kubernetes.core.k8s_info:
+    api_version: v1
+    kind: Secret
+    namespace: openshift-config
+    name: pull-secret
+  register: __aap_operator_global_pull_secret
+
+- name: Copy pull secret to AAP namespace
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: redhat-operators-pull-secret
+        namespace: "{{ aap_operator_namespace }}"
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ __aap_operator_global_pull_secret.resources[0].data['.dockerconfigjson'] }}"
+  no_log: false
+
+- name: Create OperatorGroup for AAP
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: operators.coreos.com/v1
+      kind: OperatorGroup
+      metadata:
+        name: "{{ aap_operator_name }}"
+        namespace: "{{ aap_operator_namespace }}"
+      spec:
+        targetNamespaces:
+          - "{{ aap_operator_namespace }}"
+        upgradeStrategy: Default
+
+- name: Subscribe to AAP operator
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: operators.coreos.com/v1alpha1
+      kind: Subscription
+      metadata:
+        name: "{{ aap_operator_name }}"
+        namespace: "{{ aap_operator_namespace }}"
+      spec:
+        channel: "{{ aap_operator_channel }}"
+        installPlanApproval: Automatic
+        name: "{{ aap_operator_name }}"
+        source: "{{ aap_operator_source }}"
+        sourceNamespace: openshift-marketplace
+
+# ------------------------------------------------------------------
+# Step 2: Wait for operator to be ready
+# ------------------------------------------------------------------
+- name: Wait for AnsibleAutomationPlatform CRD to be available
+  kubernetes.core.k8s_info:
+    api_version: apiextensions.k8s.io/v1
+    kind: CustomResourceDefinition
+    name: ansibleautomationplatforms.aap.ansible.com
+  register: __aap_operator_crd
+  until: __aap_operator_crd.resources | length > 0
+  retries: "{{ __aap_operator_wait_retries }}"
+  delay: 10
+
+- name: Wait for AAP operator deployments to be ready
+  kubernetes.core.k8s_info:
+    api_version: apps/v1
+    kind: Deployment
+    namespace: "{{ aap_operator_namespace }}"
+    label_selectors:
+      - "operators.coreos.com/{{ aap_operator_name }}.{{ aap_operator_namespace }}"
+  register: __aap_operator_deploy
+  until: >-
+    __aap_operator_deploy.resources | length > 0 and
+    (__aap_operator_deploy.resources
+     | rejectattr('status.readyReplicas', 'undefined')
+     | selectattr('status.readyReplicas', '>=', 1)
+     | list | length) == (__aap_operator_deploy.resources | length)
+  retries: "{{ __aap_operator_wait_retries }}"
+  delay: 10
+
+# ------------------------------------------------------------------
+# Step 3: Deploy the unified AnsibleAutomationPlatform
+# ------------------------------------------------------------------
+- name: Create AnsibleAutomationPlatform
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: aap.ansible.com/v1alpha1
+      kind: AnsibleAutomationPlatform
+      metadata:
+        name: "{{ aap_operator_platform_name }}"
+        namespace: "{{ aap_operator_namespace }}"
+      spec:
+        admin_user: "{{ aap_operator_admin_user }}"
+        # PostgreSQL storage for all components (RWO)
+        database:
+          postgres_storage_class: "{{ aap_operator_storage_class }}"
+        # Component toggles and per-component config
+        controller:
+          disabled: "{{ aap_operator_controller_disabled | bool }}"
+          route_host: "{{ aap_operator_controller_route_host | default(omit) }}"
+        hub:
+          disabled: "{{ aap_operator_hub_disabled | bool }}"
+          # Hub file/artifact storage (RWX) — must be under hub:
+          storage_type: file
+          file_storage_storage_class: "{{ aap_operator_hub_file_storage_class }}"
+          file_storage_size: "{{ aap_operator_hub_file_storage_size }}"
+        eda:
+          disabled: "{{ aap_operator_eda_disabled | bool }}"
+
+# ------------------------------------------------------------------
+# Step 4: Wait for platform to be ready
+# ------------------------------------------------------------------
+- name: Wait for AnsibleAutomationPlatform to be ready
+  kubernetes.core.k8s_info:
+    api_version: aap.ansible.com/v1alpha1
+    kind: AnsibleAutomationPlatform
+    namespace: "{{ aap_operator_namespace }}"
+    name: "{{ aap_operator_platform_name }}"
+  register: __aap_operator_platform_status
+  ignore_errors: true
+  until: >-
+    __aap_operator_platform_status.resources is defined and
+    __aap_operator_platform_status.resources | length > 0 and
+    (__aap_operator_platform_status.resources[0].status.conditions | default([])
+     | selectattr('type', '==', 'Running')
+     | selectattr('status', '==', 'True') | list | length > 0)
+  retries: "{{ __aap_operator_wait_retries }}"
+  delay: 10
+
+# ------------------------------------------------------------------
+# Step 5: Display summary
+# ------------------------------------------------------------------
+- name: Display AAP deployment summary
+  ansible.builtin.debug:
+    msg:
+      - "Ansible Automation Platform deployment complete!"
+      - "  Namespace  : {{ aap_operator_namespace }}"
+      - "  Platform CR: {{ aap_operator_platform_name }}"
+      - "  Controller : {{ 'disabled' if aap_operator_controller_disabled else 'enabled' }}"
+      - "  Hub        : {{ 'disabled' if aap_operator_hub_disabled else 'enabled' }}"
+      - "  EDA        : {{ 'disabled' if aap_operator_eda_disabled else 'enabled' }}"
+      - ""
+      - "Admin password secret: {{ aap_operator_platform_name }}-admin-password"
+      - "Retrieve with: oc get secret {{ aap_operator_platform_name }}-admin-password -n {{ aap_operator_namespace }} -o jsonpath='{.data.password}' | base64 -d"

roles/aap_operator/vars/main.yml

@@ -0,0 +1,3 @@
+---
+# Computed internal variables - do not override
+__aap_operator_wait_retries: "{{ (aap_operator_wait_timeout / 10) | int }}"

roles/alvaroaleman.freeipa-client/.gitignore

@@ -1,27 +0,0 @@
-### Files to be ignored by Git ###
-
-# Ruby
-Gemfile.lock
-
-# Vagrant
-/\.vagrant/
-
-# IntelliJ IDEA
-/*\.ipr
-/*\.iws
-/\.idea/
-**/*\.iml
-
-# Eclipse
-/\.classpath
-/\.project
-/\.settings/
-
-# Mac
-**/\.DS_Store
-
-# Custom
-/temp/
-/tmp/
-envvars
-*.swp

roles/alvaroaleman.freeipa-client/.travis.yml

@@ -1,12 +0,0 @@
----
-language: python
-python: "2.7"
-before_install:
-  - sudo apt-get update --assume-yes -qq
-  - sudo apt-get install --assume-yes -qq python-apt python-pycurl
-install:
-  - sudo pip install ansible
-script:
-  - ansible --version
-  - ansible-playbook --inventory-file tests/hosts --syntax-check tests/playbook.yml
-  - ansible-playbook --inventory-file tests/hosts --connection=local -vvvv tests/playbook.yml

roles/alvaroaleman.freeipa-client/CHANGELOG.md

@@ -1,85 +0,0 @@
-Remo Wenger (2):
-
-* Add support for RHEL
-* Add RHEL to Requirements
-
-# 1.3.1
-
-fxfitz (2):
-
-* Remove always_run
-* Use recommended change
-
-# 1.3.0
-
-Alvaro Aleman (10):
-
-* Use complex args style
-* More style
-* Fix defaults for Trusty
-* Fix variable namespace for package var
-* Update supported distros
-* Update sample playbook
-* Set test variables in playbook instead of Vagrantfile
-* Add assertion for required variables
-* Update role name in README
-* Add xenial to supported distros
-
-Tomas Dobrovolny (4):
-
-* Make DNS updates optional
-* Correct syntax using variable packages in with_items
-* Run Ubuntu specific tasks for all Debians
-* Add Ubuntu-16 to supported distributions
-
-# 1.2.0
-
-Alvaro Aleman (3):
-
-* Fix changelog ordering
-* Allow to register all routable client ips on DNS
-* Dont replace all DNS servers
-
-# 1.1.0
-
-Alvaro Aleman (14):
-
-* Move variables to role-specific namespace
-* Add consistent role tag
-* Refactor supported_distribution check for readability
-* Add Makefile to make testing easier
-* Make Vagrant not set DNS server by default
-* Use public ipa server for testing
-* Fix dependencies
-* Add no_ntp parameter
-* Add force_join parameter
-* Make hostname parameter optional
-* Fix checkmode
-* Remove obsolete serverspec testing
-* Refactor join for readability
-* Add contribution guidelines
-
-Casey Labs (2):
-
-* Update Ubuntu tasks
-* Adding SSH restart to handlers
-
-# 1.0.0
-
-Alvaro Aleman (8):
-
-* Populate galaxy info
-* Update documentation
-* Disable unused Docker testing
-* Fix naming
-* Fix Vagrant testing
-* Add *.swp files to gitignore
-* Update testing mechanism
-* init
-
-# 0.0.1
-
-* Initial commit
-
-
-<!-- vim: set nofen ts=4 sw=4 et: -->

roles/alvaroaleman.freeipa-client/LICENSE

@@ -1,662 +0,0 @@
-                    GNU AFFERO GENERAL PUBLIC LICENSE
-                       Version 3, 19 November 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU Affero General Public License is a free, copyleft license for
-software and other kinds of works, specifically designed to ensure
-cooperation with the community in the case of network server software.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-our General Public Licenses are intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  Developers that use our General Public Licenses protect your rights
-with two steps: (1) assert copyright on the software, and (2) offer
-you this License which gives you legal permission to copy, distribute
-and/or modify the software.
-
-  A secondary benefit of defending all users' freedom is that
-improvements made in alternate versions of the program, if they
-receive widespread use, become available for other developers to
-incorporate.  Many developers of free software are heartened and
-encouraged by the resulting cooperation.  However, in the case of
-software used on network servers, this result may fail to come about.
-The GNU General Public License permits making a modified version and
-letting the public access it on a server without ever releasing its
-source code to the public.
-
-  The GNU Affero General Public License is designed specifically to
-ensure that, in such cases, the modified source code becomes available
-to the community.  It requires the operator of a network server to
-provide the source code of the modified version running there to the
-users of that server.  Therefore, public use of a modified version, on
-a publicly accessible server, gives the public access to the source
-code of the modified version.
-
-  An older license, called the Affero General Public License and
-published by Affero, was designed to accomplish similar goals.  This is
-a different license, not a version of the Affero GPL, but Affero has
-released a new version of the Affero GPL which permits relicensing under
-this license.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU Affero General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Remote Network Interaction; Use with the GNU General Public License.
-
-  Notwithstanding any other provision of this License, if you modify the
-Program, your modified version must prominently offer all users
-interacting with it remotely through a computer network (if your version
-supports such interaction) an opportunity to receive the Corresponding
-Source of your version by providing access to the Corresponding Source
-from a network server at no charge, through some standard or customary
-means of facilitating copying of software.  This Corresponding Source
-shall include the Corresponding Source for any work covered by version 3
-of the GNU General Public License that is incorporated pursuant to the
-following paragraph.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the work with which it is combined will remain governed by version
-3 of the GNU General Public License.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU Affero General Public License from time to time.  Such new versions
-will be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU Affero General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU Affero General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU Affero General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU Affero General Public License as published
-    by the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU Affero General Public License for more details.
-
-    You should have received a copy of the GNU Affero General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If your software can interact with users remotely through a computer
-network, you should also make sure that it provides a way for users to
-get its source.  For example, if your program is a web application, its
-interface could display a "Source" link that leads users to an archive
-of the code.  There are many ways you could offer source, and different
-solutions will be better for different programs; see section 13 for the
-specific requirements.
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU AGPL, see
-<http://www.gnu.org/licenses/>.
-

roles/alvaroaleman.freeipa-client/Makefile

@@ -1,26 +0,0 @@
-LOGFILE = /tmp/ansible-freeipaclient-logfile
-
-default: test
-
-clean:
-	- vagrant destroy -f
-
-box: clean
-	# Start vagrant box
-	vagrant up --no-provision --provider $(ANSIBLE_FREEIPACLIENT_VAGRANT_PROVIDER)
-
-checkmode:
-	# Test checkmode
-	ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_CHECKMODE=1 vagrant provision
-
-provision:
-	# Test role
-	vagrant provision
-
-idempotence:
-	# Idempotence test
-	vagrant provision | tee $(LOGFILE) | grep 'changed=0.*failed=0' || (cat $(LOGFILE) && false)
-
-
-test: box checkmode provision idempotence
-	make checkmode

roles/alvaroaleman.freeipa-client/README.md

@@ -1,71 +0,0 @@
-# ansible-freeipa-client
-
-## Synopsis
-
-```yaml
-- hosts: all
-  vars:
-    freeipaclient_server: ipa.demo1.freeipa.org
-    freeipaclient_domain: ipa.demo1.freeipa.org
-    freeipaclient_enroll_user: admin
-    freeipaclient_enroll_pass: Secret123
-  roles:
-     - alvaroaleman.freeipa-client
-```
-
-## Description
-
-This role allows to join clients to an ipa domain
-
-## Requirements
-
-* CentOS 7
-* Red Hat Enterprise Linux 7
-* Fedora 24
-* Ubuntu Trusty
-* Ubuntu Xenial
-* Ubuntu Bionic
-
-## Role Variables
-
-* ``freeipaclient_server``: IP/Hostname of IPA server to use (string, mandatory)
-* ``freeipaclient_domain``: Domain to use (string, mandatory)
-* ``freeipaclient_enroll_user``: Username to enroll host in domain (string, mandatory)
-* ``freeipaclient_enroll_pass``: Password to enroll host in domain (string, mandatory)
-* ``freeipaclient_hostname``: The hostname to use for the client (string, default: output of ``uname -n``)
-* ``freeipaclient_dns_server``: DNS server to configure. This will not do anything if variable is empty (string)
-* ``freeipaclient_force_join``: Whether to overwrite an already existing host entry of requested name (boolean, default: ``false``)
-* ``freeipaclient_enable_ntp``: Whether to enable ntp. Kerberos won't work if the time of master and client drift too much (boolean, default: ``true``)
-* ``freeipaclient_all_ip_addresses``: Whether to add all routable ip addresses to DNS (boolean, default: ``true if not Trusty, else false``)
-
-
-## License
-
-GNU AFFERO GENERAL PUBLIC LICENSE Version 3
-
-## Contributing
-
-If you want to contribute to this repository please be aware that this
-project uses a [gitflow](http://nvie.com/posts/a-successful-git-branching-model/)
-workflow with the next release branch called ``next``.
-
-Please fork this repository and create a local branch split off of the ``next``
-branch and create pull requests back to the origin ``next`` branch.
-
-## Integration testing
-
-This role provides integration tests using Vagrant:
-
-```bash
-cp envvars-vagrant.sample envvars
-EDITOR=vim
-$EDITOR envvars
-source envvars
-make test
-```
-
-## Author information
-
-Alvaro Aleman
-
-<!-- vim: set nofen ts=4 sw=4 et: -->

roles/alvaroaleman.freeipa-client/VERSION

@@ -1 +0,0 @@
-1.3.4

roles/alvaroaleman.freeipa-client/Vagrantfile

@@ -1,56 +0,0 @@
-# vim: set ft=ruby ts=2 sw=2 et:
-# -*- mode: ruby -*-
-
-
-VAGRANT_API_VERSION = '2'
-Vagrant.configure(VAGRANT_API_VERSION) do |config|
-
-  if ENV['ANSIBLE_FREEIPACLIENT_VAGRANT_BOXNAME']
-    config.vm.box = ENV['ANSIBLE_FREEIPACLIENT_VAGRANT_BOXNAME']
-  else
-    config.vm.box = 'ubuntu/trusty64'
-  end
-
-  config.vm.define :ansiblefreeipaclienttest do |d|
-
-    d.vm.hostname = 'ansiblefreeipaclienttest'
-    d.vm.synced_folder '.', '/vagrant', id: 'vagrant-root', disabled: true
-
-    d.vm.provision :ansible do |ansible|
-      ansible.playbook = 'tests/playbook.yml'
-      ansible.tags = ENV['ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_TAGS']
-      ansible.skip_tags = ENV['ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_SKIP_TAGS']
-      ansible.verbose = ENV['ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_VERBOSE']
-      if ENV['ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_CHECKMODE'] == '1'
-        ansible.raw_arguments = '--check'
-      end
-      ansible.groups = {
-        'vagrant' => ['ansiblefreeipaclienttest']
-      }
-      ansible.limit = 'vagrant'
-      ansible.raw_arguments = [
-        '--diff'
-      ]
-      if ENV['ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_CHECKMODE'] == '1'
-        ansible.raw_arguments << '--check'
-      end
-
-      ::File.directory?('.vagrant/provisioners/ansible/inventory/') do
-        ansible.inventory_path = '.vagrant/provisioners/ansible/inventory/'
-      end
-
-    end
-
-    d.vm.provider :virtualbox do |v|
-      v.customize 'pre-boot', ['modifyvm', :id, '--nictype1', 'virtio']
-      v.customize [ 'modifyvm', :id, '--name', 'ansiblefreeipaclienttest', '--memory', '512', '--cpus', '1' ]
-    end
-
-    d.vm.provider :libvirt do |lv|
-      lv.memory = 1024
-      lv.cpus = 2
-    end
-
-
-  end
-end

roles/alvaroaleman.freeipa-client/ansible.cfg

@@ -1,4 +0,0 @@
-[defaults]
-roles_path = ../
-nocows = 1
-retry_files_enabled = False

roles/alvaroaleman.freeipa-client/defaults/main.yml

@@ -1,6 +0,0 @@
----
-# defaults file for ansible-freeipa-client
-freeipaclient_force_join: false
-freeipaclient_enable_ntp: true
-freeipaclient_all_ip_addresses: "{{ true if ansible_distribution_release != 'trusty' else false }}"
-freeipaclient_enable_dns_updates: true

roles/alvaroaleman.freeipa-client/envvars-vagrant.sample

@@ -1,9 +0,0 @@
-# General settings for Vagrant
-export ANSIBLE_FREEIPACLIENT_VAGRANT_BOXNAME=centos/7 # name of the vagrant box to use for testing
-export ANSIBLE_FREEIPACLIENT_VAGRANT_PROVIDER=virtualbox     # name of the vagrant provider to use for testing
-#export ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_TAGS=          # Multiple tags can be specified comma seperated
-unset ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_TAGS             # An empty tags variable leads to an error
-#export ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_SKIP_TAGS=     # Multiple tags can be specified comma seperated
-unset ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_SKIP_TAGS        # An empty skip_tags variable leads to an error
-export ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_VERBOSE=        # May contain one to four 'v's
-export ANSIBLE_FREEIPACLIENT_VAGRANT_ANSIBLE_CHECKMODE=      # 1 to enable, any other value to disable

roles/alvaroaleman.freeipa-client/handlers/main.yml

@@ -1,20 +0,0 @@
----
-# handlers file for ansible-freeipa-client
-#
-- name: restart sssd
-  tags:
-    - sssd
-    - freeipaclient
-  become: true
-  service:
-    name=sssd
-    state=restarted
-
-- name: restart ssh
-  tags:
-    - sssd
-    - freeipaclient
-  become: true
-  service:
-    name=ssh
-    state=restarted

roles/alvaroaleman.freeipa-client/meta/.galaxy_install_info

@@ -1 +0,0 @@
-{install_date: 'Tue Nov 20 16:00:28 2018', version: 1.3.4}

roles/alvaroaleman.freeipa-client/meta/main.yml

@@ -1,23 +0,0 @@
----
-galaxy_info:
-  author: Alvaro Aleman
-  description: A role to join clients to an IPA domain
-  license: AGPLv3
-  min_ansible_version: 2.1
-  platforms:
-  - name: EL
-    versions:
-    - 7
-  - name: Fedora
-    versions:
-    - 24
-  - name: Ubuntu
-    versions:
-    - trusty
-    - xenial
-  categories:
-  - system
-  - identity
-  - ldap
-  - kerberos
-dependencies: []

roles/alvaroaleman.freeipa-client/scripts/release.sh

@@ -1,179 +0,0 @@
-#!/bin/bash
-
-##Always exit on $? -ne 0
-set -e
-##
-
-_cleanup()
-{
-  rm $FILENAME_TMPCHANGELOG &>/dev/null
-}
-
-##### Create a release for a project managed with a Git repository #####
-
-
-
-### Functions ###
-
-# Confirm dialog for user interactions
-# Usage: confirm "Question?"
-# Returns: 0 = true, 1 = false
-confirm() {
-  read -r -p "$1 [y/n] " response
-  case $response in
-    [yY][eE][sS]|[yY])
-      return 0;;
-    *)
-      return 1;;
-  esac
-}
-
-### Display usage message
-usage () {
-  echo "Usage: $0 [-v VERSION] [-r REMOTE] -s 'One line summary of changes for this release'"
-  exit 0
-}
-
-
-### Initialize the variables and settings ###
-#Variables
-RELEASE_VERSION=
-REMOTE=
-SHORT_SUMMARY=
-
-while getopts v:r:s: OPT; do
-  case $OPT in
-      v) RELEASE_VERSION="${OPTARG}";;
-      r) REMOTE="${OPTARG}";;
-      s) SHORT_SUMMARY="${OPTARG}";;
-  esac
-done
-shift $(( $OPTIND - 1 ));
-
-if [ -z "${SHORT_SUMMARY}" ]; then
-  usage && exit 0
-fi
-
-: ${REMOTE:=origin}
-
-FILENAME_TMPCHANGELOG="$( mktemp --suffix=ansible_role_release_changelog )"
-
-trap _cleanup ALRM HUP INT TERM EXIT
-
-# Fetch Git remote inormation
-git fetch $REMOTE --tags
-
-# Some information can be detected
-LAST_VERSION=$( git tag -l | tail -n 1 )
-REPOSITORY_NAME=$( git remote show -n $REMOTE | grep Fetch | sed 's#.*/##' | sed 's/\.git//' )
-EXISTING_TAGS=`git tag -l`
-
-# Detect version if not provided by user
-if [[ -z "${RELEASE_VERSION}" ]]; then
-  RELEASE_VERSION=$(echo $LAST_VERSION|awk -F . '{print $1 "." $2 + 1 "." $3}')
-fi
-
-RELEASE_BRANCH="release/${RELEASE_VERSION}"
-# Check if there is already a tag named $RELEASE_VERSION
-## Temporary disabling exit on $? -ne 0 to be able to display error message
-set +e
-if [[ $EXISTING_TAGS =~ "$RELEASE_VERSION" ]]; then
-  >&2 echo "A tag $RELEASE_VERSION already exists!"
-  >&2 echo "Aborting.."
-  exit 1
-fi
-set -e
-
-
-# Confirm or exit
-echo
-echo "Settings for the release to be created:"
-echo "  Version of last release:  ${LAST_VERSION}"
-echo "  Version of new release:   ${RELEASE_VERSION}"
-echo "  Name of Git repository:   ${REPOSITORY_NAME}"
-echo "  Summary text for release: ${SHORT_SUMMARY}"
-if ! confirm "Continue with these settings?"; then
-  exit 1
-fi
-
-
-
-### Perform release ###
-
-echo
-echo "Checkout and pull next branch"
-git checkout next
-git pull $REMOTE next
-
-echo
-echo "Checkout new release branch"
-git checkout -b ${RELEASE_BRANCH}
-
-echo
-echo "Write VERSION file"
-echo ${RELEASE_VERSION} > VERSION
-
-echo
-echo "Add release information to CHANGELOG.md file"
-
-cat CHANGELOG.md > $FILENAME_TMPCHANGELOG
-echo "# ${RELEASE_VERSION}" > CHANGELOG.md
-echo "" >> CHANGELOG.md
-
-if [[ -n ${LAST_VERSION} ]]; then
-  git shortlog --no-merges next --not ${LAST_VERSION} | sed -e '/^[ \t]/s#^[ \t]*#* #' | perl -pe 's/:$/:\n/g' >> CHANGELOG.md
-  cat $FILENAME_TMPCHANGELOG >> CHANGELOG.md
-else
-  git shortlog --no-merges next | sed -e '/^[ \t]/s#^[ \t]*#* #' | perl -pe 's/:$/:\n/g' >> CHANGELOG.md
-  cat $FILENAME_TMPCHANGELOG >> CHANGELOG.md
-fi
-echo "Please verify and adjust version information that was prepended to CHANGELOG.md file"
-echo "Diff looks like this:"
-echo
-echo '###### Diff start ######'
-
-## Disable exit on $? -ne 0 for the diff command, since it returns $? == 1 if a diff was found
-set +e
-diff -u $FILENAME_TMPCHANGELOG CHANGELOG.md
-set -e
-
-echo '###### Diff end ######'
-echo
-echo "In case this is not correct, press ctrl+z to pause this script, adjust CHANGELOG.md and get back using the fg command"
-while ! confirm "Continue?"; do
-  echo "And now?"
-done
-
-echo
-echo "Commit generated release information"
-rm -f $FILENAME_TMPCHANGELOG
-git add VERSION
-git add CHANGELOG.md
-git commit -m "${REPOSITORY_NAME} ${RELEASE_VERSION}: ${SHORT_SUMMARY}"
-
-echo
-echo "Checkout and pull master branch"
-git checkout master
-git pull $REMOTE master
-
-echo
-echo "Merge release branch to master branch"
-git merge --no-ff --log --no-edit ${RELEASE_BRANCH}
-
-echo
-echo "Create release tag ${RELEASE_VERSION}"
-git tag -a ${RELEASE_VERSION} -m "${REPOSITORY_NAME} ${RELEASE_VERSION}: ${SHORT_SUMMARY}"
-
-echo
-echo "Merge release branch to next branch"
-git checkout next
-git merge ${RELEASE_BRANCH}
-
-echo
-echo "Delete release branch - it's obsolete now"
-git branch -d ${RELEASE_BRANCH}
-
-echo
-echo "Push all changes to remote repository"
-git push $REMOTE master next ${RELEASE_VERSION}
-exit 0

roles/alvaroaleman.freeipa-client/tasks/main.yml

@@ -1,95 +0,0 @@
----
-# tasks file for ansible-freeipa-client
-
-- name: Assert supported distribution
-  tags:
-    - assertion
-    - freeipaclient
-  assert:
-    that:
-      - ansible_distribution + '-' + ansible_distribution_major_version in freeipaclient_supported_distributions
-
-- name: Assert required variables
-  tags:
-    - assertion
-    - freeipaclient
-  assert:
-    that:
-      - freeipaclient_server is defined
-      - freeipaclient_domain is defined
-      - freeipaclient_enroll_user is defined
-      - freeipaclient_enroll_pass is defined
-
-- name: Import variables
-  tags:
-    - import
-    - freeipaclient
-  include_vars: "{{ ansible_distribution }}.yml"
-
-- name: Set DNS server
-  tags:
-    - dns
-    - freeipaclient
-  become: true
-  when: freeipaclient_dns_server is defined
-  lineinfile:
-    state: present
-    line: "nameserver {{ freeipaclient_dns_server }}"
-    dest: /etc/resolv.conf
-
-- name: Update apt cache
-  tags:
-    - packagemanagement
-    - freeipaclient
-  become: true
-  when: ansible_pkg_mgr  == 'apt'
-  apt:
-    update_cache: true
-    cache_valid_time: 3600
-
-- name: Install required packages
-  tags:
-    - packagemanagement
-    - freeipaclient
-  become: true
-  with_items: "{{ freeipaclient_packages }}"
-  package:
-    state: present
-    name: "{{ item }}"
-
-- name: Check if host is enrolled
-  tags:
-    - enroll
-    - freeipaclient
-  register: freeipaclient_ipaconf
-  check_mode: no
-  stat:
-    path: /etc/ipa/default.conf
-
-- name: Enroll host in domain
-  tags:
-    - enroll
-    - freeipaclient
-  become: true
-  when: not freeipaclient_ipaconf.stat.exists
-  command: >
-    {{ freeipaclient_install_command }}
-    {{'--hostname=' + freeipaclient_hostname  if freeipaclient_hostname is defined else '--hostname=' + ansible_nodename }}
-    --server={{ freeipaclient_server }}
-    --domain={{ freeipaclient_domain }}
-    --principal={{ freeipaclient_enroll_user }}
-    --password={{ freeipaclient_enroll_pass }}
-    --ssh-trust-dns
-    --mkhomedir
-    {{ '--enable-dns-updates' if freeipaclient_enable_dns_updates else ''}}
-    --unattended
-    {{ '--all-ip-addresses' if freeipaclient_all_ip_addresses else ''}}
-    {{ '--no-ntp' if not freeipaclient_enable_ntp else ''}}
-    {{ '--force-join' if freeipaclient_force_join else ''}}
-
-- name: Include Ubuntu specific tasks
-  tags:
-    - ubuntu
-    - freeipaclient
-  when: ansible_os_family == 'Debian'
-  include: ubuntu.yml

roles/alvaroaleman.freeipa-client/tasks/ubuntu.yml

@@ -1,23 +0,0 @@
-- name: Enable mkhomedir
-  tags:
-    - ubuntu
-    - mkhomedir
-    - freeipaclient
-  become: true
-  lineinfile:
-    dest: /etc/pam.d/common-session
-    line: 'session     required      pam_mkhomedir.so skel=/etc/skel umask=0022'
-
-- name: Enable sssd sudo functionality
-  tags:
-    - ubuntu
-    - sssd
-    - freeipaclient
-  become: true
-  notify:
-    - restart sssd
-    - restart ssh
-  lineinfile:
-    dest: /etc/sssd/sssd.conf
-    regexp: '^services.*'
-    line: 'services = nss, pam, ssh, sudo'

roles/alvaroaleman.freeipa-client/tests/playbook.yml

@@ -1,11 +0,0 @@
----
-- hosts: all
-  vars:
-    freeipaclient_force_join: true
-    freeipaclient_server: ipa.demo1.freeipa.org
-    freeipaclient_domain: ipa.demo1.freeipa.org
-    freeipaclient_enroll_user: admin
-    freeipaclient_enroll_pass: Secret123
-    freeipaclient_hostname: ansible-freeipa-client-test.demo1.freeipa.org
-  roles:
-    - ansible-freeipa-client

roles/alvaroaleman.freeipa-client/vars/CentOS.yml

@@ -1,4 +0,0 @@
-freeipaclient_install_command: '/sbin/ipa-client-install'
-freeipaclient_packages:
- - ipa-client
- - dbus-python

roles/alvaroaleman.freeipa-client/vars/Fedora.yml

@@ -1,3 +0,0 @@
-freeipaclient_install_command: '/sbin/ipa-client-install'
-freeipaclient_packages:
- - freeipa-client

roles/alvaroaleman.freeipa-client/vars/RedHat.yml

@@ -1,4 +0,0 @@
-freeipaclient_install_command: '/sbin/ipa-client-install'
-freeipaclient_packages:
- - ipa-client
- - dbus-python

roles/alvaroaleman.freeipa-client/vars/Ubuntu.yml

@@ -1,4 +0,0 @@
-freeipaclient_install_command: '/usr/sbin/ipa-client-install'
-freeipaclient_packages:
- - freeipa-client
- - dnsutils

roles/alvaroaleman.freeipa-client/vars/main.yml

@@ -1,9 +0,0 @@
----
-# vars file for ansible-freeipa-client
-freeipaclient_supported_distributions:
-  - Ubuntu-14
-  - Ubuntu-16
-  - Ubuntu-18
-  - CentOS-7
-  - RedHat-7
-  - Fedora-24

roles/ansible-network.cisco_ios/.gitignore

@@ -1,113 +0,0 @@
-# IDE
-.vscode/
-
-# Ansible
-*.log
-*.retry
-*.swp
-!*.gitkeep
-ansible.cfg
-
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
-
-# C extensions
-*.so
-
-# Distribution / packaging
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.coverage
-.coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-.hypothesis/
-.pytest_cache/
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
-local_settings.py
-db.sqlite3
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-target/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# pyenv
-.python-version
-
-# celery beat schedule file
-celerybeat-schedule
-
-# SageMath parsed files
-*.sage.py
-
-# Environments
-.env
-.venv
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
-
-# Spyder project settings
-.spyderproject
-.spyproject
-
-# Rope project settings
-.ropeproject
-
-# mkdocs documentation
-/site
-
-# mypy
-.mypy_cache/

roles/ansible-network.cisco_ios/.yamllint

@@ -1,10 +0,0 @@
-extends: default
-
-rules:
-  braces:
-    max-spaces-inside: 1
-    level: error
-  brackets:
-    max-spaces-inside: 1
-    level: error
-  line-length: disable

roles/ansible-network.cisco_ios/CHANGELOG.rst

@@ -1,120 +0,0 @@
-=========================
-Ansible Network cisco_ios
-=========================
-.. _cisco_ios_v2.7.1:
-
-v2.7.1
-======
-
-.. _cisco_ios_v2.7.1_Minor Changes:
-
-Minor Changes
--------------
-
-- Adds parser for reload reason. `ios-#87 <https://github.com/ansible-network/cisco_ios/pull/87>`_.
-- Fixed message ``missing required arg: config_manager_text``. `ios-#88 <https://github.com/ansible-network/cisco_ios/pull/88>`_.
-- Remove set defaults task files. `ios-#89 <https://github.com/ansible-network/cisco_ios/pull/89>`_.
-- Use default template if no specific peer provider folder is present. `ios-#90 <https://github.com/ansible-network/cisco_ios/pull/90>`_.
-- Add unconfigure task hooks. `ios-#92 <https://github.com/ansible-network/cisco_ios/pull/92>`_.
-
-.. _cisco_ios_v2.7.0:
-
-v2.7.0
-======
-
-.. _cisco_ios_v2.7.0_Major Changes:
-
-Major Changes
--------------
-
-- Initial release of 2.7.0 ``cisco_ios`` Ansible role that is supported with Ansible 2.7.0
-- Dependant role ``ansible-network.network-engine`` should be upgraded with version >= 2.7.2 
-
-.. _cisco_ios_v2.7.0_Bugfixes:
-
-Bugfixes
---------
-
-- multiline banner processing (cli_config issue) (#69)
-- Ensure that subset is a list. Align docs with fact map (#47)
-- Created test for show_interfaces parser (#58)
-- fix for 'interfaces' facts (#55)
-- fix for handling config text with lines containing only whitespace chars (#64)
-
-.. _cisco_ios_v2.6.3:
-
-v2.6.3
-======
-
-.. _cisco_ios_v2.6.3_New Features
-
-New Features
-------------
-
-- NEW provider tasks and parsers for net_operations role
-
-.. _cisco_ios_v2.6.3_Bugfixes:
-
-Bugfixes
---------
-
-- configure_user task should use config_manager_file instead of config_manager_text
-- uptime facts from cisco IOS has separate keys for year, week, days hours and time
-
-.. _cisco_ios_v2.6.2:
-
-v2.6.2
-======
-
-.. _cisco_ios_v2.6.2_New Features
-
-New Features
-------------
-
-- NEW Added CPF and Fiber Optic DOM parser
-- NEW Added dependency role plugin check
-
-.. _cisco_ios_v2.6.1:
-
-v2.6.1
-======
-
-.. _cisco_ios_v2.6.1_New Action Plugins:
-
-New Action Plugins
-------------------
-
-- NEW ``ios_user_manager`` action plugin
-
-.. _cisco_ios_v2.6.1_New Tasks:
-
-New Tasks
----------
-
-- NEW ``configure_user`` task
-
-.. _cisco_ios_v2.6.1_Bugfixes:
-
-Bugfixes
---------
-
-- Refactor vrf and bgp output and improve reliability (#29)
-- better support for working with config_manager tasks
-
-devel
-=====
-
-New Functions
--------------
-
-- NEW `get_facts` retrive and parse facts from cisco ios devices
-- NEW `config_manager/get` support for config_manager get function
-- NEW `config_manager/load` support for config_manager load function
-- NEW `config_manager/save` support for config_manager save function
-- NEW `configure_user` support for configuring users on cisco ios devices
-
-
-Major Changes
--------------
-
-- Initial release of the `cisco_ios` role.

roles/ansible-network.cisco_ios/LICENSE

@@ -1,674 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    {one line to give the program's name and a brief idea of what it does.}
-    Copyright (C) {year}  {name of author}
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    {project}  Copyright (C) {year}  {fullname}
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.

roles/ansible-network.cisco_ios/README.md

@@ -1,37 +0,0 @@
-# cisco_ios
-
-This Ansible Network role provides a set of platform dependent fuctions that
-are designed to work with Cisco IOS network devices.  The functions included
-int his role inlcuding both configuration and fact collection.
-
-## Requirements
-
-* Ansible 2.6 or later
-* Ansible Network Engine Role 2.6.0 or later
-
-## Functions
-
-This section provides a list of the availabe functions that are including
-in this role.  Any of the provided functions can be implemented in Ansible
-playbooks to perform automation activities on Cisco IOS devices.
-
-Please see the documentation link for each function for details on how to use
-the function in an Ansible playbook.
-
-* get_facts [[source]](https://github.com/ansible-network/cisco_ios/blob/devel/tasks/get_facts.yaml) [[docs]](https://github.com/ansible-network/cisco_ios/blob/devel/docs/get_facts.md)
-
-### Config Manager
-* config_manager/get [[source]](https://github.com/ansible-network/cisco_ios/blob/devel/tasks/config_manager/get.yaml) [[docs]](https://github.com/ansible-network/cisco_ios/blob/devel/docs/config_manager/get.md)
-* config_manager/load [[source]](https://github.com/ansible-network/cisco_ios/blob/devel/tasks/config_manager/load.yaml) [[docs]](https://github.com/ansible-network/cisco_ios/blob/devel/docs/config_manager/load.md)
-
-### Cloud VPN
-* cloud_vpn/configure_vpn_initiator [[source]](https://github.com/ansible-network/cisco_ios/blob/devel/tasks/cloud_vpn/configure_vpn_initiator.yaml) [[docs]](https://github.com/ansible-network/cisco_ios/blob/devel/docs/cloud_vpn/configure_vpn_initiator.md)
-* cloud_vpn/configure_routing_initiator [[source]](https://github.com/ansible-network/cisco_ios/blob/devel/tasks/cloud_vpn/configure_routing_initiator.yaml) [[docs]](https://github.com/ansible-network/cisco_ios/blob/devel/docs/cloud_vpn/configure_routing_initiator.md)
-
-## License
-
-GPLv3
-
-## Author Information
-
-Ansible Network Community

roles/ansible-network.cisco_ios/action_plugins/extract_banners.py

@@ -1,137 +0,0 @@
-# (c) 2018, Ansible by Red Hat, inc
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
-#
-from __future__ import (absolute_import, division, print_function)
-__metaclass__ = type
-
-ANSIBLE_METADATA = {'metadata_version': '1.1',
-                    'status': ['preview'],
-                    'supported_by': 'network'}
-
-DOCUMENTATION = """
----
-module: extract_banners
-author: Ansible Network Team
-short_description: remove banners from config text
-description:
-  - The config text specified in C(config) will be used to extract banners
-    from it. Banners need to be executed on device in special manner. It
-    returns configs with banner removed and a dictionary of banners
-version_added: "2.7"
-options:
-  config:
-    description:
-      - Config text from which banners need to be extracted.
-    required: yes
-    default: null
-"""
-
-EXAMPLES = """
-- name: extract multiline banners
-  extract_banners:
-    config: "{{ ios_config_text }}"
-
-"""
-
-RETURN = """
-config:
-  description: returns the config with masked banners
-  returned: always
-  type: str
-banners:
-  description: returns the extracted banners
-  returned: always
-  type: dict
-"""
-import re
-from ansible.plugins.action import ActionBase
-from ansible.module_utils._text import to_text
-from ansible.errors import AnsibleError
-
-try:
-    from __main__ import display
-except ImportError:
-    from ansible.utils.display import Display
-    display = Display()
-
-
-class ActionModule(ActionBase):
-
-    def run(self, tmp=None, task_vars=None):
-        ''' handler for extract_banners  '''
-
-        if task_vars is None:
-            task_vars = dict()
-
-        result = super(ActionModule, self).run(tmp, task_vars)
-        del tmp  # tmp no longer has any effect
-
-        try:
-            config = self._task.args['config']
-        except KeyError as exc:
-            raise AnsibleError(to_text(exc))
-
-        # make config required argument
-        if not config:
-            raise AnsibleError('missing required argument `config`')
-
-        banners, masked_config = self._extract_banners(config)
-        result['config'] = masked_config
-        result['banners'] = banners
-        return result
-
-    def _extract_banners(self, config):
-        config_lines = config.split('\n')
-        found_banner_start = 0
-        banner_meta = []
-        for linenum, line in enumerate(config_lines):
-            if not found_banner_start:
-                banner_start = re.search(r'^banner\s+(\w+)\s+(.*)', line)
-                if banner_start:
-                    banner_cmd = banner_start.group(1)
-                    try:
-                        banner_delimiter = banner_start.group(2)
-                        banner_delimiter = banner_delimiter.strip()
-                        banner_delimiter_esc = re.escape(banner_delimiter)
-                    except Exception:
-                        continue
-                    banner_start_index = linenum
-                    found_banner_start = 1
-                    continue
-
-            if found_banner_start:
-                # Search for delimiter found in current banner start
-                regex = r'%s' % banner_delimiter_esc
-                banner_end = re.search(regex, line)
-                if banner_end:
-                    found_banner_start = 0
-                    kwargs = {
-                        'banner_cmd': banner_cmd,
-                        'banner_delimiter': banner_delimiter,
-                        'banner_start_index': banner_start_index,
-                        'banner_end_index': linenum,
-                    }
-                    banner_meta.append(kwargs)
-
-        # Build banners from extracted data
-        banner_lines = []
-        for banner in banner_meta:
-            banner_lines.append('banner %s %s' % (banner['banner_cmd'],
-                                banner['banner_delimiter']))
-            banner_conf_lines = config_lines[banner['banner_start_index'] + 1: banner['banner_end_index']]
-            for index, conf_line in enumerate(banner_conf_lines):
-                banner_lines.append(conf_line)
-            banner_lines.append('%s' % banner['banner_delimiter'])
-
-        # Delete banner lines from config
-        for banner in banner_meta:
-            banner_lines_range = range(banner['banner_start_index'],
-                                       banner['banner_end_index'] + 1)
-            for index in banner_lines_range:
-                config_lines[index] = '! banner removed'
-
-        configs = '\n'.join(config_lines)
-        return (banner_lines, configs)

roles/ansible-network.cisco_ios/action_plugins/ios_user_manager.py

@@ -1,111 +0,0 @@
-# (c) 2018, Ansible by Red Hat, inc
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
-#
-from __future__ import (absolute_import, division, print_function)
-__metaclass__ = type
-
-ANSIBLE_METADATA = {'metadata_version': '1.1',
-                    'status': ['preview'],
-                    'supported_by': 'network'}
-import re
-import base64
-import hashlib
-
-from ansible.plugins.action import ActionBase
-
-
-class UserManager:
-
-    def __init__(self, new_users, user_config_data):
-        self.__new_users = new_users
-        self.__user_config_data = user_config_data
-
-    @staticmethod
-    def calculate_fingerprint(sshkey):
-        if ' ' in sshkey:
-            keyparts = sshkey.split(' ')
-            keyparts[1] = hashlib.md5(base64.b64decode(keyparts[1])).hexdigest().upper()
-            return ' '.join(keyparts)
-
-        else:
-            return 'ssh-rsa %s' % hashlib.md5(base64.b64decode(sshkey)).hexdigest().upper()
-
-    def _parse_view(self, data):
-        match = re.search(r'view (\S+)', data, re.M)
-        if match:
-            return match.group(1)
-
-    def _parse_sshkey(self, data):
-        match = re.search(r'key-hash (\S+ \S+(?: .+)?)$', data, re.M)
-        if match:
-            return match.group(1)
-
-    def _parse_privilege(self, data):
-        match = re.search(r'privilege (\S+)', data, re.M)
-        if match:
-            return int(match.group(1))
-
-    def generate_existing_users(self):
-        match = re.findall(r'(?:^(?:u|\s{2}u))sername (\S+)', self.__user_config_data, re.M)
-        if not match:
-            return []
-
-        existing_users = []
-
-        for user in set(match):
-            regex = r'username %s .+$' % user
-            cfg = re.findall(regex, self.__user_config_data, re.M)
-            cfg = '\n'.join(cfg)
-            sshregex = r'username %s\n\s+key-hash .+$' % user
-            sshcfg = re.findall(sshregex, self.__user_config_data, re.M)
-            sshcfg = '\n'.join(sshcfg)
-
-            obj = {
-                'name': user,
-                'sshkey': self._parse_sshkey(sshcfg),
-                'privilege': self._parse_privilege(cfg),
-                'view': self._parse_view(cfg)
-            }
-
-            filtered = {k: v for k, v in obj.items() if v is not None}
-            obj.clear()
-            obj.update(filtered)
-
-            existing_users.append(obj)
-
-        return existing_users
-
-    def filter_users(self):
-        want = self.__new_users
-        for user in want:
-            if 'sshkey' in user:
-                user['sshkey'] = self.calculate_fingerprint(user['sshkey'])
-
-        have = self.generate_existing_users()
-        filtered_users = [x for x in want if x not in have]
-
-        changed = True if len(filtered_users) > 0 else False
-
-        return changed, filtered_users
-
-
-class ActionModule(ActionBase):
-
-    def run(self, tmp=None, task_vars=None):
-        if task_vars is None:
-            task_vars = dict()
-
-        result = super(ActionModule, self).run(tmp, task_vars)
-
-        try:
-            new_users = self._task.args['new_users']
-            user_config_data = self._task.args['user_config']
-        except KeyError as exc:
-            return {'failed': True, 'msg': 'missing required argument: %s' % exc}
-
-        result['changed'], result['stdout'] = UserManager(new_users, user_config_data).filter_users()
-
-        return result

roles/ansible-network.cisco_ios/action_plugins/parse_validate_acl.py

@@ -1,262 +0,0 @@
-# (c) 2018, Ansible Inc,
-#
-# This file is part of Ansible
-#
-# Ansible is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
-from __future__ import (absolute_import, division, print_function)
-__metaclass__ = type
-
-import copy
-import os
-import time
-import re
-import hashlib
-import netaddr
-import json
-import socket
-
-from ansible.module_utils._text import to_bytes, to_text
-from ansible.module_utils.connection import Connection
-from ansible.errors import AnsibleError
-from ansible.plugins.action import ActionBase
-from ansible.module_utils.six.moves.urllib.parse import urlsplit
-from ansible.utils.path import unfrackpath
-
-try:
-    from __main__ import display
-except ImportError:
-    from ansible.utils.display import Display
-    display = Display()
-
-
-class ActionModule(ActionBase):
-
-    def run(self, tmp=None, task_vars=None):
-        result = super(ActionModule, self).run(task_vars=task_vars)
-
-        try:
-            show_acl_output_buffer = self._task.args.get('show_acl_output_buffer')
-        except KeyError as exc:
-            return {'failed': True, 'msg': 'missing required argument: %s' % exc}
-
-        try:
-            parser = self._task.args.get('parser')
-        except KeyError as exc:
-            return {'failed': True, 'msg': 'missing required argument: %s' % exc}
-
-        try:
-            generated_flow_file = self._task.args.get('generated_flow_file')
-        except KeyError as exc:
-            return {'failed': True, 'msg': 'missing required argument: %s' % exc}
-
-        generated_flow_file = unfrackpath(generated_flow_file)
-        dest = generated_flow_file
-
-        parser = unfrackpath(parser)
-        if not os.path.exists(parser):
-            return {'failed': True, 'msg': 'path: %s does not exist.' % parser}
-        parser_file = parser
-
-        pd_json = self._parse_acl_with_textfsm(
-            parser_file, show_acl_output_buffer)
-        try:
-            changed = self._write_packet_dict(dest, pd_json)
-        except IOError as exc:
-            result['failed'] = True
-            result['msg'] = ('Exception received : %s' % exc)
-
-        result['changed'] = changed
-        if changed:
-            result['destination'] = dest
-        else:
-            result['dest_unchanged'] = dest
-
-        return result
-
-    def _create_packet_dict(self, cmd_out):
-        import warnings
-        with warnings.catch_warnings(record=True):
-            warnings.simplefilter("always")
-            from trigger.acl import parse
-        import netaddr
-        import json
-        import uuid
-
-        # pd is list of dictionary of packets
-        pd = []
-        lines = cmd_out.split('\n')
-        for index, line in enumerate(lines):
-            line = to_bytes(line, errors='surrogate_or_strict')
-            pd_it = {}
-            try:
-                p = parse(line)
-            except Exception:
-                continue
-
-            if p.terms:
-                match = p.terms[0].match
-                for key in match:
-                    if key == 'source-address':
-                        for m in match["source-address"]:
-                            v = netaddr.IPNetwork(str(m))
-                            # Return the host in middle of subnet
-                            size_subnet = v.size
-                            host_index = int(size_subnet / 2)
-                            pd_it["src"] = str(v[host_index])
-                    if key == 'destination-address':
-                        for m in match["destination-address"]:
-                            v = netaddr.IPNetwork(str(m))
-                            # Return the host in middle of subnet
-                            size_subnet = v.size
-                            host_index = int(size_subnet / 2)
-                            pd_it["dst"] = str(v[host_index])
-                    if key == 'protocol':
-                        for m in match['protocol']:
-                            pd_it["proto"] = str(m)
-                    if key == 'destination-port':
-                        for m in match["destination-port"]:
-                            pd_it['dst_port'] = str(m)
-                    if key == 'source-port':
-                        for m in match["source-port"]:
-                            pd_it['src_port'] = str(m)
-
-                action = p.terms[0].action
-                for act in action:
-                    pd_it["action"] = act
-
-            if pd_it is not None:
-                if "dst" not in pd_it:
-                    pd_it["dst"] = "any"
-                if "src" not in pd_it:
-                    pd_it["src"] = "any"
-                pd_it["service_line_index"] = str(index)
-                pd.append(pd_it)
-
-        return json.dumps(pd, indent=4)
-
-    def _write_packet_dict(self, dest, contents):
-        # Check for Idempotency
-        if os.path.exists(dest):
-            try:
-                with open(dest, 'r') as f:
-                    old_content = f.read()
-            except IOError as ioexc:
-                raise IOError(ioexc)
-            sha1 = hashlib.sha1()
-            old_content_b = to_bytes(old_content, errors='surrogate_or_strict')
-            sha1.update(old_content_b)
-            checksum_old = sha1.digest()
-
-            sha1 = hashlib.sha1()
-            new_content_b = to_bytes(contents, errors='surrogate_or_strict')
-            sha1.update(new_content_b)
-            checksum_new = sha1.digest()
-            if checksum_old == checksum_new:
-                return (False)
-
-        try:
-            with open(dest, 'w') as f:
-                f.write(contents)
-        except IOError as ioexc:
-            raise IOError(ioexc)
-
-        return (True)
-
-    def _parse_acl_with_textfsm(self, parser_file, output):
-        import textfsm
-        tmp = open(parser_file)
-        re_table = textfsm.TextFSM(tmp)
-        results = re_table.ParseText(output)
-        fsm_results = []
-        for item in results:
-            facts = {}
-            facts.update(dict(zip(re_table.header, item)))
-            fsm_results.append(facts)
-
-        pd = []
-        parsed_acl = []
-        # Convert dictionary of terms into flows dictionary
-        for term in fsm_results:
-            pd_it = {}
-            original_terms = {}
-            for k, v in term.items():
-                if k == 'LINE_NUM' and v == '':
-                    # Empty line with just name
-                    continue
-                elif k == 'LINE_NUM' and v != '':
-                    pd_it["service_line_index"] = v
-                    original_terms["service_line_index"] = v
-                if k == 'PROTOCOL' and v != '':
-                    pd_it["proto"] = v
-                    original_terms['proto'] = v
-                if k == 'ACTION' and v != '':
-                    pd_it["action"] = v
-                    original_terms['action'] = v
-                if k == 'SRC_NETWORK' and v != '':
-                    if 'SRC_WILDCARD' in term:
-                        src_mask = term['SRC_WILDCARD']
-                        src_invert_mask = sum([bin(255 - int(x)).count("1") for x in
-                                              src_mask.split(".")])
-                    else:
-                        src_invert_mask = '32'
-                    cidr = "%s/%s" % (v, src_invert_mask)
-                    src_ip = netaddr.IPNetwork(cidr)
-                    size_subnet = src_ip.size
-                    host_index = int(size_subnet / 2)
-                    pd_it['src'] = str(src_ip[host_index])
-                    original_terms['src'] = src_ip
-                if k == 'SRC_ANY' and v != '':
-                    pd_it['src'] = "any"
-                    original_terms['src'] = netaddr.IPNetwork('0.0.0.0/0')
-                if k == 'SRC_HOST' and v != '':
-                    pd_it['src'] = v
-                    original_terms['src'] = v
-                if k == 'SRC_PORT' and v != '':
-                    if not v[0].isdigit():
-                        v = str(socket.getservbyname(v))
-                    pd_it['src_port'] = v
-                    original_terms['src_port'] = v
-                if k == 'DST_NETWORK' and v != '':
-                    if 'DST_WILDCARD' in term:
-                        dst_mask = term['DST_WILDCARD']
-                        dst_invert_mask = sum([bin(255 - int(x)).count("1") for x in
-                                              dst_mask.split(".")])
-                    else:
-                        dst_invert_mask = '32'
-                    d_cidr = "%s/%s" % (v, dst_invert_mask)
-                    dst_ip = netaddr.IPNetwork(d_cidr)
-                    d_size_subnet = dst_ip.size
-                    d_host_index = int(d_size_subnet / 2)
-                    pd_it['dst'] = str(dst_ip[d_host_index])
-                    original_terms['dst'] = dst_ip
-                if k == 'DST_ANY' and v != '':
-                    pd_it['dst'] = "any"
-                    original_terms['dst'] = netaddr.IPNetwork('0.0.0.0/0')
-                if k == 'DST_HOST' and v != '':
-                    pd_it['dst'] = v
-                    original_terms['dst'] = v
-                if k == 'DST_PORT' and v != '':
-                    if not v[0].isdigit():
-                        v = str(socket.getservbyname(v))
-                    pd_it['dst_port'] = v
-                    original_terms['dst_port'] = v
-
-            if pd_it:
-                pd.append(pd_it)
-            if original_terms:
-                parsed_acl.append(original_terms)
-
-        # Store parsed acl on this object for later processing
-        self._parsed_acl = parsed_acl
-        return json.dumps(pd, indent=4)

roles/ansible-network.cisco_ios/bindep.txt

@@ -1,7 +0,0 @@
-# This is a cross-platform list tracking distribution packages needed by tests;
-# see http://docs.openstack.org/infra/bindep/ for additional information.
-
-gcc-c++ [test platform:rpm]
-python3-devel [test platform:rpm]
-python3 [test platform:rpm]
-python36 [test !platform:fedora-28]

roles/ansible-network.cisco_ios/defaults/cloud_vpn/providers/csr/initiator.yaml

@@ -1,5 +0,0 @@
----
-
-cloud_vpn_initiator_user: ec2-user
-cloud_vpn_initiator_ansible_connection: network_cli
-cloud_vpn_initiator_outside_interface: GigabitEthernet1

roles/ansible-network.cisco_ios/defaults/main.yml

@@ -1,15 +0,0 @@
----
-# defaults file for ansible-network.cisco_ios
-#
-ios_config_rollback_enabled: true
-ios_config_use_terminal: true
-ios_config_remove_temp_files: "{{ remove_temp_files | default(True) }}"
-ios_config_replace: "{{ config_manager_replace | default(False) }}"
-
-ios_config_source:
-  running: show running-config
-  startup: show startup-config
-
-ios_get_facts_command_map: "{{ role_path }}/vars/get_facts_command_map.yaml"
-ios_get_facts_subset: "{{ subset | default(['default']) }}"
-ios_dependent_role_check: true

roles/ansible-network.cisco_ios/docs/cloud_vpn/configure_routing_initiator.md

@@ -1,24 +0,0 @@
-# Configure VPN routing as initiator
-The `cloud_vpn/configure_routing_initiator` function will configure the routing where
-a VPN as initiator has been configured previously on Cisco IOS devices.
-It is performed by calling the `cloud_vpn/configure_routing_initiator` task from the role.
-The task will process variables needed for routing configuration and apply it to the device.
-
-Below is an example to configure routing on a CSR device configured as initiator,
-where the responder is AWS VPN.
-
-```
-- hosts: cisco_ios
-
-  tasks:
-    - name: Configure initiator routing
-      include_role:
-        name: ansible-network.cisco_ios
-        tasks_from: cloud_vpn/configure_routing_initiator
-      vars:
-        cloud_vpn_responder_provider: aws_vpn
-        cloud_vpn_responder_cidr: 192.168.0.0/24
-```
-
-## Notes
-None

roles/ansible-network.cisco_ios/docs/cloud_vpn/configure_vpn_initiator.md

@@ -1,33 +0,0 @@
-# Configure VPN as initiator
-The `cloud_vpn/configure_vpn_initiator` function will configure IPSEC VPN as initiator
-on Cisco IOS devices.
-It is performed by calling the `cloud_vpn/configure_vpn_initiator` task from the role.
-The task will process variables needed for VPN configuration and apply it to the device.
-
-Below is an example to configure an IPSEC VPN as initiator on CSR device, where
-the responder is AWS VPN:
-
-```
-- hosts: cisco_ios
-
-  tasks:
-    - name: Configure IPSEC VPN as initiator
-      include_role:
-        name: ansible-network.cisco_ios
-        tasks_from: cloud_vpn/configure_vpn_initiator
-      vars:
-        cloud_vpn_name: myvpn
-        cloud_vpn_psk: mypsksecret
-        cloud_vpn_initiator_provider: csr
-        cloud_vpn_initiator_outside_interface: GigabitEthernet1
-        cloud_vpn_initiator_tunnel_ip: 169.254.56.25
-        cloud_vpn_initiator_tunnel_failover_ip: 169.254.56.29
-        cloud_vpn_responder_provider: aws_vpn
-        cloud_vpn_responder_public_ip: 18.191.132.220
-        cloud_vpn_responder_failover_ip: 18.191.132.221
-        cloud_vpn_responder_tunnel_ip: 169.254.56.26
-        cloud_vpn_responder_tunnel_failover_ip: 169.254.56.30
-```
-
-## Notes
-None

roles/ansible-network.cisco_ios/docs/config_manager/get.md

@@ -1,78 +0,0 @@
-# Get configuration from device
-The `config_manager/get` function will return the either the current active or current
-saved configuration from an Cisco IOS devices.  This function is only
-supported over `network_cli` connections.
-
-The `config_manager/get` function will also parse the device active configuration into
-a set of host facts during its execution.  All of the parsed facts are stored
-in the ``cisco_ios.config`` top level facts key.
-
-## How to get the device configuration
-Retrieving the configuration from the device involves just calling the
-`config_manager/get` function from the role.  By default, the `config_manager/get` role will
-return the device active (running) configuraiton.  The text configuration will
-be returned as a fact for the host.  The configuration text is stored in the
-`configuration` fact.
-
-Below is an example of calling the `config_manager/get` function from the playbook.
-
-```
-- hosts: cisco_ios
-
-  roles:
-    - name ansible-network.cisco_ios
-      function: config_manager/get
-```
-
-The above playbook will return the current running config from each host listed
-in the `cisco_ios` group in inventory.
-
-### Get the current startup config
-By default the `config_manager/get` function will return the device running
-configuration.  If you want to retrieve the device startup configuration, set
-the value of `source` to `startup`.
-
-```
-- hosts: cisco_ios
-
-  roles:
-    - name ansible-network.cisco_ios
-      function: config_manager/get
-      source: startup
-```
-
-### Implement using tasks
-The `config_manager/get` function can also be implemented in the `tasks` during the
-playbook run using either the `include_role` or `import_role` modules as shown
-below.
-
-```
-- hosts: cisco_ios
-
-  tasks:
-    - name: collect facts from cisco ios devices
-      include_role:
-        name: ansible-network.cisco_ios
-        tasks_from: config_manager/get
-```
-
-## How to add additional parsers
-
-The configuration facts are returned by this function are parsed using the
-parsers in the `parser_templates/config` folder.  To add a new parser, simply
-create a PR and add the new parser to the folder.  Once merged, the
-`config_manager/get` function will automatically use the new parser.
-
-## Arguments
-
-### source
-
-Defines the configuration source to return from the device.  This argument
-accepts one of `running` or `startup`.  When the value is set to `running`
-(default), the current active configuration is returned.  When the value is set
-to `sartup`, the device saved configuration is returned.
-
-The default value is `running`
-
-## Notes
-None

roles/ansible-network.cisco_ios/docs/config_manager/load.md

@@ -1,86 +0,0 @@
-# Load configuration onto device
-The `config_manager/load` function will take a Cisco IOS configuration file and load it
-onto the device.  This function supports either merging the configuration with
-the current active configuration or replacing the current active configuration
-with the provided configuration file.  
-
-The `config_manager/load` function will return the full configuration diff in the
-`ios_diff` fact.
-
-NOTE: When performing a configuration replace function be sure to specify the
-entire configuration to be loaded otherwise you could end up not being able to
-reconnect to your IOS device after the configuration has been loaded.
-
-## How to load and merge a configuration
-Loading and merging a configuration file is the default operation for the
-`config_manager/load` function.  It will take the contents of a Cisco IOS configuration
-file and merge it with the current device active configurations.
-
-Below is an example of calling the `config_manager/load` function from the playbook.
-
-```
-- hosts: cisco_ios
-
-  roles:
-    - name ansible_network.cisco_ios
-      function: config_manager/load
-      config_manager_text: "{{ lookup('file', 'ios.cfg') }}"
-```
-
-The above playbook will load the specified configuration file onto each device
-in the `cisco_ios` host group.
-
-## How to replace the current active configuration
-The `config_manager/load` function also supports replacing the current active
-configuration with the configuration file located on the Ansible controller.
-In order to replace the device's active configuration, set the value of the
-`config_manager_replace` setting to `True`.
-
-```
-- hosts: cisco_ios
-
-  roles:
-    - name ansible_network.cisco_ios
-      function: config_manager/load
-      config_manager_text: "{{ lookup('file', 'ios.cfg') }}"
-      config_manager_replace: true
-```
-
-
-## Arguments
-
-### config_manager_text
-
-This value accepts the text form of the configuration to be loaded on to the remote device. 
-The configuration file should be the native set of commands used to configure the remote device.
-
-The default value is `null`
-
-### config_manager_replace
-
-Specifies whether or not the source configuration should replace the current
-active configuration on the target IOS device.  When this value is set to
-False, the source configuration is merged with the active configuration.  When
-this value is set to True, the source configuration will replace the current
-active configuration
-
-The default value is `False`
-
-### ios_config_remove_temp_files
-
-Configures the function to remove or not remove the temp files created when
-preparing to load the configuration file.  There are two locations for temp
-files, one on the Ansible controller and one on the device.  This argument
-accepts a boolean value.
-
-The default value is `True`
-
-### ios_config_rollback_enabled
-
-Configures whether or not automatic rollback is enabled during the execution of
-the function.  When enabled, if an error is enountered, then the configuration
-is automatically returned to the original running-config.  If disabled, then
-the rollback operation is not performed automatically.
-
-The default value is `True`
-

roles/ansible-network.cisco_ios/docs/get_facts.md

@@ -1,166 +0,0 @@
-# Get facts from device
-
-The `get_facts` function can be used to collect facts from an Cisco IOS
-devices.  This function is only supported over `network_cli` connection
-type and requires the `ansible_network_os` value set to `ios`.
-
-## How to get facts from the device
-
-To collect facts from the device, simply include this function in the playbook
-using either the `roles` directive or the `tasks` directive.  If no other
-options are provided, then all of the available facts will be collected for the
-device.
-
-Below is an example of how to use the `roles` directive to collect all facts
-from the IOS device.
-
-```
-- hosts: cisco_ios
-
-  roles:
-    - name ansible-network.cisco_ios
-      function: get_facts
-```
-
-The above playbook will return the facts for the host under the `cisco_ios`
-top level key.  
-
-### Filter the subset of facts returned
-
-By default all available facts will be returned by the `get_facts` function.
-If you only want to return a subset of the facts, you can specify the `subset`
-variable as a list of keys to return. 
-
-For instance, the below will return only `interfaces` and `system` facts.
-
-```
-- hosts: cisco_ios
-
-  roles:
-    - name ansible-network.cisco_ios
-      function: get_facts
-      subset: 
-        - system
-```
-
-### Implement using tasks
-
-The `get_facts` function can also be implemented using the `tasks` directive
-instead of the `roles` directive.  By using the `tasks` directive, you can
-control when the fact collection is run. 
-
-Below is an example of how to use the `get_facts` function with `tasks`.
-
-```
-- hosts: cisco_ios
-
-  tasks:
-    - name: collect facts from cisco ios devices
-      import_role:
-        name: ansible-network.cisco_ios
-        tasks_from: get_facts
-      vars:
-        subset:
-          - system
-          - interfaces
-```
-
-## Adding new parsers
-
-Over time new parsers can be added (or updated) to the role to add additional
-or enhanced functionality.  To add or update parsers perform the following
-steps:
-
-* Add (or update) command parser located ino `parse_templates/cli`
-
-* Update the `vars/get_facts_command_map.yaml` file to map the CLI command 
-to the parser
-
-The `get_facts_command_map.yaml` file provides a mapping between CLI command 
-and parser used to transform the output into Ansible facts. 
-
-### Understanding the mapping file
-
-The command map file provides the mapping between show command and parser file.
-The format of the file is a list of objects.  Each object supports a set of
-keys that can be configured to provide granular control over how each command
-is implemented.
-
-Command map entries support the following keys:
-
-#### command
-
-The `command` key is required and specifies the actual CLI command to execute
-on the target device.  The output from the command is then passed to the parser
-for further processing.
-
-#### parser
-
-The `parser` key provides the name of the parser used to accept the output from
-the command.  The parser value shoule be the command parser filename either
-relative to `parser_templates/cli` or absolute path.  This value is required.
-
-#### engine
-
-This key accepts one of two values, either `command_parser` or `textfsm_parser`. 
-This value instructs the the parsing function as to which parsing engine to 
-use to parse the output from the CLI command.
-
-This key is not required and, if not provided, the engine will assumed to be
-`command_parser`
-
-#### groups
-
-Commands can be contained in one (or more) groups to make it easy for playbook
-designers to filter specific facts to retreive from the network device.  The
-`groups` key must be a list and contain the groups the this command should be
-associated with.
-
-#### pre_hook
-
-The `pre_hook` key provides the path to the set of tasks to include prior
-to running the command on the CLI.  This is useful if there is a need to check
-if a command is available or supported on a particular version.
-
-#### post_hook
-
-The `post_hook` key provides the path to the set of tasks to include after the
-command has been run on the target device and its results have been parsed by
-the parser. 
-
-## Arguments
-
-### ios_get_facts_subset 
-
-Defines the subset of facts to collection when the `get_facts` function is
-called.  This value must be a list value and contain only the sub keys for the
-facts you wish to return.
-
-The default value is `default`
-
-#### Aliases
-
-* subset
-
-#### Current supported values for subset are
-
-* default
-* all
-* interfaces
-* bgp
-* lldp
-
-### ios_get_facts_command_map
-
-Defines the command / parser mapping file to use when the call to `get_facts`
-is made by the playbook.  Normally this value does not need to be modified but
-can be used to pass a custom command map to the function.
-
-The default value is `vars/get_facts_command_map.yaml`
-
-
-## Notes
-
-None
-
-

roles/ansible-network.cisco_ios/filter_plugins/ios.py

@@ -1,35 +0,0 @@
-#
-# (c) 2018 Red Hat, Inc.
-#
-# Copyright (c) 2017 Ansible Project
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-#
-# Make coding more python3-ish
-from __future__ import (absolute_import, division, print_function)
-__metaclass__ = type
-
-import re
-
-
-INTERFACE_NAMES = {
-    'Gi': 'GigabitEthernet',
-}
-
-
-def expand_interface_name(name):
-    match = re.match('([a-zA-Z]*)', name)
-    if match and match.group(1) in INTERFACE_NAMES:
-        matched = match.group(1)
-        name = name.replace(matched, INTERFACE_NAMES[matched])
-    return name
-
-
-class FilterModule(object):
-    """Filters for working with output from network devices"""
-
-    filter_map = {
-        'expand_interface_name': expand_interface_name
-    }
-
-    def filters(self):
-        return self.filter_map

roles/ansible-network.cisco_ios/handlers/main.yml

@@ -1,2 +0,0 @@
----
-# handlers file for ansible-network.cisco_ios

roles/ansible-network.cisco_ios/includes/args_adapter.yaml

@@ -1,13 +0,0 @@
----
-# Playbook to ingest config manager args into ios provider specific args
-#
-
-- name: convert config_manager_text
-  set_fact:
-    ios_config_text: "{{ config_manager_text }}"
-  when: config_manager_text is defined
-
-- name: convert config_manager_file
-  set_fact:
-    ios_config_file: "{{ config_manager_file }}"
-  when: config_manager_file is defined

roles/ansible-network.cisco_ios/includes/checkpoint/create.yaml

@@ -1,26 +0,0 @@
----
-- name: validate ios_checkpoint_filename is defined
-  fail:
-    msg: "missing required var: ios_checkpoint_filename"
-  when: ios_checkpoint_filename is undefined
-
-- name: get current files on disk
-  cli:
-    command: dir
-  register: ios_dir_listing
-
-- name: remove old checkpoint file (if necessary)
-  cli:
-    command: "delete /force flash:/{{ ios_checkpoint_filename }}"
-  when: ios_checkpoint_filename in ios_dir_listing.stdout
-
-# copy the current running-config to the local flash disk on the target device.
-# This will be used both for restoring the current config if a failure happens
-# as well as performing a configuration diff once the new config has been
-# loaded.
-- name: create a checkpoint of the current running-config
-  ios_command:
-    commands:
-      - command: "copy running-config flash:{{ ios_checkpoint_filename }}"
-        prompt: ["\\? "]
-        answer: "{{ ios_checkpoint_filename }}"

roles/ansible-network.cisco_ios/includes/checkpoint/remove.yaml

@@ -1,15 +0,0 @@
----
-- name: validate ios_checkpoint_filename is defined
-  fail:
-    msg: "missing required var: ios_checkpoint_filename"
-  when: ios_checkpoint_filename is undefined
-
-- name: get current files on disk
-  cli:
-    command: dir
-  register: ios_dir_listing
-
-- name: remove checkpoint file from remote device
-  cli:
-    command: "delete /force flash:/{{ ios_checkpoint_filename }}"
-  when: ios_checkpoint_filename in ios_dir_listing.stdout

roles/ansible-network.cisco_ios/includes/checkpoint/restore.yaml

@@ -1,32 +0,0 @@
----
-- name: validate ios_checkpoint_filename is defined
-  fail:
-    msg: "missing required var: ios_checkpoint_filename"
-  when: ios_checkpoint_filename is undefined
-
-- name: get current files on disk
-  cli:
-    command: dir
-  register: ios_dir_listing
-
-- name: verify checkpoint file exists
-  fail:
-    msg: "missing checkpoint file {{ ios_checkpoing_filename }}"
-  when: ios_checkpoint_filename not in ios_dir_listing.stdout
-
-- name: checkpoint configuration restore pre hook
-  include_tasks: "{{ ios_checkpoint_restore_pre_hook }}"
-  when: ios_checkpoint_restore_pre_hook is defined
-
-- name: restore checkpoint configuration
-  cli:
-    command: "config replace flash:/{{ ios_checkpoint_filename }} force"
-  register: ios_rollback_results
-
-- name: checkpoint configuration restore post hook
-  include_tasks: "{{ ios_checkpoint_restore_post_hook }}"
-  when: ios_checkpoint_restore_post_hook is defined
-
-- name: remove checkpoint file from remote device
-  cli:
-    command: "delete /force flash:/{{ ios_checkpoint_filename }}"

roles/ansible-network.cisco_ios/includes/configure/merge.yaml

@@ -1,59 +0,0 @@
----
-- name: validate ios_config_text is defined
-  fail:
-    msg: "missing required arg: ios_config_text"
-  when: ios_config_text is undefined
-
-- name: set the ios_config_temp_file name
-  set_fact:
-    ios_config_temp_file: "tmp_ansible"
-
-- name: create temp working dir
-  tempfile:
-    state: directory
-  register: ios_config_temp_dir
-
-- name: write the config text to disk
-  copy:
-    content: "{{ ios_config_text }}"
-    dest: "{{ ios_config_temp_dir.path }}/{{ ios_config_temp_file }}"
-
-- name: get current list of files on remote device
-  cli:
-    command: dir
-  register: ios_dir_listing
-
-- name: remove temporary files from target device
-  cli:
-    command: "delete /force flash:/{{ ios_config_temp_file }}"
-  when: ios_config_temp_file in ios_dir_listing.stdout
-
-- name: enable the ios scp server
-  cli:
-    command: "{{ line }}"
-  loop:
-    - configure terminal
-    - ip scp server enable
-    - end
-  loop_control:
-    loop_var: line
-
-- name: copy configuration to device
-  net_put:
-    src: "{{ ios_config_temp_dir.path }}/{{ ios_config_temp_file }}"
-    dest: "flash:/{{ ios_config_temp_file }}"
-  changed_when: false
-
-- name: merge with current active configuration
-  cli:
-    command: "{{ line }}"
-  loop:
-    - "copy flash:/{{ ios_config_temp_file }} force"
-    - "delete /force flash:/{{ ios_config_temp_file }}"
-  loop_control:
-    loop_var: line
-
-- name: remove local temp working dir
-  file:
-    path: "{{ ios_config_temp_dir.path }}"
-    state: absent

roles/ansible-network.cisco_ios/includes/configure/replace.yaml

@@ -1,59 +0,0 @@
----
-- name: validate ios_config_text is defined
-  fail:
-    msg: "missing required arg: ios_config_text"
-  when: ios_config_text is undefined
-
-- name: set the ios_config_temp_file name
-  set_fact:
-    ios_config_temp_file: "tmp_ansible"
-
-- name: create temp working dir
-  tempfile:
-    state: directory
-  register: ios_config_temp_dir
-
-- name: write the config text to disk
-  copy:
-    content: "{{ ios_config_text }}"
-    dest: "{{ ios_config_temp_dir.path }}/{{ ios_config_temp_file }}"
-
-- name: get current list of files on remote device
-  cli:
-    command: dir
-  register: ios_dir_listing
-
-- name: remove temporary files from target device
-  cli:
-    command: "delete /force flash:/{{ ios_config_temp_file }}"
-  when: ios_config_temp_file in ios_dir_listing.stdout and ios_config_remove_temp_files
-
-- name: enable the ios scp server
-  cli:
-    command: "{{ line }}"
-  loop:
-    - configure terminal
-    - ip scp server enable
-    - end
-  loop_control:
-    loop_var: line
-
-- name: copy configuration to device
-  net_put:
-    src: "{{ ios_config_temp_dir.path }}/{{ ios_config_temp_file }}"
-    dest: "flash:/{{ ios_config_temp_file }}"
-  changed_when: false
-
-- name: replace current active configuration
-  cli:
-    command: "{{ line }}"
-  loop:
-    - "config replace flash:/{{ ios_config_temp_file }} force"
-    - "delete /force flash:/{{ ios_config_temp_file }}"
-  loop_control:
-    loop_var: line
-
-- name: remove local temp working dir
-  file:
-    path: "{{ ios_config_temp_dir.path }}"
-    state: absent

roles/ansible-network.cisco_ios/includes/configure/terminal.yaml

@@ -1,41 +0,0 @@
----
-# this block is responsible for loading the configuration on to the target
-# device line by line from config model.
-- name: load configuration onto target device
-  block:
-    - name: load configuration lines into target device
-      block:
-        - name: extract banners from configs if present
-          extract_banners:
-            config: "{{ ios_config_text }}"
-          register: result
-
-        - name: load configuration lines into target device except banner
-          cli_config:
-            config: "{{ result['config'] }}"
-          register: ios_config_output
-
-        - name: enter configuration mode
-          cli:
-            command: "configure terminal"
-
-        - name: load banner lines into target device
-          cli_command:
-            command: "{{ item }}"
-            sendonly: true
-          with_items: "{{ result['banners'] }}"
-          register: banner_config_output
-
-        - name: exit configuration mode
-          cli:
-            command: end
-
-      rescue:
-        - name: exit configuration mode
-          cli:
-            command: end
-
-        - name: set host failed
-          fail:
-            msg: "error loading configuration lines"
-  when: not ansible_check_mode

roles/ansible-network.cisco_ios/includes/init.yaml

@@ -1,34 +0,0 @@
----
-- name: set role basic facts
-  set_fact:
-    ansible_network_ios_path: "{{ role_path }}"
-    ansible_network_ios_version: "v2.7.0"
-
-- name: display the role version to stdout
-  debug:
-    msg: "ansible_network.cisco_ios version is {{ ansible_network_ios_version }}"
-
-- name: validate ansible_network_os == 'ios'
-  fail:
-    msg: "expected ansible_network_os to be `ios`, got `{{ ansible_network_os }}`"
-  when: ansible_network_os != 'ios'
-
-- name: validate ansible_connection == 'network_cli'
-  fail:
-    msg: "expected ansible_network to be `network_cli`, got `{{ ansible_connection }}`"
-  when: ansible_connection != 'network_cli'
-
-- name: Validate we have required installed version of dependent roles
-  verify_dependent_role_version:
-    role_path: "{{ role_path }}"
-    depends_map:
-      - name: 'ansible-network.network-engine'
-        version: "{{ ios_network_engine_req_ver_override }}"
-  when: ios_dependent_role_check is defined and ios_dependent_role_check
-        and ios_network_engine_req_ver_override is defined
-
-- name: Validate we have required installed version of dependent roles from meta
-  verify_dependent_role_version:
-    role_path: "{{ role_path }}"
-  when: ios_dependent_role_check is defined and ios_dependent_role_check
-        and ios_network_engine_req_ver_override is not defined

roles/ansible-network.cisco_ios/includes/run_cli.yaml

@@ -1,25 +0,0 @@
----
-- name: run cli command pre hook
-  include_tasks: "{{ ios_run_cli_command_pre_hook }}"
-  when: ios_run_cli_command_pre_hook is defined and ios_run_cli_command_pre_hook
-
-- name: run command and parse output
-  cli:
-    command: "{{ ios_command }}"
-    parser: "{{ parser }}"
-    engine: "{{ ios_parser_engine | default(None) }}"
-    name: "{{ ios_name | default(None) }} "
-  with_first_found:
-    - files:
-        - "{{ ios_parser }}"
-      paths:
-        - "{{ playbook_dir }}/parser_templates/ios"
-        - "~/.ansible/ansible_network/parser_templates/ios"
-        - "/etc/ansible/ansible_network/parser_templates/ios"
-        - "{{ role_path }}/parser_templates"
-  loop_control:
-    loop_var: parser
-
-- name: run cli command post hook
-  include_tasks: "{{ ios_run_cli_command_post_hook }}"
-  when: ios_run_cli_command_post_hook is defined and ios_run_cli_command_post_hook

roles/ansible-network.cisco_ios/includes/wrapper.yaml

@@ -1,102 +0,0 @@
----
-- name: initialize function
-  include_tasks: includes/init.yaml
-
-- name: validate ios_config_includes is defined
-  fail:
-    msg: "missing required arg: ios_config_includes"
-  when: ios_config_includes is undefined
-
-- name: set ios checkpoint filename
-  set_fact:
-    ios_checkpoint_filename: "chk_ansible"
-
-# initiate creating a checkpoint of the existing running-config
-- name: create checkpoint of current configuration
-  include_tasks: "{{ role_path }}/includes/checkpoint/create.yaml"
-
-- name: configure the target device
-  block:
-    # iterate over the set of includes to configure the device
-    - name: iterate over configuration tasks
-      include_tasks: "{{ task }}"
-      loop: "{{ ios_config_includes }}"
-      loop_control:
-        loop_var: task
-
-  rescue:
-    # since the host has failed during the configuration load, the role by
-    # default will initiate a restore sequence.  the restore sequence will
-    # load the previous running-config with the replace option enabled.
-    - name: display message
-      debug:
-        msg: "error configuring device, starting rollback"
-      when: ios_config_rollback_enabled
-
-    - name: initiate configuration rollback
-      include_tasks: "{{ role_path }}/includes/checkpoint/restore.yaml"
-
-    - name: display message
-      debug:
-        msg: "successfully completed configuration rollback"
-      when: ios_config_rollback_enabled
-
-    - name: fail host due to config load error
-      fail:
-        msg: "error loading configuration onto target device"
-
-- name: set the ios_active_config fact
-  set_fact:
-    ios_active_config: "cfg_ansible"
-
-# check if any reminents are left over from a previous run and remove them
-# prior to starting the configuration tasks.
-- name: check if stale temporarary files exist on target device
-  cli:
-    command: dir
-  register: ios_dir_listing
-
-- name: remove temporary files from target device
-  cli:
-    command: "delete /force flash:/{{ ios_active_config }}"
-  when: ios_active_config in ios_dir_listing.stdout
-
-# copy the updated running-config to the local flash device to be used to
-# generate a configuration diff between the before and after
-# running-configurations.
-- name: copy running-config to active config
-  ios_command:
-    commands:
-      - command: "copy running-config flash:{{ ios_active_config }}"
-        prompt: ["\\? "]
-        answer: "{{ ios_active_config }}"
-
-# generate the configuration diff and display the diff to stdout.  only set
-# changed if there are lines in the diff that have changed
-- name: generate ios diff
-  cli:
-    command: "show archive config differences flash:{{ ios_checkpoint_filename }} flash:{{ ios_active_config }}"
-  register: ios_config_diff
-  changed_when: "'No changes were found' not in ios_config_diff.stdout"
-
-- name: display config diff
-  debug:
-    msg: "{{ ios_config_diff.stdout.splitlines() }}"
-  when: not ansible_check_mode
-
-# refresh the list of files currently on the target network device flash
-# drive and remote all temp files
-- name: update local directory listing
-  cli:
-    command: dir
-  register: ios_dir_listing
-
-- name: remove remote temp files from flash
-  cli:
-    command: "delete /force flash:/{{ filename }}"
-  loop:
-    - "{{ ios_active_config }}"
-    - "{{ ios_checkpoint_filename }}"
-  loop_control:
-    loop_var: filename
-  when: filename in ios_dir_listing.stdout

roles/ansible-network.cisco_ios/library/ios_capabilities.py

@@ -1,65 +0,0 @@
-#!/usr/bin/python
-#
-# This file is part of Ansible
-#
-# Ansible is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
-#
-
-ANSIBLE_METADATA = {'metadata_version': '1.1',
-                    'status': ['preview'],
-                    'supported_by': 'network'}
-
-
-DOCUMENTATION = """
----
-module: ios_capabilities
-version_added: "2.7"
-short_description: Collect device capabilities from Cisco IOS
-description:
-  - Collect basic fact capabilities from Cisco NX-OS devices and return
-    the capabilities as Ansible facts.
-author:
-  - Ansible Netowrk Community (ansible-network)
-options: {}
-"""
-
-EXAMPLES = """
-- facts:
-"""
-
-RETURN = """
-"""
-from ansible.module_utils.basic import AnsibleModule
-from ansible.module_utils.connection import Connection
-
-
-def main():
-    """ main entry point for Ansible module
-    """
-    argument_spec = {}
-
-    module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True)
-
-    connection = Connection(module._socket_path)
-    facts = connection.get_capabilities()
-    facts = module.from_json(facts)
-    result = {
-        'changed': False,
-        'ansible_facts': {'cisco_ios': {'capabilities': facts['device_info']}}
-    }
-    module.exit_json(**result)
-
-
-if __name__ == '__main__':
-    main()

roles/ansible-network.cisco_ios/library/ios_command.py

@@ -1,241 +0,0 @@
-#!/usr/bin/python
-#
-# This file is part of Ansible
-#
-# Ansible is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# Ansible is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
-#
-
-ANSIBLE_METADATA = {'metadata_version': '1.1',
-                    'status': ['preview'],
-                    'supported_by': 'network'}
-
-
-DOCUMENTATION = """
----
-module: ios_command
-version_added: "2.1"
-author: "Peter Sprygada (@privateip)"
-short_description: Run commands on remote devices running Cisco IOS
-description:
-  - Sends arbitrary commands to an ios node and returns the results
-    read from the device. This module includes an
-    argument that will cause the module to wait for a specific condition
-    before returning or timing out if the condition is not met.
-  - This module does not support running commands in configuration mode.
-    Please use M(ios_config) to configure IOS devices.
-extends_documentation_fragment: ios
-notes:
-  - Tested against IOS 15.6
-options:
-  commands:
-    description:
-      - List of commands to send to the remote ios device over the
-        configured provider. The resulting output from the command
-        is returned. If the I(wait_for) argument is provided, the
-        module is not returned until the condition is satisfied or
-        the number of retries has expired. If a command sent to the
-        device requires answering a prompt, it is possible to pass
-        a dict containing I(command), I(answer) and I(prompt).
-        Common answers are 'y' or "\\r" (carriage return, must be
-        double quotes). See examples.
-    required: true
-  wait_for:
-    description:
-      - List of conditions to evaluate against the output of the
-        command. The task will wait for each condition to be true
-        before moving forward. If the conditional is not true
-        within the configured number of retries, the task fails.
-        See examples.
-    aliases: ['waitfor']
-    version_added: "2.2"
-  match:
-    description:
-      - The I(match) argument is used in conjunction with the
-        I(wait_for) argument to specify the match policy.  Valid
-        values are C(all) or C(any).  If the value is set to C(all)
-        then all conditionals in the wait_for must be satisfied.  If
-        the value is set to C(any) then only one of the values must be
-        satisfied.
-    default: all
-    choices: ['any', 'all']
-    version_added: "2.2"
-  retries:
-    description:
-      - Specifies the number of retries a command should by tried
-        before it is considered failed. The command is run on the
-        target device every retry and evaluated against the
-        I(wait_for) conditions.
-    default: 10
-  interval:
-    description:
-      - Configures the interval in seconds to wait between retries
-        of the command. If the command does not pass the specified
-        conditions, the interval indicates how long to wait before
-        trying the command again.
-    default: 1
-"""
-
-EXAMPLES = r"""
-tasks:
-  - name: run show version on remote devices
-    ios_command:
-      commands: show version
-
-  - name: run show version and check to see if output contains IOS
-    ios_command:
-      commands: show version
-      wait_for: result[0] contains IOS
-
-  - name: run multiple commands on remote nodes
-    ios_command:
-      commands:
-        - show version
-        - show interfaces
-
-  - name: run multiple commands and evaluate the output
-    ios_command:
-      commands:
-        - show version
-        - show interfaces
-      wait_for:
-        - result[0] contains IOS
-        - result[1] contains Loopback0
-  - name: run commands that require answering a prompt
-    ios_command:
-      commands:
-        - command: 'clear counters GigabitEthernet0/1'
-          prompt: 'Clear "show interface" counters on this interface \[confirm\]'
-          answer: 'y'
-        - command: 'clear counters GigabitEthernet0/2'
-          prompt: '[confirm]'
-          answer: "\r"
-"""
-
-RETURN = """
-stdout:
-  description: The set of responses from the commands
-  returned: always apart from low level errors (such as action plugin)
-  type: list
-  sample: ['...', '...']
-stdout_lines:
-  description: The value of stdout split into a list
-  returned: always apart from low level errors (such as action plugin)
-  type: list
-  sample: [['...', '...'], ['...'], ['...']]
-failed_conditions:
-  description: The list of conditionals that have failed
-  returned: failed
-  type: list
-  sample: ['...', '...']
-"""
-import re
-import time
-
-from ansible.module_utils.network.ios.ios import run_commands
-from ansible.module_utils.network.ios.ios import ios_argument_spec, check_args
-from ansible.module_utils.basic import AnsibleModule
-from ansible.module_utils.network.common.utils import ComplexList
-from ansible.module_utils.network.common.parsing import Conditional
-from ansible.module_utils.six import string_types
-
-
-def to_lines(stdout):
-    for item in stdout:
-        if isinstance(item, string_types):
-            item = str(item).split('\n')
-        yield item
-
-
-def parse_commands(module, warnings):
-    command = ComplexList(dict(
-        command=dict(key=True),
-        prompt=dict(),
-        answer=dict()
-    ), module)
-    commands = command(module.params['commands'])
-    for item in list(commands):
-        configure_type = re.match(r'conf(?:\w*)(?:\s+(\w+))?', item['command'])
-        if module.check_mode:
-            if configure_type and configure_type.group(1) not in ('confirm', 'replace', 'revert', 'network'):
-                module.fail_json(
-                    msg='ios_command does not support running config mode '
-                        'commands.  Please use ios_config instead'
-                )
-    return commands
-
-
-def main():
-    """main entry point for module execution
-    """
-    argument_spec = dict(
-        commands=dict(type='list', required=True),
-
-        wait_for=dict(type='list', aliases=['waitfor']),
-        match=dict(default='all', choices=['all', 'any']),
-
-        retries=dict(default=10, type='int'),
-        interval=dict(default=1, type='int')
-    )
-
-    argument_spec.update(ios_argument_spec)
-
-    module = AnsibleModule(argument_spec=argument_spec,
-                           supports_check_mode=True)
-
-    result = {'changed': False}
-
-    warnings = list()
-    check_args(module, warnings)
-    commands = parse_commands(module, warnings)
-    result['warnings'] = warnings
-
-    wait_for = module.params['wait_for'] or list()
-    conditionals = [Conditional(c) for c in wait_for]
-
-    retries = module.params['retries']
-    interval = module.params['interval']
-    match = module.params['match']
-
-    while retries > 0:
-        responses = run_commands(module, commands)
-
-        for item in list(conditionals):
-            if item(responses):
-                if match == 'any':
-                    conditionals = list()
-                    break
-                conditionals.remove(item)
-
-        if not conditionals:
-            break
-
-        time.sleep(interval)
-        retries -= 1
-
-    if conditionals:
-        failed_conditions = [item.raw for item in conditionals]
-        msg = 'One or more conditional statements have not been satisfied'
-        module.fail_json(msg=msg, failed_conditions=failed_conditions)
-
-    result.update({
-        'changed': False,
-        'stdout': responses,
-        'stdout_lines': list(to_lines(responses))
-    })
-
-    module.exit_json(**result)
-
-
-if __name__ == '__main__':
-    main()

roles/ansible-network.cisco_ios/library/ios_user_manager.py

@@ -1,48 +0,0 @@
-#!/usr/bin/python
-# -*- coding: utf-8 -*-
-
-# Copyright 2018 Red Hat
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-
-from __future__ import absolute_import, division, print_function
-__metaclass__ = type
-
-
-ANSIBLE_METADATA = {'metadata_version': '1.1',
-                    'status': ['preview'],
-                    'supported_by': 'network'}
-
-
-DOCUMENTATION = '''
----
-module: ios_user_manager
-short_description: Manage an aggregate of users in IOS device(s)
-description:
-    - Allows the `cisco_ios` provider role to manage aggregate of users
-      by providing idempotency and other utility functions while running
-      the `configure_user` task
-version_added: "2.7"
-options:
-  new_users:
-    description:
-      - Aggregate of local users to be configured on IOS device(s)
-    required: true
-  user_config:
-    description:
-      - User config lines extracted from the devices' running-configuration
-    required: true
-author:
-  - Nilashish Chakraborty (@NilashishC)
-'''
-RETURN = """
-stdout:
-  description: Filtered set of users that should be configured on the device
-  returned: always apart from low-level errors (such as action plugin)
-  type: list
-  sample: [{"name": "ansible", "privilege": 15}, {"name": "test_user", "privilege": 15, "view": "sh_int"}]
-"""
-EXAMPLES = '''
-- ios_user_manager:
-    new_users: "{{ users }}"
-    user_config: "{{ existing_user_config.stdout }}"
-'''

roles/ansible-network.cisco_ios/meta/.galaxy_install_info

@@ -1 +0,0 @@
-{install_date: 'Thu May  2 18:46:21 2019', version: v2.7.1}

roles/ansible-network.cisco_ios/meta/main.yml

@@ -1,41 +0,0 @@
----
-galaxy_info:
-  author: Ansible Network Community (ansible-network)
-  description: |
-    This role provides an implementation for automating the configuration of
-    Cisco IOS/IOS-XE devices.  It provides implementations of Ansible Network
-    configuration abstractions.
-  company: Ansible
-
-  license: GPLv3
-
-  min_ansible_version: 2.7
-
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
-
-  # Optionally specify the branch Galaxy will use when accessing the GitHub
-  # repo for this role. During role install, if no tags are available,
-  # Galaxy will use this branch. During import Galaxy will access files on
-  # this branch. If Travis integration is configured, only notifications for this
-  # branch will be accepted. Otherwise, in all cases, the repo's default branch
-  # (usually master) will be used.
-  # github_branch:
-
-  #
-  # platforms is a list of platforms, and each platform has a name and a list of versions.
-  #
-  platforms:
-    - name: ios
-      version:
-        - any
-
-  galaxy_tags:
-    - network
-    - cisco
-    - ios
-    - iosxe
-
-dependencies:
-  - src: ansible-network.network-engine
-    version: v2.7.3

roles/ansible-network.cisco_ios/parser_templates/cli/show_cdp_neighbors_detail.yaml

@@ -1,51 +0,0 @@
----
-- name: parser meta data
-  parser_metadata:
-    version: 1.0
-    command: show cdp neighbors detail
-    network_os: ios
-
-- name: match sections
-  pattern_match:
-    regex: "^-----.*"
-    match_all: true
-    match_greedy: true
-  register: context
-
-- name: parse cdp neighbors
-  pattern_group:
-    - name: parse local port
-      pattern_match:
-        regex: '^Interface: ([^,]*)'
-        content: "{{ item }}"
-      register: local_port
-
-    - name: parse remote prort
-      pattern_match:
-        regex: 'Port ID \(outgoing port\): (.*)$'
-        content: "{{ item }}"
-      register: remote_port
-
-    - name: parse remote host
-      pattern_match:
-        regex: 'Device ID: (.*)$'
-        content: "{{ item }}"
-      register: remote_host
-
-  loop: "{{ context }}"
-  register: matches
-
-- name: build cdp neighbor facts
-  loop: "{{ matches }}"
-  register: cdp
-  export: true
-  export_as: dict
-  extend: "{{ toplevel | default('cisco_ios') }}"
-  json_template:
-    template:
-      - key: "{{ item.local_port.matches.0  | expand_interface_name }}"
-        object:
-          - key: neighbor
-            value: "{{ item.remote_host.matches.0 }}"
-          - key: neighbor_port
-            value: "{{ item.remote_port.matches.0 }}"

roles/ansible-network.cisco_ios/parser_templates/cli/show_interfaces.yaml

@@ -1,119 +0,0 @@
----
-- name: parser meta data
-  parser_metadata:
-    version: 1.0
-    command: show interfaces
-    network_os: ios
-
-- name: match sections
-  pattern_match:
-    regex: "^\\S+ is (up|down|administratively down),"
-    match_all: true
-    match_greedy: true
-  register: context
-
-- name: match interface values
-  pattern_group:
-    - name: match name
-      pattern_match:
-        regex: "^(\\S+)"
-        content: "{{ item }}"
-      register: name
-
-    - name: match hardware
-      pattern_match:
-        regex: "Hardware is (.*(?=,)|.*)"
-        content: "{{ item }}"
-      register: type
-
-    - name: match mtu
-      pattern_match:
-        regex: "MTU (\\d+)"
-        content: "{{ item }}"
-      register: mtu
-
-    - name: match interface description
-      pattern_match:
-        regex: "Description: (.+)"
-        content: "{{ item }}"
-      register: description
-
-    - name: match administrative state
-      pattern_match:
-        regex: "(administratively down)"
-        content: "{{ item }}"
-      register: enabled
-
-    - name: match line protocol
-      pattern_match:
-        regex: "line protocol is (\\S+)"
-        content: "{{ item }}"
-      register: operstatus
-
-    - name: match in packets
-      pattern_match:
-        regex: "(\\d+) packets input, (\\d+)"
-        content: "{{ item }}"
-      register: in_pkts_octets
-
-    - name: match input broadcast
-      pattern_match:
-        regex: "Received (\\d+) broadcasts \\(\\d+"
-        content: "{{ item }}"
-      register: in_bcast_mcast
-
-    - name: match out packets
-      pattern_match:
-        regex: "(\\d+) packets output, (\\d+) bytes"
-        content: "{{ item }}"
-      register: out_pkts_octets
-
-    - name: match out errors
-      pattern_match:
-        regex: "(\\d+) output errors"
-        content: "{{ item }}"
-      register: out_errors
-
-  loop: "{{ context }}"
-  register: values
-
-- name: template interface values
-  loop: "{{ values }}"
-  register: interfaces
-  export: true
-  export_as: dict
-  extend: cisco_ios
-  json_template:
-    template:
-      - key: "{{ item.name.matches.0 }}"
-        object:
-          - key: name
-            value: "{{ item.name.matches.0 }}"
-          - key: type
-            value: "{{ item.type.matches.0 }}"
-          - key: mtu
-            value: "{{ item.mtu.matches.0 }}"
-          - key: description
-            value: "{{ item.description.matches.0 }}"
-          - key: enabled
-            value: "{{ item.enabled.matches.0 is undefined }}"
-          - key: admin-status
-            value: "{{ item.enabled.matches.0 is undefined | ternary ('enabled', 'disabled') }}"
-          - key: oper-status
-            value: "{{ item.operstatus.matches.0 }}"
-          - key: counters
-            object:
-              - key: in-octets
-                value: "{{ item.in_pkts_octets.matches.0 }}"
-              - key: in-unicast-pkts
-                value: "{{ item.in_pkts_octets.matches.1 }}"
-              - key: in-broadcast-pkts
-                value: "{{ item.in_bcast_mcast.matches.0 }}"
-              - key: in-multicast-pkts
-                value: "{{ item.in_bcast_mcast.matches.1 }}"
-              - key: out-octets
-                value: "{{ item.out_pkts_octets.matches.0 }}"
-              - key: out-unicast-pkts
-                value: "{{ item.out_pkts_octets.matches.1 }}"
-              - key: out-errors
-                value: "{{ item.out_errors.matches.0 }}"