feat(ansible): add corosync-qnetd role for NAS quorum

ansible/playbooks/corosync_qnetd/setup.yaml

@@ -0,0 +1,6 @@
+---
+- hosts: qnetd
+  name: Configure corosync-qnetd quorum device
+
+  roles:
+    - corosync_qnetd

ansible/playbooks/setup.yaml

@@ -4,3 +4,6 @@
 
 - name: Run bind9 setup playbook
   ansible.builtin.import_playbook: bind9/setup.yaml
+
+- name: Run corosync-qnetd setup playbook
+  ansible.builtin.import_playbook: corosync_qnetd/setup.yaml

ansible/roles/corosync_qnetd/defaults/main.yaml

@@ -0,0 +1,14 @@
+---
+# corosync-qnetd defaults
+
+# Network port for the qnetd daemon
+corosync_qnetd_port: 5403
+
+# NSS certificate database path
+corosync_qnetd_nss_db: /etc/corosync/qnetd/nssdb
+
+# Quorum algorithm: ffsplit (fifty-fifty split) is correct for 2-node clusters
+corosync_qnetd_algorithm: ffsplit
+
+# Firewall service name for high-availability (includes port 5403)
+corosync_qnetd_firewall_service: high-availability

ansible/roles/corosync_qnetd/handlers/main.yaml

@@ -0,0 +1,6 @@
+---
+- name: Restart corosync-qnetd
+  ansible.builtin.systemd:
+    name: corosync-qnetd
+    state: restarted
+    daemon_reload: true

ansible/roles/corosync_qnetd/tasks/main.yaml

@@ -0,0 +1,29 @@
+---
+- name: Install corosync-qnetd package
+  ansible.builtin.dnf:
+    name: corosync-qnetd
+    state: present
+
+- name: Open firewall for high-availability services (port {{ corosync_qnetd_port }})
+  ansible.posix.firewalld:
+    service: "{{ corosync_qnetd_firewall_service }}"
+    permanent: true
+    immediate: true
+    state: enabled
+
+- name: Check if NSS certificate database exists
+  ansible.builtin.stat:
+    path: "{{ corosync_qnetd_nss_db }}/cert9.db"
+  register: nss_db
+
+- name: Initialize NSS certificate database for qnetd
+  ansible.builtin.command: corosync-qnetd-certutil -i
+  when: not nss_db.stat.exists
+  changed_when: true
+  notify: Restart corosync-qnetd
+
+- name: Enable and start corosync-qnetd service
+  ansible.builtin.systemd:
+    name: corosync-qnetd
+    enabled: true
+    state: started

ansible/sample_inventory/qnetd.yaml

@@ -0,0 +1,6 @@
+---
+qnetd:
+  hosts:
+    qnetd-01.local.example.com:
+      ansible_user: mpeterson
+      ansible_become: true