feat: add software.install.kunai_official_workshop role

[hyde-repo]

feat: add software.install.kunai_official_workshop role

Umbrella: #178
Wave: WAVE_04 (since 2026-06-05)
Related / cross-repo: range42/range42-playbooks#115

Problem

The kunai_lab scenario needs the CIRCL Kunai workshop toolchain preinstalled on the
trainer + student VMs (yara, the pykunai command-line tools, the pinned kunai eBPF
binary, and the m2k-config.toml). There is no role for this yet.

Solution

Add the software.install.kunai_official_workshop role under
02_ansible_layer/admin/roles/. Turnkey install (nothing to configure by hand) :

• apt : yara, pipx (+ jq curl wget gnupg)
• pykunai via pipx as the operator user (kunai-search, kunai-iocgen,
  misp-to-kunai, kunai-to-misp, kunai-graph) + ~/.local/bin on the interactive PATH
• the pinned kunai eBPF binary, GPG-verified (key C0F6E8F2C1AB2799A31F416C0548A778D21D10AD),
  placed in /usr/local/bin/kunai (the play aborts if verification fails)
• m2k-config.toml (public CIRCL OSINT feed always on ; local [misp] block opt-in)
• a tmpfiles.d rule reseeding /tmp/m2k-config.toml on boot

It mirrors the upstream CIRCL VSS workshop. A future software.install.kunai role is
reserved for a clean production install of kunai, distinct from this workshop toolchain.

The role is invoked by the thin bundle
range42-playbooks/bundles/core/software.install.kunai_official_workshop/ (see #115).

Composable user-provisioning roles

The kunai_lab human-user model (a trainer account on the trainer VM, a per-VM student
account on each student VM, both sudo) is built at the scenario level from small, reusable
roles - no wizard or core change. This issue also covers the roles that model relies on :

• systems.configure.ssh_keypair - place a keypair (private + public) in a user's ~/.ssh
• systems.configure.authorized_keys - add / remove an entry in a user's authorized_keys
  (additive by default, never clobbers existing keys)
• systems.configure.sudo - enable / disable a validated /etc/sudoers.d drop-in, with or
  without NOPASSWD
• systems.configure.add_user (existing) - fix : manage the password through
  ansible.builtin.user (drop the chpasswd shell), add an update_password toggle

Each is generic (no kunai coupling) and reusable by any scenario. They are consumed by the
matching thin bundles in range42-playbooks (see #115).

Files

• 02_ansible_layer/admin/roles/software.install.kunai_official_workshop/
  (defaults/main.yml, tasks/main.yml + tasks/00..04, templates/m2k-config.toml.j2,
  meta/main.yml, README.md)
• 02_ansible_layer/admin/roles/systems.configure.ssh_keypair/
• 02_ansible_layer/admin/roles/systems.configure.authorized_keys/
• 02_ansible_layer/admin/roles/systems.configure.sudo/
• 02_ansible_layer/admin/roles/systems.configure.add_user/ (fix)

References

• Workshop : https://github.com/kunai-project/workshops (circl-vss-2025)
• kunai : https://github.com/kunai-project/kunai (v0.6.2)
• pykunai : https://github.com/kunai-project/pykunai (0.1.10)