feat(mattermost): add mattermost bootstrap — role, BoxTemplate, catalog_try

.ansible-lint

@@ -0,0 +1,46 @@
+profile: basic
+
+skip_list:
+  # SCREAMING_SNAKE is the documented convention for infrastructure-wide vars
+  - var-naming[pattern]
+  # dot-notation role naming is the documented convention (e.g. software.install.wazuh)
+  - role-name
+  # dot-notation roles produce nonsensical prefix requirements
+  - var-naming[no-role-prefix]
+  # pre-existing task naming convention: lowercase names throughout catalog
+  - name[casing]
+  # large legacy codebase: hundreds of unnamed tasks, out of scope for CI hardening
+  - name[missing]
+  # plays in catalog bundles do not require names
+  - name[play]
+  # Jinja template syntax in task names is intentional
+  - name[template]
+  # cosmetic key ordering; pre-existing throughout catalog
+  - key-order[task]
+  # partial become (become without become_user) is pre-existing throughout catalog
+  - partial-become[task]
+  # octal file permission values are intentional (e.g. 0644, 0755)
+  - yaml[octal-values]
+  # pre-existing shell usage throughout catalog — all cases are intentional
+  - command-instead-of-shell
+  # pre-existing free-form module calls throughout catalog
+  - no-free-form
+  # pre-existing {{ var}} spacing in catalog roles — cosmetic only
+  - jinja[spacing]
+
+warn_list:
+  - yaml[line-length]
+  - yaml[truthy]
+  - yaml[trailing-spaces]
+  - yaml[empty-lines]
+  - yaml[new-line-at-end-of-file]
+  - yaml[colons]
+  - yaml[comments]
+  - yaml[indentation]
+  - risky-shell-pipe
+
+# catalog roles that reference themselves in test.yml or cross-repo roles not checked out in CI
+mock_roles:
+  - soft.install.warmup.local_bin
+  - software.install.dotFiles
+  - system.checks.overview

.ansible/roles/software.install.dotFiles/tasks/main.yml

@@ -0,0 +1 @@
+---

.ansible/roles/system.checks.overview/tasks/main.yml

@@ -0,0 +1 @@
+---

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    labels: [dependencies, ci]

.github/workflows/ci.yml

@@ -0,0 +1,17 @@
+name: CI
+on:
+  push:
+    branches: [main, dev, 'feat/**', 'fix/**']
+  pull_request:
+    branches: [main, dev]
+jobs:
+  ansible-lint:
+    name: Ansible Lint
+    runs-on: ubuntu-latest
+    container:
+      image: python:3.13-slim
+    steps:
+      - run: apt-get update && apt-get install -y --no-install-recommends git
+      - uses: actions/checkout@v4
+      - run: pip install --no-cache-dir ansible-lint
+      - run: ansible-lint 02_ansible_layer/

.gitignore

@@ -3,5 +3,6 @@
 notes
 CLAUDE.md
 **/CLAUDE.md
+.claude/
 **/.env
 !**/.env.example

01_image_layer/debian_trixie/v1.0.0/image.yml

@@ -0,0 +1,12 @@
+id: debian_trixie
+api_version: 1
+distro: debian
+codename: trixie
+description: Debian 13 (Trixie)
+cloud_image:
+  url: "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-amd64.raw"
+  filename: "debian-13-genericcloud-amd64.img"
+proxmox_templates:
+  - {vm_id: 9321, vm_name: "template-vm-debian-trixie-small",  spec: "1cpu/4gb/32gb"}
+  - {vm_id: 9331, vm_name: "template-vm-debian-trixie-medium", spec: "2cpu/8gb/64gb"}
+  - {vm_id: 9341, vm_name: "template-vm-debian-trixie-large",  spec: "4cpu/16gb/500gb"}

01_image_layer/ubuntu_noble/v1.0.0/image.yml

@@ -0,0 +1,21 @@
+id: ubuntu_noble
+api_version: 1
+distro: ubuntu
+codename: noble
+description: Ubuntu 24.04 LTS (Noble Numbat)
+cloud_image:
+  url: "https://cloud-images.ubuntu.com/minimal/daily/noble/current/noble-minimal-cloudimg-amd64.img"
+  filename: "noble-minimal-cloudimg-amd64.img"
+proxmox_templates:
+  - {vm_id: 9901, vm_name: "template-vm-ubuntu-noble-nano",             spec: "1cpu/1gb/16gb"}
+  - {vm_id: 9211, vm_name: "template-vm-ubuntu-noble-micro-01-2g-24g",  spec: "1cpu/2gb/24gb"}
+  - {vm_id: 9212, vm_name: "template-vm-ubuntu-noble-micro-02-2g-24g",  spec: "1cpu/2gb/24gb"}
+  - {vm_id: 9221, vm_name: "template-vm-ubuntu-noble-small-01-4g-32g",  spec: "1cpu/4gb/32gb"}
+  - {vm_id: 9222, vm_name: "template-vm-ubuntu-noble-small-02-4g-32g",  spec: "1cpu/4gb/32gb"}
+  - {vm_id: 9224, vm_name: "template-vm-ubuntu-noble-small-04-4g-32g",  spec: "1cpu/4gb/32gb"}
+  - {vm_id: 9232, vm_name: "template-vm-ubuntu-noble-medium-02-8g-64g", spec: "2cpu/8gb/64gb"}
+  - {vm_id: 9234, vm_name: "template-vm-ubuntu-noble-medium-04-8g-64g", spec: "4cpu/8gb/64gb"}
+  - {vm_id: 9236, vm_name: "template-vm-ubuntu-noble-medium-06-8g-64g", spec: "6cpu/8gb/64gb"}
+  - {vm_id: 9244, vm_name: "template-vm-ubuntu-noble-large-04-8g-64g",  spec: "4cpu/8gb/64gb"}
+  - {vm_id: 9246, vm_name: "template-vm-ubuntu-noble-large-06-8g-64g",  spec: "6cpu/8gb/64gb"}
+  - {vm_id: 9248, vm_name: "template-vm-ubuntu-noble-large-08-8g-64g",  spec: "8cpu/8gb/64gb"}

01_image_layer/ubuntu_resolute/v1.0.0/image.yml

@@ -0,0 +1,21 @@
+id: ubuntu_resolute
+api_version: 1
+distro: ubuntu
+codename: resolute
+description: Ubuntu 26.04 LTS (Resolute Raccoon)
+cloud_image:
+  url: "https://cloud-images.ubuntu.com/minimal/daily/resolute/current/resolute-minimal-cloudimg-amd64.img"
+  filename: "resolute-minimal-cloudimg-amd64.img"
+proxmox_templates:
+  - {vm_id: 9501, vm_name: "template-vm-ubuntu-resolute-nano",              spec: "1cpu/1gb/16gb"}
+  - {vm_id: 9511, vm_name: "template-vm-ubuntu-resolute-micro-01-2g-24g",   spec: "1cpu/2gb/24gb"}
+  - {vm_id: 9512, vm_name: "template-vm-ubuntu-resolute-micro-02-2g-24g",   spec: "1cpu/2gb/24gb"}
+  - {vm_id: 9521, vm_name: "template-vm-ubuntu-resolute-small-01-4g-32g",   spec: "1cpu/4gb/32gb"}
+  - {vm_id: 9522, vm_name: "template-vm-ubuntu-resolute-small-02-4g-32g",   spec: "1cpu/4gb/32gb"}
+  - {vm_id: 9524, vm_name: "template-vm-ubuntu-resolute-small-04-4g-32g",   spec: "1cpu/4gb/32gb"}
+  - {vm_id: 9532, vm_name: "template-vm-ubuntu-resolute-medium-02-8g-64g",  spec: "2cpu/8gb/64gb"}
+  - {vm_id: 9534, vm_name: "template-vm-ubuntu-resolute-medium-04-8g-64g",  spec: "4cpu/8gb/64gb"}
+  - {vm_id: 9536, vm_name: "template-vm-ubuntu-resolute-medium-06-8g-64g",  spec: "6cpu/8gb/64gb"}
+  - {vm_id: 9544, vm_name: "template-vm-ubuntu-resolute-large-04-8g-64g",   spec: "4cpu/8gb/64gb"}
+  - {vm_id: 9546, vm_name: "template-vm-ubuntu-resolute-large-06-8g-64g",   spec: "6cpu/8gb/64gb"}
+  - {vm_id: 9548, vm_name: "template-vm-ubuntu-resolute-large-08-8g-64g",   spec: "8cpu/8gb/64gb"}

02_ansible_layer/admin/roles/software.configure.apt_mirror_client/defaults/main.yml

@@ -0,0 +1,18 @@
+---
+# defaults file
+apt_mirror_enabled: false
+apt_proxy_url: ""
+apt_mirror_airgapped: false
+apt_mirror_vm_ip: ""
+apt_mirror_http_port: 80
+# Wait parameters — used only in airgapped (mirror) mode.
+# apt-mirror prewarm runs async on the server; clients poll until the Release
+# file is accessible before proceeding with apt update.
+apt_mirror_wait_retries: 360
+apt_mirror_wait_delay: 30
+# Set to true only if backports are included in the mirror (apt_mirror_backports: true on server).
+# When false (default), the backports suite is stripped from apt sources in airgapped mode.
+apt_mirror_backports: false
+# Must match apt_mirror_ubuntu_components on the mirror server.
+# The client strips any components not listed here from ubuntu.sources in airgapped mode.
+apt_mirror_ubuntu_components: "main restricted universe"

02_ansible_layer/admin/roles/software.configure.apt_mirror_client/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+# handlers file
+
+- name: update apt cache
+  ansible.builtin.apt:
+    update_cache: true
+  become: true

02_ansible_layer/admin/roles/software.configure.apt_mirror_client/meta/main.yml

@@ -0,0 +1 @@
+---

02_ansible_layer/admin/roles/software.configure.apt_mirror_client/tasks/main.yml

@@ -0,0 +1,149 @@
+---
+# tasks file
+
+- name: client - assert apt_mirror_vm_ip is set in airgapped mode
+  ansible.builtin.assert:
+    that: apt_mirror_vm_ip | length > 0
+    fail_msg: "apt_mirror_vm_ip must be set when apt_mirror_airgapped is true"
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - apt_mirror_airgapped | default(false) | bool
+
+- name: client - set effective mirror URL (airgapped)
+  ansible.builtin.set_fact:
+    _apt_effective_url: "http://{{ apt_mirror_vm_ip }}:{{ apt_mirror_http_port }}"
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - apt_mirror_airgapped | default(false) | bool
+
+- name: client - set effective mirror URL (proxy)
+  ansible.builtin.set_fact:
+    _apt_effective_url: "{{ apt_proxy_url }}"
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - not apt_mirror_airgapped | default(false) | bool
+
+- name: client - wait for mirror Release file to be accessible
+  ansible.builtin.uri:
+    url: >-
+      {%- if ansible_distribution == 'Debian' -%}
+        {{ _apt_effective_url }}/deb.debian.org/debian/dists/{{ ansible_distribution_release }}/InRelease
+      {%- elif 'universe' in apt_mirror_ubuntu_components -%}
+        {{ _apt_effective_url }}/archive.ubuntu.com/ubuntu/dists/{{ ansible_distribution_release }}/universe/binary-amd64/Packages
+      {%- else -%}
+        {{ _apt_effective_url }}/archive.ubuntu.com/ubuntu/dists/{{ ansible_distribution_release }}/InRelease
+      {%- endif -%}
+    method: GET
+    status_code: 200
+    timeout: 10
+  register: _apt_mirror_release_check
+  until: _apt_mirror_release_check.status == 200
+  retries: "{{ apt_mirror_wait_retries }}"
+  delay: "{{ apt_mirror_wait_delay }}"
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - apt_mirror_airgapped | default(false) | bool
+    - _apt_effective_url is defined
+    - ansible_distribution in ["Debian", "Ubuntu"]
+
+- name: client - remove backports suite from apt sources (not mirrored)
+  ansible.builtin.replace:
+    path: /etc/apt/sources.list.d/debian.sources
+    regexp: '(Suites:.*)[ \t]+{{ ansible_distribution_release }}-backports'
+    replace: '\1'
+  become: true
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - apt_mirror_airgapped | default(false) | bool
+    - not apt_mirror_backports | default(false) | bool
+    - ansible_distribution == "Debian"
+
+- name: client - remove backports suite from ubuntu apt sources (not mirrored)
+  ansible.builtin.replace:
+    path: /etc/apt/sources.list.d/ubuntu.sources
+    regexp: '(Suites:.*)[ \t]+{{ ansible_distribution_release }}-backports'
+    replace: '\1'
+  become: true
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - apt_mirror_airgapped | default(false) | bool
+    - not apt_mirror_backports | default(false) | bool
+    - ansible_distribution == "Ubuntu"
+
+- name: client - restrict ubuntu apt components to mirrored set
+  ansible.builtin.replace:
+    path: /etc/apt/sources.list.d/ubuntu.sources
+    regexp: '^Components:.*$'
+    replace: 'Components: {{ apt_mirror_ubuntu_components }}'
+  become: true
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - apt_mirror_airgapped | default(false) | bool
+    - ansible_distribution == "Ubuntu"
+
+- name: client - remove old proxy apt.conf.d files
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  become: true
+  loop:
+    - /etc/apt/apt.conf.d/00range42-proxy
+    - /etc/apt/apt.conf.d/01-r42-bootstrap-block
+    - /etc/apt/apt.conf.d/01proxy
+  when: apt_mirror_enabled | default(false) | bool
+
+- name: client - rewrite debian mirror list
+  ansible.builtin.copy:
+    content: "{{ _apt_effective_url }}/deb.debian.org/debian\n"
+    dest: /etc/apt/mirrors/debian.list
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  notify: update apt cache
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - _apt_effective_url is defined
+    - _apt_effective_url | length > 0
+    - ansible_distribution == "Debian"
+
+- name: client - rewrite debian-security mirror list
+  ansible.builtin.copy:
+    content: "{{ _apt_effective_url }}/security.debian.org/debian-security\n"
+    dest: /etc/apt/mirrors/debian-security.list
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  notify: update apt cache
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - _apt_effective_url is defined
+    - _apt_effective_url | length > 0
+    - ansible_distribution == "Debian"
+
+- name: client - rewrite ubuntu archive URI
+  ansible.builtin.replace:
+    path: /etc/apt/sources.list.d/ubuntu.sources
+    regexp: 'http://archive\.ubuntu\.com/ubuntu'
+    replace: "{{ _apt_effective_url }}/archive.ubuntu.com/ubuntu"
+  become: true
+  notify: update apt cache
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - _apt_effective_url is defined
+    - _apt_effective_url | length > 0
+    - ansible_distribution == "Ubuntu"
+
+- name: client - rewrite ubuntu security URI
+  ansible.builtin.replace:
+    path: /etc/apt/sources.list.d/ubuntu.sources
+    regexp: 'http://security\.ubuntu\.com/ubuntu'
+    replace: "{{ _apt_effective_url }}/security.ubuntu.com/ubuntu"
+  become: true
+  notify: update apt cache
+  when:
+    - apt_mirror_enabled | default(false) | bool
+    - _apt_effective_url is defined
+    - _apt_effective_url | length > 0
+    - ansible_distribution == "Ubuntu"

02_ansible_layer/admin/roles/software.configure.apt_mirror_client/templates/01-apt-proxy.conf.j2

@@ -0,0 +1,5 @@
+Acquire::http::Proxy "http://{{ apt_proxy_url }}:{{ apt_mirror_port }}/";
+Acquire::https::Proxy "DIRECT";
+{% if apt_mirror_fallback %}
+Acquire::http::ConnectTimeout "{{ apt_mirror_connect_timeout }}";
+{% endif %}

02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/ubuntu/deploy.yml → 02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/debian-based/deploy.yml

@@ -9,7 +9,7 @@
       apt:
         name: rsync
         state: present
         update_cache: yes
 
     #
     - name: DEPLOY DOCKER FILES  - CREATE TMP DIR
@@ -26,7 +26,7 @@
       synchronize:
         src: "{{ LOCAL__PROJECT_DIR }}/"
         dest: "{{ REMOTE_PROJECT_DIR }}/"
         recursive: yes
         rsync_opts:
           - "--exclude=poc/"
           - "-e ssh --info=progress2"
@@ -39,7 +39,7 @@
       synchronize:
         src: "{{ LOCAL__PROJECT_DIR }}/"
         dest: "{{ REMOTE_PROJECT_DIR }}/"
         recursive: yes
         rsync_opts:
           - "-e ssh --info=progress2"
       delegate_to: localhost
@@ -51,10 +51,18 @@
   block:
     #
     #
+    # Retry on transient failures (intermittent registry/mirror anycast timeouts
+    # pulling images are common on egress-filtered ranges). `up` is idempotent,
+    # so re-running resumes the pull. A persistent failure still surfaces after
+    # the retries are exhausted.
     - name: DOCKER - DOCKER-COMPOSE - RUN
       community.docker.docker_compose_v2:
         project_src: "{{ REMOTE_PROJECT_DIR }}"
         state: present
+      register: compose_run
+      until: compose_run is succeeded
+      retries: 5
+      delay: 20
     #
     - name: DOCKER - GET CONTAINER INFO {{ LABEL_PROJET_NAME }}
       community.docker.docker_container_info:

02_ansible_layer/admin/roles/software.configure.docker-compose/tasks/main.yml

@@ -7,8 +7,10 @@
   ansible.builtin.setup:
 
 #
-- name: INCLUDE - ufw tasks - ubuntu
-  ansible.builtin.include_tasks: ./ubuntu/deploy.yml
-  when: ansible_facts['distribution'] == "Ubuntu"
+# Tasks in ./debian-based/deploy.yml are apt/rsync based, so they run on every
+# Debian-family host (Ubuntu + Debian).
+- name: INCLUDE - deploy tasks - debian-based
+  ansible.builtin.include_tasks: ./debian-based/deploy.yml
+  when: ansible_facts['distribution'] in ['Ubuntu', 'Debian']
 
   #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### ####

02_ansible_layer/admin/roles/software.configure.firewalls/tasks/main.yml

@@ -11,8 +11,8 @@
   when: ansible_facts['distribution'] == "Fedora"
 
 #
-- name: INCLUDE - ufw tasks - ubuntu
-  ansible.builtin.include_tasks: ./ubuntu/ufw.yml
-  when: ansible_facts['distribution'] == "Ubuntu"
+- name: INCLUDE - ufw tasks - debian-based
+  ansible.builtin.include_tasks: ./debian-based/ufw.yml
+  when: ansible_facts['distribution'] in ['Ubuntu', 'Debian']
 
   #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### ####

02_ansible_layer/admin/roles/software.install.apt_cacher_ng/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+# defaults file
+apt_cacher_port: 3142
+apt_cacher_passthrough: true
+apt_cacher_cache_dir: /var/cache/apt-cacher-ng
+apt_cacher_log_dir: /var/log/apt-cacher-ng
+apt_cacher_bind_address: "0.0.0.0"

02_ansible_layer/admin/roles/software.install.apt_cacher_ng/handlers/main.yml

@@ -0,0 +1,8 @@
+---
+# handlers file
+
+- name: restart apt-cacher-ng
+  ansible.builtin.systemd:
+    name: apt-cacher-ng
+    state: restarted
+  become: true

02_ansible_layer/admin/roles/software.install.apt_cacher_ng/meta/main.yml

@@ -0,0 +1 @@
+---