feat(scenarios): add test_mattermost scenario (vm_ids 1003/3003, port 8065)

.ansible-lint

@@ -0,0 +1,47 @@
+profile: basic
+
+skip_list:
+  # SCREAMING_SNAKE is the documented convention for infrastructure-wide vars
+  - var-naming[pattern]
+  # noun.verb role naming is the documented convention
+  - role-name
+  # generated scenario playbooks do not require play-level names
+  - name[play]
+  # pre-existing task naming convention: lowercase names throughout bundles
+  - name[casing]
+  # generated bundles include tasks without explicit names
+  - name[missing]
+  # Jinja template syntax in task names is intentional (loop items, vars)
+  - name[template]
+  # pre-existing {{ item.ID}} spacing in generated bundles — cosmetic only
+  - jinja[spacing]
+
+warn_list:
+  - yaml[line-length]
+  - yaml[empty-lines]
+  - yaml[trailing-spaces]
+  - risky-shell-pipe
+
+# catalog and cross-repo roles not checked out in CI — stub so syntax-check passes
+mock_roles:
+  - range42-ansible_roles-proxmox_controller
+  - ansible.utils
+  - indexer
+  - software.configure.docker-compose
+  - software.configure.firewalls
+  - software.configure.tailscale_disable_nftables
+  - software.install.nodejs_app_systemd
+  - software.install.symlinks_farm
+  - software.install.tailscale
+  - software.install.warmup.basic_packages
+  - software.install.warmup.dot_files
+  - software.install.wazuh-dashboard
+  - software.install.wazuh-filebeat-oss
+  - software.install.wazuh-indexer
+  - software.install.wazuh-manager
+  - systems.configure.add_user
+  - software.install.wazuh-agent
+
+# vars defined at runtime via inventory/group_vars — stub for CI syntax-check
+extra_vars:
+  global_vm_ssh_name: ci_mock

.ansible/roles/software.configure.firewalls/tasks/main.yml

@@ -0,0 +1 @@
+---

.ansible/roles/software.configure.tailscale_disable_nftables/tasks/main.yml

@@ -0,0 +1 @@
+---

.ansible/roles/software.install.nodejs_app_systemd/tasks/main.yml

@@ -0,0 +1 @@
+---

.ansible/roles/software.install.symlinks_farm/tasks/main.yml

@@ -0,0 +1 @@
+---

.ansible/roles/software.install.tailscale/tasks/main.yml

@@ -0,0 +1 @@
+---

.ansible/roles/systems.configure.add_user/tasks/main.yml

@@ -0,0 +1 @@
+---

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    labels: [dependencies]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    labels: [dependencies, ci]

.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+on:
+  push:
+    branches: [main, dev, 'feat/**', 'fix/**']
+  pull_request:
+    branches: [main, dev]
+jobs:
+  ansible-lint:
+    name: Ansible Lint
+    runs-on: ubuntu-latest
+    container:
+      image: python:3.13-slim
+    steps:
+      - run: apt-get update && apt-get install -y --no-install-recommends git
+      - uses: actions/checkout@v6
+      - run: pip install --no-cache-dir ansible-lint
+      - run: ansible-lint bundles/
+
+  python:
+    name: Ruff + Pytest
+    runs-on: ubuntu-latest
+    container:
+      image: python:3.13-slim
+    steps:
+      - run: apt-get update && apt-get install -y --no-install-recommends git
+      - uses: actions/checkout@v6
+      - id: pycheck
+        run: test -f pyproject.toml && echo "exists=true" >> "$GITHUB_OUTPUT" || echo "exists=false" >> "$GITHUB_OUTPUT"
+      - if: "steps.pycheck.outputs.exists == 'true'"
+        run: pip install --no-cache-dir -e ".[dev]"
+      - if: "steps.pycheck.outputs.exists == 'true'"
+        run: ruff check --select ALL r42playbooks/
+      - if: "steps.pycheck.outputs.exists == 'true'"
+        run: pytest tests/ --tb=short -q

.gitignore

@@ -2,3 +2,23 @@
 **/secret/
 CLAUDE.md
 **/CLAUDE.md
+
+# Python (r42playbooks module)
+.venv/
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+dist/
+build/
+
+# Claude session files (local only — handoffs, design notes)
+.claude/
+
+# Scratch compiler artifacts (flat-workspace outputs, never committed)
+/topology.json
+/hosts.yml
+/expanded.json

bundles/core/linux/debian/README.md

@@ -0,0 +1,18 @@
+# bundles/core/linux/debian
+
+Debian-targeted **example bundles** for composing scenarios — the siblings of
+`../ubuntu/`.
+
+The warmup/configure roles (`software.install.warmup.*`, `software.configure.*`,
+`systems.configure.*`) dispatch per OS **at runtime** via
+`ansible_facts.distribution` (ubuntu / debian / fedora — see the catalog's
+`feat/local-apt-mirror`). Each bundle here therefore has the **same** `main.yml`
+as `../ubuntu/` (it runs `hosts: all` + the OS-agnostic role); only the `test.sh`
+target host differs (a Debian box, e.g. `r42.debian-jump-00`).
+
+Pair with the catalog `debian-jump` box template (`image: debian_trixie`,
+Debian 13) to deploy a Debian target these bundles can run against.
+
+> If the roles stay fully OS-agnostic, a future cleanup may collapse
+> `ubuntu/`+`debian/` into a single `linux/` set; kept split here to mirror the
+> existing layout.

bundles/core/linux/debian/configure/add-user/main.yml

@@ -0,0 +1,19 @@
+# Debian example bundle. The role self-detects the OS at runtime via
+# ansible_facts.distribution (ubuntu/debian/fedora), so this mirrors the
+# ubuntu/ bundle — it is the Debian-targeted invocation + test host.
+
+- name: add user 
+  hosts: all
+  become: true
+  roles:
+    - systems.configure.add_user 
+
+  vars:
+    #
+    # variables will be overwrited by values coming from API 
+    #
+    TARGET_USER: student 
+    TARGET_PASSWORD: "boj6q-uien3-ieda-h3Yiesi-li-uYi" # test password - will not be use in production. 
+    CHANGE_PWD_AT_LOGON: false
+    TARGET_SHELL_PATH: "/bin/sh"
+

bundles/core/linux/debian/configure/add-user/test.sh

@@ -0,0 +1,8 @@
+#!/bin/bash 
+
+# echo $TMP_RANGE42_ANSIBLE_INVENTORY_DIR ; exit 1 
+
+ansible-playbook -i "$TMP_RANGE42_ANSIBLE_INVENTORY_DIR/inventory_default.yml"  \
+	-l "r42.debian-jump-00" \
+    "./main.yml" \
+    --vault-password-file /tmp/vault/vault_pass.txt

bundles/core/linux/debian/install/basic-packages/main.yml

@@ -0,0 +1,35 @@
+# Debian example bundle. The role self-detects the OS at runtime via
+# ansible_facts.distribution (ubuntu/debian/fedora), so this mirrors the
+# ubuntu/ bundle — it is the Debian-targeted invocation + test host.
+
+#
+
+- name: install basics packages
+  hosts: all
+  become: true
+  roles:
+    # - software.install.warmup.dot_files
+    - software.install.warmup.basic_packages
+
+  #
+  # variables will be overwrited by values coming from API
+  #
+  vars:
+    # FOR - software.install.warmup.dot_files
+    # OPERATOR_USER: jane
+    # INSTALL_VIM_DOTFILES: "NO" # accept also true false
+    # INSTALL_ZSH_DOTFILES: "NO" # accept also true false
+
+    # FOR - software.install.warmup.basic_packages
+    INSTALL_PACKAGES_BASICS: "YES"
+    INSTALL_PACKAGES_FIREWALLS: "YES"
+    #
+    INSTALL_PACKAGES_DOCKER: "NO"
+    INSTALL_PACKAGES_DOCKER_COMPOSE: "NO"
+    #
+    INSTALL_PACKAGES_UTILS_JSON: "NO"
+    INSTALL_PACKAGES_UTILS_NETWORK: "NO"
+
+    INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES"
+
+    SPECIFIC_PACKAGES_CLEANING: "NO"

bundles/core/linux/debian/install/basic-packages/test.sh

@@ -0,0 +1,8 @@
+#!/bin/bash 
+
+# echo $TMP_RANGE42_ANSIBLE_INVENTORY_DIR ; exit 1 
+
+ansible-playbook -i "$TMP_RANGE42_ANSIBLE_INVENTORY_DIR/inventory_default.yml"  \
+	-l "r42.debian-jump-00" \
+    "./main.yml" \
+    --vault-password-file /tmp/vault/vault_pass.txt

bundles/core/linux/debian/install/docker-compose/main.yml

@@ -0,0 +1,35 @@
+# Debian example bundle. The role self-detects the OS at runtime via
+# ansible_facts.distribution (ubuntu/debian/fedora), so this mirrors the
+# ubuntu/ bundle — it is the Debian-targeted invocation + test host.
+
+#
+
+- name: install basics packages
+  hosts: all
+  become: true
+  roles:
+    # - software.install.warmup.dot_files
+    - software.install.warmup.basic_packages
+
+  #
+  # variables will be overwrited by values coming from API
+  #
+  vars:
+    # FOR - software.install.warmup.dot_files
+    # OPERATOR_USER: jane
+    # INSTALL_VIM_DOTFILES: "NO" # accept also true false
+    # INSTALL_ZSH_DOTFILES: "NO" # accept also true false
+
+    # FOR - software.install.warmup.basic_packages
+    INSTALL_PACKAGES_BASICS: "YES"
+    INSTALL_PACKAGES_FIREWALLS: "NO"
+    #
+    INSTALL_PACKAGES_DOCKER: "YES"
+    INSTALL_PACKAGES_DOCKER_COMPOSE: "YES"
+    #
+    INSTALL_PACKAGES_UTILS_JSON: "NO"
+    INSTALL_PACKAGES_UTILS_NETWORK: "NO"
+
+    INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES"
+
+    SPECIFIC_PACKAGES_CLEANING: "NO"

bundles/core/linux/debian/install/docker-compose/test.sh

@@ -0,0 +1,8 @@
+#!/bin/bash 
+
+# echo $TMP_RANGE42_ANSIBLE_INVENTORY_DIR ; exit 1 
+
+ansible-playbook -i "$TMP_RANGE42_ANSIBLE_INVENTORY_DIR/inventory_default.yml"  \
+	-l "r42.debian-jump-00" \
+    "./main.yml" \
+    --vault-password-file /tmp/vault/vault_pass.txt

bundles/core/linux/debian/install/docker/main.yml

@@ -0,0 +1,35 @@
+# Debian example bundle. The role self-detects the OS at runtime via
+# ansible_facts.distribution (ubuntu/debian/fedora), so this mirrors the
+# ubuntu/ bundle — it is the Debian-targeted invocation + test host.
+
+#
+
+- name: install basics packages
+  hosts: all
+  become: true
+  roles:
+    # - software.install.warmup.dot_files
+    - software.install.warmup.basic_packages
+
+  #
+  # variables will be overwrited by values coming from API
+  #
+  vars:
+    # FOR - software.install.warmup.dot_files
+    # OPERATOR_USER: jane
+    # INSTALL_VIM_DOTFILES: "NO" # accept also true false
+    # INSTALL_ZSH_DOTFILES: "NO" # accept also true false
+
+    # FOR - software.install.warmup.basic_packages
+    INSTALL_PACKAGES_BASICS: "YES"
+    INSTALL_PACKAGES_FIREWALLS: "NO"
+    #
+    INSTALL_PACKAGES_DOCKER: "YES"
+    INSTALL_PACKAGES_DOCKER_COMPOSE: "NO"
+    #
+    INSTALL_PACKAGES_UTILS_JSON: "NO"
+    INSTALL_PACKAGES_UTILS_NETWORK: "NO"
+
+    INSTALL_PACKAGES_NTP_AND_UPDATE_TIME: "YES"
+
+    SPECIFIC_PACKAGES_CLEANING: "NO"

bundles/core/linux/debian/install/docker/test.sh

@@ -0,0 +1,8 @@
+#!/bin/bash 
+
+# echo $TMP_RANGE42_ANSIBLE_INVENTORY_DIR ; exit 1 
+
+ansible-playbook -i "$TMP_RANGE42_ANSIBLE_INVENTORY_DIR/inventory_default.yml"  \
+	-l "r42.debian-jump-00" \
+    "./main.yml" \
+    --vault-password-file /tmp/vault/vault_pass.txt

bundles/core/linux/debian/install/dot-files/main.yml

@@ -0,0 +1,21 @@
+# Debian example bundle. The role self-detects the OS at runtime via
+# ansible_facts.distribution (ubuntu/debian/fedora), so this mirrors the
+# ubuntu/ bundle — it is the Debian-targeted invocation + test host.
+
+#
+
+- name: install dot files
+  hosts: all
+  become: true
+  roles:
+    - software.install.warmup.dot_files
+
+  vars:
+    #
+    # variables will be overwrited by values coming from API
+    #
+    OPERATOR_USER: jane
+    INSTALL_VIM_DOTFILES: "NO" # accept also true false
+    INSTALL_ZSH_DOTFILES: "NO" # accept also true false
+    #
+    APPLY_FOR_ROOT: "NO" # accept also true false

bundles/core/linux/debian/install/dot-files/test.sh

@@ -0,0 +1,8 @@
+#!/bin/bash 
+
+# echo $TMP_RANGE42_ANSIBLE_INVENTORY_DIR ; exit 1 
+
+ansible-playbook -i "$TMP_RANGE42_ANSIBLE_INVENTORY_DIR/inventory_default.yml"  \
+	-l "r42.debian-jump-00" \
+    "./main.yml" \
+    --vault-password-file /tmp/vault/vault_pass.txt

bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_api_devkit.yml

@@ -21,7 +21,7 @@
   vars_files:
     - "../../secrets/default_vault.yml"
 
-  vars:
+  vars: {}
     #
     # variables will be overwrited by values  in _main.yml
     #

bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/builder_docker_registry.yml

@@ -21,7 +21,7 @@
   vars_files:
     - "../../secrets/default_vault.yml"
 
-  vars:
+  vars: {}
     #
     # variables will be overwrited by values  in _main.yml
     #

bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_backend.yml

@@ -21,7 +21,7 @@
   vars_files:
     - "../../secrets/default_vault.yml"
 
-  vars:
+  vars: {}
     #
     # variables will be overwrited by values  in _main.yml
     #

bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_api_gateway.yml

@@ -21,7 +21,7 @@
   vars_files:
     - "../../secrets/default_vault.yml"
 
-  vars:
+  vars: {}
     #
     # variables will be overwrited by values  in _main.yml
     #

bundles/core/proxmox/configure/default/vms/create-vms-admin/stage_00/deployer_ui.yml

@@ -21,7 +21,7 @@
   vars_files:
     - "../../secrets/default_vault.yml"
 
-  vars:
+  vars: {}
     #
     # variables will be overwrited by values  in _main.yml
     #