feat(scenarios): add test_mattermost scenario

scenarios/demo_lab/02_admin_infrastructure/_main.yml

@@ -22,6 +22,7 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
 - import_playbook: ./stage_00/mon_wazuh.yml
+  when: INSTALL_WAZUH | default("YES") | upper == "YES"
 
   vars:
     global_vm_name: "admin-wazuh"
@@ -144,5 +145,6 @@
 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 
 - import_playbook: ./stage_01/mon_wazuh.yml
+  when: INSTALL_WAZUH | default("YES") | upper == "YES"
 #
 #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### ####

scenarios/demo_lab/02_admin_infrastructure/stage_01/_r42_admin.yml

@@ -95,7 +95,7 @@
       loop: "{{ tailscale_hostnames }}"
       loop_control:
         loop_var: tailscale_hostname
-      when: INSTALL_TAILSCALE == "YES"
+      when: INSTALL_TAILSCALE | upper == "YES"
 
 #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### ####
 
@@ -117,4 +117,4 @@
         - include_role:
             name: software.configure.tailscale_disable_nftables
 
-      when: INSTALL_TAILSCALE == "YES"
+      when: INSTALL_TAILSCALE | upper == "YES"

scenarios/demo_lab/03_student_infrastructure/stage_01/_r42_student_box_group.yml

@@ -82,7 +82,7 @@
       loop: "{{ tailscale_hostnames }}"
       loop_control:
         loop_var: tailscale_hostname
-      when: INSTALL_TAILSCALE == "YES"
+      when: INSTALL_TAILSCALE | upper == "YES"
 
 #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### ####
 
@@ -104,4 +104,4 @@
         - include_role:
             name: software.configure.tailscale_disable_nftables
 
-      when: INSTALL_TAILSCALE == "YES"
+      when: INSTALL_TAILSCALE | upper == "YES"

scenarios/demo_lab/04_ctf_infrastructure/stage_01/_r42_vuln_box_group.yml

@@ -86,7 +86,7 @@
       loop: "{{ tailscale_hostnames }}"
       loop_control:
         loop_var: tailscale_hostname
-      when: INSTALL_TAILSCALE == "YES"
+      when: INSTALL_TAILSCALE | upper == "YES"
 
 #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### #### ####
 
@@ -112,4 +112,4 @@
         - include_role:
             name: software.configure.tailscale_disable_nftables
 
-      when: INSTALL_TAILSCALE == "YES"
+      when: INSTALL_TAILSCALE | upper == "YES"

scenarios/demo_lab/README.md

@@ -73,3 +73,20 @@ Each infrastructure section follows staged deployment:
 | `demo_lab.delete_vms_only.sh` | Destroy VMs only (keep templates) |
 | `demo_lab.reset.setup.sh` | Delete all + redeploy from scratch |
 | `demo_lab.reset.ssh_keys.sh` | Reset SSH keys only |
+
+## Optional components - feature flags
+
+The optional components shipped with this scenario can be toggled on/off at deploy
+time. The catalog lives in [`manifest/feature_flags.yml`](manifest/feature_flags.yml) ;
+the deploy scripts forward any trailing `-e INSTALL_<NAME>=<YES|NO>` to `ansible-playbook`
+(same convention as the pre-existing `INSTALL_TAILSCALE` variable used elsewhere
+in the scenario).
+
+Example - deploy everything except wazuh, and force tailscale off on all groups :
+
+```bash
+range42-context deploy      -e INSTALL_WAZUH=NO
+range42-context deploy-vms  -e INSTALL_WAZUH=NO -e INSTALL_TAILSCALE=NO
+```
+
+The same flags surface as checkboxes in `range42-context --tui` (deploy / deploy-vms entries).

scenarios/demo_lab/demo_lab.reset.setup.sh

@@ -32,6 +32,14 @@ for ip in "${INFRASTRUCTURE_IP[@]}"; do
     ssh-keygen -f "$HOME/.ssh/known_hosts" -R "$ip"
 done
 
+##
+## Trailing "$@" propagates any extra args to ansible-playbook.
+## Typical use : feature flag overrides from the TUI, e.g.
+##   demo_lab.reset.setup.sh -e enable_wazuh=false
+## See ./manifest/feature_flags.yml for the list of toggleable features.
+##
+
 ansible-playbook -i "${RANGE42_ANSIBLE_ROLES__INVENTORY_DIR}/inventory_default.yml" \
 	-l "all" \
-	"./main.yml" --vault-password-file "${RANGE42_VAULT_PASSWORD_FILE:?RANGE42_VAULT_PASSWORD_FILE is not set — run: range42-context use <codename> <scenario>}"
+	"./main.yml" --vault-password-file "${RANGE42_VAULT_PASSWORD_FILE:?RANGE42_VAULT_PASSWORD_FILE is not set — run: range42-context use <codename> <scenario>}" \
+	"$@"

scenarios/demo_lab/demo_lab.setup.sh

@@ -1,5 +1,13 @@
 #!/bin/bash
 
+##
+## Trailing "$@" propagates any extra args to ansible-playbook.
+## Typical use : feature flag overrides from the TUI, e.g.
+##   demo_lab.setup.sh -e enable_wazuh=false -e enable_misp=true
+## See ./manifest/feature_flags.yml for the list of toggleable features.
+##
+
 ansible-playbook -i "${RANGE42_ANSIBLE_ROLES__INVENTORY_DIR}/inventory_default.yml" \
 	-l "all" \
-	"./main.yml" --vault-password-file "${RANGE42_VAULT_PASSWORD_FILE:?RANGE42_VAULT_PASSWORD_FILE is not set — run: range42-context use <codename> <scenario>}"
+	"./main.yml" --vault-password-file "${RANGE42_VAULT_PASSWORD_FILE:?RANGE42_VAULT_PASSWORD_FILE is not set — run: range42-context use <codename> <scenario>}" \
+	"$@"

scenarios/demo_lab/demo_lab.setup_vms_only.sh

@@ -4,7 +4,13 @@
 ## deploy VMs only — skip template download and creation
 ## faster redeploy when templates already exist on proxmox
 ##
+## Trailing "$@" propagates any extra args to ansible-playbook.
+## Typical use : feature flag overrides from the TUI, e.g.
+##   demo_lab.setup_vms_only.sh -e enable_wazuh=false
+## See ./manifest/feature_flags.yml for the list of toggleable features.
+##
 
 ansible-playbook -i "${RANGE42_ANSIBLE_ROLES__INVENTORY_DIR}/inventory_default.yml" \
 	-l "all" \
-	"./main_vms_only.yml" --vault-password-file "${RANGE42_VAULT_PASSWORD_FILE:?RANGE42_VAULT_PASSWORD_FILE is not set — run: range42-context use <codename> <scenario>}"
+	"./main_vms_only.yml" --vault-password-file "${RANGE42_VAULT_PASSWORD_FILE:?RANGE42_VAULT_PASSWORD_FILE is not set — run: range42-context use <codename> <scenario>}" \
+	"$@"

scenarios/demo_lab/manifest/feature_flags.yml

@@ -0,0 +1,61 @@
+---
+# Feature flags for demo_lab - optional components that can be toggled on/off
+# at deploy time via `-e INSTALL_<NAME>=YES|NO` (aligned with the existing
+# `INSTALL_TAILSCALE` convention used elsewhere in the scenario).
+#
+# This file is the single source of truth :
+#   - the deploy TUI (range42-context --tui) reads `features` to render the
+#     checkbox modal before invoking `range42-context deploy`
+#   - the playbooks read the `INSTALL_<NAME>` variables via
+#     `when: INSTALL_<NAME> | default("YES"|"NO") | upper == "YES"` on the
+#     relevant `import_playbook` / `block:` entries
+#
+# Convention :
+#   - `id` is UPPERCASE (matches the variable name : `id: WAZUH` -> `INSTALL_WAZUH`)
+#   - `default: true|false` is the checkbox initial state in the TUI
+#   - the playbook `default("YES"|"NO")` fallback should align with this
+#   - `| upper` makes the check case-insensitive : YES / yes / Yes all match
+#
+# To add a new optional component :
+#   1. append a row under `features:` with id + label + description + default
+#   2. wire the playbook tasks under
+#      `when: INSTALL_<ID> | default("YES"|"NO") | upper == "YES"`
+#   3. the TUI picks it up automatically on next launch
+
+features:
+  - id: WAZUH
+    label: "Wazuh stack - SIEM + agents services"
+    description: "Deploys the wazuh-indexer / wazuh-server VM + post-create configuration. Skipping leaves the admin-wazuh VM uncreated and removes the agent install on student boxes."
+    default: true
+
+  - id: TAILSCALE
+    label: "Tailscale VPN client"
+    description: "Per-group install (admin=NO / student=YES / ctf=NO by default in the scenario). Checking forces YES on all groups via -e INSTALL_TAILSCALE=YES ; unchecking forces NO everywhere."
+    default: false
+
+  #
+  # for upcoming POCs not yet ready
+  #
+  - id: MISP
+    label: "MISP - threat intel services"
+    description: "Deploys ...."
+    default: false
+
+  - id: GITEA
+    label: "Gitea - code services"
+    description: "Deploys ...."
+    default: false
+
+  - id: ROCKETCHAT
+    label: "RocketChat - chat services"
+    description: "Deploys ...."
+    default: false
+
+  - id: MATTERMOST
+    label: "Mattermost - chat services"
+    default: false
+
+  - id: NEXTCLOUD
+    label: "Nextcloud - files storage services"
+    description: "Deploys ...."
+    default: false