#315 - First provisioning run of ipa.cloonar.com — close out #313's acceptance criteria - Cloonar/nixos

#313 delivered the `ansible/` tree (merged in #314) but its acceptance criteria could not be demonstrated: there is no VPS and no Storage Box sub-account yet, so every criterion that needs a real box was encoded as a runtime check rather than proven. This issue closes that gap on the first real provisioning run. Raised as a follow-up during the landing of #314, where it was recorded as a non-blocking concern. ## Prerequisites (manual, per `ansible/README.md`) - Install AlmaLinux 10 (≥ 10.1) from netcup's SCP with the SSH key selected - Set rDNS on both the IPv4 and the IPv6 in SCP — no API, has to be done by hand - Create the A and AAAA records for `ipa.cloonar.com` — **not** a CNAME - Create the Storage Box sub-account on `u149513`, set its password, enable SSH - Fill in `net_ipv6` and `sb_user` in `ansible/inventory/host_vars/ipa-cloonar.yml` - Create `ansible/inventory/host_vars/ipa-cloonar.sops.yaml` from the shipped `.example` (`sb_password`, `borg_passphrase`, `ipa_dm_password`, `ipa_admin_password`) - Confirm the snapshot plan on `u149513` is active — `--append-only` is advisory, snapshots are the real backup control ## Acceptance — carried over from #313, undemonstrated at merge - [ ] `ansible-playbook -i ansible/inventory ansible/playbooks/provision.yml -l ipa-cloonar` takes a freshly installed AlmaLinux 10 box to a working IdM server - [ ] Running it a second time reports zero changes - [ ] `preflight` fails loudly, before any change, on a CNAME hostname, on missing rDNS, and on a forward/reverse mismatch — each tested deliberately against the real box - [ ] `dnf-automatic` applies an OS security update unattended and provably leaves `ipa-*`, `389-ds-*`, `pki-*` and `*tomcat*` untouched - [ ] `borg-mount` works on the target, and a restore has been performed end to end from a real archive - [ ] `mail`'s KDC is untouched and `kinit` against it still works ## Runtime assumptions to confirm on the box Probed at runtime and failing loudly rather than guessed, but never observed: - [ ] `ipa-healthcheck --output-type json` writes JSON to **stdout** when `--output-file` is omitted. If it does not, `roles/verify/tasks/main.yml:16` raises a Jinja error on an empty `stdout` instead of the intended message, and the journal feed is silently empty. One `systemctl start ipa-healthcheck.service && journalctl -t ipa-healthcheck -n 5` settles it. - [ ] EPEL 10 carries `borgbackup` at 1.4.x — the `borg` role asserts it and stops if not - [ ] The dnf-automatic package and timer names on Alma 10.1 match one of the probed candidates (`dnf-automatic` / `dnf5-plugin-automatic`, `dnf-automatic.timer` / `dnf5-automatic.timer`) - [ ] `ansible.builtin.dnf5`'s `disable_excludes: main` actually steps over the `dnf.conf` exclude for `ipa-server` and `ipa-healthcheck` ## Out of scope Cutover from `mail`'s KDC — still needs an ADR first, since ADR-0023 rejected FreeIPA and its workstream is live in #299/#302/#308.

dominik.polakovics commented

2026-08-10 00:23:26 +02:00

Owner

#313 delivered the ansible/ tree (merged in #314) but its acceptance criteria could not be demonstrated: there is no VPS and no Storage Box sub-account yet, so every criterion that needs a real box was encoded as a runtime check rather than proven. This issue closes that gap on the first real provisioning run.

Raised as a follow-up during the landing of #314, where it was recorded as a non-blocking concern.

Prerequisites (manual, per `ansible/README.md`)

Install AlmaLinux 10 (≥ 10.1) from netcup's SCP with the SSH key selected
Set rDNS on both the IPv4 and the IPv6 in SCP — no API, has to be done by hand
Create the A and AAAA records for ipa.cloonar.com — not a CNAME
Create the Storage Box sub-account on u149513, set its password, enable SSH
Fill in net_ipv6 and sb_user in ansible/inventory/host_vars/ipa-cloonar.yml
Create ansible/inventory/host_vars/ipa-cloonar.sops.yaml from the shipped .example (sb_password, borg_passphrase, ipa_dm_password, ipa_admin_password)
Confirm the snapshot plan on u149513 is active — --append-only is advisory, snapshots are the real backup control

Acceptance — carried over from #313, undemonstrated at merge

ansible-playbook -i ansible/inventory ansible/playbooks/provision.yml -l ipa-cloonar takes a freshly installed AlmaLinux 10 box to a working IdM server
Running it a second time reports zero changes
preflight fails loudly, before any change, on a CNAME hostname, on missing rDNS, and on a forward/reverse mismatch — each tested deliberately against the real box
dnf-automatic applies an OS security update unattended and provably leaves ipa-*, 389-ds-*, pki-* and *tomcat* untouched
borg-mount works on the target, and a restore has been performed end to end from a real archive
mail's KDC is untouched and kinit against it still works

Runtime assumptions to confirm on the box

Probed at runtime and failing loudly rather than guessed, but never observed:

ipa-healthcheck --output-type json writes JSON to stdout when --output-file is omitted. If it does not, roles/verify/tasks/main.yml:16 raises a Jinja error on an empty stdout instead of the intended message, and the journal feed is silently empty. One systemctl start ipa-healthcheck.service && journalctl -t ipa-healthcheck -n 5 settles it.
EPEL 10 carries borgbackup at 1.4.x — the borg role asserts it and stops if not
The dnf-automatic package and timer names on Alma 10.1 match one of the probed candidates (dnf-automatic / dnf5-plugin-automatic, dnf-automatic.timer / dnf5-automatic.timer)
ansible.builtin.dnf5's disable_excludes: main actually steps over the dnf.conf exclude for ipa-server and ipa-healthcheck