rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update
  all README/AGENTS call examples and the inventory table
- move admin_password hash into encrypted vault.yml; remove plaintext copies
  from roles/bootstrap/defaults and group_vars/external.yml
- bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring)
- monitoring: PSK config/registration updates, docker role defaults,
  os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks
- add .project-wiki knowledge base and .github agent instructions

roles/monitoring/README.md

@@ -27,7 +27,7 @@ einschließlich Template-Verlinkung.
 ```
 
 ```bash
-ansible-playbook -i inventory/dmc12.yml --vault-password-file .vault_password \
+ansible-playbook -i inventory/cloudlorean.yml --vault-password-file .vault_password \
   playbooks/monitoring.yml
 ```
 
@@ -50,14 +50,16 @@ Tag `monitoring`):
    anlegen, `docker.conf` aus Template ausliefern. Falls nein: Plugin-Config
    entfernen.
 5. **`configure-psk.yml`** – stellt PSK-Store auf dem Controller sicher
-   (`<playbook_dir>/../.zabbix-psk`), generiert pro Host eine PSK mit
+   (im Repository unter `.zabbix-psk`), generiert pro Host eine PSK mit
    `openssl rand -hex`, persistiert sie im Store und verteilt sie auf den
    Zielhost (`/etc/zabbix/zabbix_agent2.psk`, Mode `0600`).
 6. **`configure-agent.yml`** – schreibt `zabbix_agent2.conf` aus Template.
 7. **`register-host.yml`** – registriert bzw. aktualisiert den Host über die
-   Zabbix-API (`community.zabbix.zabbix_host`). Verknüpft Standard-Templates
-   und ggf. Docker-Templates. Unterscheidet zwischen Proxy- und
-   Server-Modus (zwei Tasks, gegeneinander exklusiv). Delegiert an localhost.
+   Zabbix-API (`community.zabbix.zabbix_host` via `httpapi`-Connection).
+   Verknüpft Standard-Templates und ggf. Docker-Templates. Wählt
+   `monitored_by: proxy` bzw. `zabbix_server` anhand von
+   `monitoring_zabbix_proxy`.
+   Delegiert an localhost.
 
 ## Variablen
 
@@ -92,10 +94,10 @@ Tag `monitoring`):
 |-----------------------------------------|--------|--------------------------------------|---------------------------------------------------------|
 | `monitoring_zabbix_tls_connect`         | string | `psk`                                | TLS-Modus für ausgehende Verbindungen                  |
 | `monitoring_zabbix_tls_accept`          | string | `psk`                                | TLS-Modus für eingehende Verbindungen                   |
-| `monitoring_zabbix_psk_identity`        | string | `{{ inventory_hostname }}`          | PSK-Identity (hostname)                                |
+| `monitoring_zabbix_psk_identity`        | string | `{{ monitoring_zabbix_host_name }}` | PSK-Identity; muss mit der in Zabbix registrierten Identity übereinstimmen |
 | `monitoring_zabbix_psk_file`            | string | `/etc/zabbix/zabbix_agent2.psk`      | Pfad zur PSK-Datei auf dem Zielhost                    |
 | `monitoring_zabbix_psk_bits`             | int    | `256`                                | PSK-Länge in Bits (32 Byte → 64 Hex-Chars)             |
-| `monitoring_zabbix_psk_store`            | string | `{{ playbook_dir }}/../.zabbix-psk`  | PSK-Store-Verzeichnis auf dem Controller               |
+| `monitoring_zabbix_psk_store`            | string | `{{ role_path }}/../../.zabbix-psk` | PSK-Store-Verzeichnis auf dem Controller               |
 | `monitoring_zabbix_psk_store_mode`       | string | `0700`                               | Berechtigung des PSK-Stores                            |
 
 ### Zabbix Proxy (optional)
@@ -109,7 +111,7 @@ Tag `monitoring`):
 
 | Variable                                    | Typ    | Default                              | Beschreibung                                            |
 |---------------------------------------------|--------|--------------------------------------|---------------------------------------------------------|
-| `monitoring_zabbix_api_url`                 | string | `https://zabbix/api_jsonrpc.php`     | API-URL                                                 |
+| `monitoring_zabbix_api_url`                 | string | `https://zabbix/api_jsonrpc.php`     | API-URL (wird via `urlsplit` in Host, Port, Pfad zerlegt) |
 | `monitoring_zabbix_api_user`                | string | `Admin`                             | API-Benutzer                                            |
 | `monitoring_zabbix_api_password`             | string | (Vault)                              | API-Passwort – MUSS in `vault.yml` gesetzt werden       |
 | `monitoring_zabbix_api_validate_certs`      | bool   | `true`                               | TLS-Zertifikate prüfen                                  |
@@ -151,7 +153,7 @@ Passive-Servers mit Proxy-Adresse, setzt `ServerActive` auf Proxy).
 `monitoring` – alle Subtasks sind mit diesem Tag versehen:
 
 ```bash
-ansible-playbook -i inventory/dmc12.yml playbooks/monitoring.yml -t monitoring
+ansible-playbook -i inventory/cloudlorean.yml playbooks/monitoring.yml -t monitoring
 ```
 
 ## Abhängigkeiten
@@ -163,14 +165,21 @@ ansible-playbook -i inventory/dmc12.yml playbooks/monitoring.yml -t monitoring
 ## Hinweise
 
 - **PSK-Store**: Pro Host wird eine PSK unter
-  `<playbook_dir>/../.zabbix-psk/<hostname>.psk` (git-ignored) gespeichert.
+  `<Repository-Root>/.zabbix-psk/<hostname>.psk` (git-ignored) gespeichert.
   Bei Host-Umbenennung PSK migrieren oder neu generieren – sonst stimmt die
   Zabbix-Registrierung nicht.
+- **PSK-Identity**: Die Agent-Konfiguration und die Zabbix-Hostkonfiguration
+  verwenden dieselbe Identity. Wenn `monitoring_zabbix_host_name` überschrieben
+  wird, wird die Identity standardmäßig automatisch daran angepasst.
 - **API-Passwort** MUSS in `vault.yml` als `monitoring_zabbix_api_password`
   gesetzt sein; die Validate-Tasks brechen sonst ab.
 - **Docker-Plugin** wird nur konfiguriert, wenn der Socket existiert – sonst
   wird eine eventuell vorhandene Plugin-Config entfernt (Idempotenz).
-- Die Registrierung wird **delegiert an localhost** ausgeführt, da der
-  Controller den API-Zugang besitzt.
-- Proxy- und Server-Modus schließen sich gegenseitig aus (zwei Tasks mit
-  entgegengesetzten `when`-Bedingungen).
+- Die Registrierung nutzt die `httpapi`-Connection
+  (`ansible_network_os: community.zabbix.zabbix`, `ansible_connection: httpapi`)
+  und läuft direkt vom Controller aus – kein `delegate_to` nötig.
+  Die API-URL wird per `urlsplit` in Host, Port, SSL und Pfad zerlegt;
+  User/Passwort kommen als `ansible_user`/`ansible_password` in die
+  Task-Vars.
+- Proxy- und Server-Modus werden über `monitored_by` gesteuert
+  (`proxy` bei gesetztem `monitoring_zabbix_proxy`, sonst `zabbix_server`).

roles/monitoring/defaults/main.yml

@@ -17,11 +17,11 @@ monitoring_zabbix_docker_endpoint: "unix://{{ monitoring_zabbix_docker_socket_pa
 # --- TLS / PSK ----------------------------------------------------------------
 monitoring_zabbix_tls_connect: psk          # outgoing connections from agent: psk
 monitoring_zabbix_tls_accept: psk           # incoming connections to agent:   psk
-monitoring_zabbix_psk_identity: "{{ inventory_hostname }}"
+monitoring_zabbix_psk_identity: "{{ monitoring_zabbix_host_name }}"
 monitoring_zabbix_psk_file: /etc/zabbix/zabbix_agent2.psk
 monitoring_zabbix_psk_bits: 256             # 32 bytes -> 64 hex chars
 # Directory on the Ansible controller used to persist per-host PSKs across runs.
-monitoring_zabbix_psk_store: "{{ playbook_dir }}/../.zabbix-psk"
+monitoring_zabbix_psk_store: "{{ role_path }}/../../.zabbix-psk"
 monitoring_zabbix_psk_store_mode: "0700"
 
 # --- Zabbix Proxy (optional) --------------------------------------------------
@@ -45,4 +45,4 @@ monitoring_zabbix_host_inventory_mode: manual
 # Templates linked to every host
 monitoring_zabbix_templates: ["Linux by Zabbix agent", "Zabbix agent2"]
 # Templates added when a Docker socket is present on the host
-monitoring_zabbix_docker_templates: ["Docker by Zabbix agent2"]
+monitoring_zabbix_docker_templates: ["Docker by Zabbix agent2"]

roles/monitoring/tasks/configure-psk.yml

@@ -12,6 +12,13 @@
   become: false
   run_once: false
 
+- name: Show PSK store path
+  ansible.builtin.debug:
+    msg: "Persisting PSKs on the controller in {{ monitoring_zabbix_psk_store }}"
+  delegate_to: localhost
+  become: false
+  changed_when: false
+
 - name: Check whether PSK already exists on controller
   ansible.builtin.stat:
     path: "{{ monitoring_zabbix_psk_store }}/{{ inventory_hostname }}.psk"
@@ -37,6 +44,17 @@
                 monitoring_zabbix_psk_store ~ '/' ~ inventory_hostname ~ '.psk')
          | trim }}
 
+- name: Validate PSK format
+  ansible.builtin.assert:
+    that:
+      - monitoring_zabbix_psk_value is match('^[0-9a-fA-F]+$')
+      - monitoring_zabbix_psk_value | length == (monitoring_zabbix_psk_bits / 4) | int
+    fail_msg: >-
+      The PSK must contain exactly {{ (monitoring_zabbix_psk_bits / 4) | int }}
+      hexadecimal characters.
+  delegate_to: localhost
+  become: false
+
 - name: Ensure Zabbix agent runtime directory exists
   ansible.builtin.file:
     path: "{{ monitoring_zabbix_psk_file | dirname | default('/etc/zabbix') }}"
@@ -52,4 +70,4 @@
     owner: "{{ monitoring_zabbix_agent_user }}"
     group: "{{ monitoring_zabbix_agent_user }}"
     mode: '0600'
-  notify: Restart Zabbix Agent
+  notify: Restart Zabbix Agent

roles/monitoring/tasks/register-host.yml

@@ -24,52 +24,36 @@
         dns: "{{ inventory_hostname }}"
         port: "{{ monitoring_zabbix_host_interface_port }}"
 
-- name: Register or update host in Zabbix (monitored by proxy)
+- name: Register or update host in Zabbix
   community.zabbix.zabbix_host:
-    server_url: "{{ monitoring_zabbix_api_url }}"
-    login_user: "{{ monitoring_zabbix_api_user }}"
-    login_password: "{{ monitoring_zabbix_api_password }}"
-    validate_certs: "{{ monitoring_zabbix_api_validate_certs }}"
     host_name: "{{ monitoring_zabbix_host_name }}"
     visible_name: "{{ monitoring_zabbix_host_name }}"
     host_groups: "{{ monitoring_zabbix_host_groups }}"
     link_templates: "{{ monitoring_zabbix_link_templates }}"
     interfaces: "{{ monitoring_zabbix_interfaces }}"
     inventory_mode: "{{ monitoring_zabbix_host_inventory_mode }}"
-    monitored_by: proxy
-    proxy: "{{ monitoring_zabbix_proxy }}"
+    monitored_by: "{{ 'proxy' if monitoring_zabbix_proxy | length > 0 else 'zabbix_server' }}"
+    proxy: "{{ monitoring_zabbix_proxy | default(omit) }}"
     tls_connect: 2
     tls_accept: 2
     tls_psk_identity: "{{ monitoring_zabbix_psk_identity }}"
     tls_psk: "{{ monitoring_zabbix_psk_value }}"
     status: enabled
     state: present
-  delegate_to: localhost
+  vars:
+    ansible_network_os: community.zabbix.zabbix
+    ansible_connection: httpapi
+    ansible_host: "{{ (monitoring_zabbix_api_url | urlsplit).hostname }}"
+    ansible_httpapi_port: "{{ (monitoring_zabbix_api_url | urlsplit).port | default(443, true) }}"
+    ansible_httpapi_use_ssl: "{{ (monitoring_zabbix_api_url | urlsplit).scheme == 'https' }}"
+    ansible_httpapi_validate_certs: "{{ monitoring_zabbix_api_validate_certs }}"
+    ansible_zabbix_url_path: >-
+      {{
+        (monitoring_zabbix_api_url | urlsplit).path
+        | regex_replace('^/', '')
+        | regex_replace('/?api_jsonrpc\.php$', '')
+      }}
+    ansible_user: "{{ monitoring_zabbix_api_user }}"
+    ansible_password: "{{ monitoring_zabbix_api_password }}"
   become: false
-  when:
-    - monitoring_zabbix_register_host | bool
-    - monitoring_zabbix_proxy | length > 0
-
-- name: Register or update host in Zabbix (monitored by server)
-  community.zabbix.zabbix_host:
-    server_url: "{{ monitoring_zabbix_api_url }}"
-    login_user: "{{ monitoring_zabbix_api_user }}"
-    login_password: "{{ monitoring_zabbix_api_password }}"
-    validate_certs: "{{ monitoring_zabbix_api_validate_certs }}"
-    host_name: "{{ monitoring_zabbix_host_name }}"
-    visible_name: "{{ monitoring_zabbix_host_name }}"
-    host_groups: "{{ monitoring_zabbix_host_groups }}"
-    link_templates: "{{ monitoring_zabbix_link_templates }}"
-    interfaces: "{{ monitoring_zabbix_interfaces }}"
-    inventory_mode: "{{ monitoring_zabbix_host_inventory_mode }}"
-    tls_connect: 2
-    tls_accept: 2
-    tls_psk_identity: "{{ monitoring_zabbix_psk_identity }}"
-    tls_psk: "{{ monitoring_zabbix_psk_value }}"
-    status: enabled
-    state: present
-  delegate_to: localhost
-  become: false
-  when:
-    - monitoring_zabbix_register_host | bool
-    - monitoring_zabbix_proxy | length == 0
+  when: monitoring_zabbix_register_host | bool