Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
2026-09-09 16:47:20 +00:00
commit 88a02ababa
418 changed files with 50579 additions and 0 deletions
@@ -0,0 +1,21 @@
+---
+# win_domain_join role defaults.
+# Target host must be reachable over WinRM (see inventory/hosts.yml windows group).
+
+win_dc_ip: "10.10.10.10"                 # DC IP — becomes the box's primary DNS
+win_domain_dns_name: "ad.example.com"    # lowercase DNS domain to join
+win_domain_admin_user: "EXAMPLE\\Administrator"
+# win_domain_admin_password comes from vault.
+
+# RSAT for the GPO/AD management station. On Windows SERVER these are Features
+# (Install-WindowsFeature), NOT the client "Rsat.*~~~~" capabilities.
+win_rsat_features:
+  - GPMC                 # Group Policy Management Console
+  - RSAT-AD-Tools        # ADUC / ADAC / AD PowerShell
+  - RSAT-DNS-Server      # DNS console
+
+# KMS activation. Default relies on the _vlmcs._tcp SRV record in AD DNS for
+# auto-discovery (see samba_ad_dc role) — the GVLK is already baked in by autounattend.
+win_activate: true
+win_kms_host: ""            # optional explicit "host:1688" override; empty = SRV auto-discovery
+win_kms_client_key: ""      # optional GVLK /ipk; empty = already installed at build time
@@ -0,0 +1,48 @@
+---
+# Join the Windows admin box to the domain, install RSAT, activate against KMS.
+# Requires collections: ansible.windows, community.windows.
+
+- name: Point primary DNS at the DC (mandatory before join)
+  ansible.windows.win_dns_client:
+    adapter_names: "*"
+    dns_servers:
+      - "{{ win_dc_ip }}"
+
+- name: Join the Active Directory domain (reboots automatically)
+  microsoft.ad.membership:
+    dns_domain_name: "{{ win_domain_dns_name }}"
+    domain_admin_user: "{{ win_domain_admin_user }}"
+    domain_admin_password: "{{ win_domain_admin_password }}"
+    state: domain
+    reboot: true
+  no_log: true
+
+- name: Install RSAT management features (GPMC, ADUC, DNS console) — Server SKU
+  ansible.windows.win_feature:
+    name: "{{ win_rsat_features }}"
+    state: present
+    include_management_tools: true
+  register: rsat_feature
+
+- name: Reboot if an RSAT feature asked for it
+  ansible.windows.win_reboot:
+  when: rsat_feature.reboot_required | default(false)
+
+- name: KMS activation (SRV auto-discovery unless a host is pinned)
+  when: win_activate | bool
+  block:
+    - name: Install GVLK (only if explicitly provided; normally already baked in)
+      ansible.windows.win_command: "cscript //nologo C:\\Windows\\System32\\slmgr.vbs /ipk {{ win_kms_client_key }}"
+      when: win_kms_client_key | length > 0
+      changed_when: true
+
+    - name: Pin KMS host (only if overriding the _vlmcs SRV auto-discovery)
+      ansible.windows.win_command: "cscript //nologo C:\\Windows\\System32\\slmgr.vbs /skms {{ win_kms_host }}"
+      when: win_kms_host | length > 0
+      changed_when: true
+
+    - name: Activate (discovers KMS via _vlmcs._tcp SRV in AD DNS)
+      ansible.windows.win_command: "cscript //nologo C:\\Windows\\System32\\slmgr.vbs /ato"
+      register: slmgr_ato
+      changed_when: true
+      failed_when: false    # first /ato can race the domain DNS; not fatal