feat(inventory): add all 4 workstations; add Windows SPNEGO policy support

Add morgana and zinfandel (macOS) and morgoth + fairyland (Windows)
to the workstations inventory.

Extend workstation_kerberos.yml to handle Windows targets:
- Chrome and Edge AuthServerAllowlist set via win_regedit under
  HKLM\SOFTWARE\Policies\{Google\Chrome,Microsoft\Edge}
- krb5.conf and plist tasks skip on Windows (uses built-in SSPI/AD)
- Windows hosts in [workstations_windows] group with WinRM/NTLM
  transport; switch to kerberos transport after domain join

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/inventory/hosts.ini

@@ -52,18 +52,36 @@ gandalf.prole.org
 [merlin_bootstrap]
 merlin ansible_host=10.0.0.36 ansible_user=ansible
 
-# ── Engineer workstations ────────────────────────────────────────────────────
+# ── Engineer workstations — macOS / Linux ────────────────────────────────────
-# Add each engineer's laptop here when they join.
+# workstation_kerberos.yml targets this group to deploy:
-# The workstation_kerberos.yml playbook targets this group to deploy:
+#   - /etc/krb5.conf  (or /Library/Preferences/edu.mit.Kerberos on macOS)
-#   - /etc/krb5.conf pointing to myrddin.prole.org PROLE.ORG KDC
+#     pointing to myrddin.prole.org PROLE.ORG KDC
-#   - Chrome/Edge managed policy for automatic SPNEGO (no per-user browser config)
+#   - Chrome/Edge managed policy (AuthServerAllowlist = *.prole.org)
+#     via /Library/Managed Preferences/ (macOS) or
+#     /etc/opt/chrome/policies/managed/ (Linux)
 #
-# Example entries:
+# Ensure the ansible_user has passwordless-sudo or run with --ask-become-pass.
-#   chrisfu-mbp.prole.org ansible_user=chrisfu ansible_connection=ssh
-#   ron-mbp.prole.org     ansible_user=ron     ansible_connection=ssh
-#
-# For macOS targets, ensure the ansible user has sudo rights (via sudoers or
-# the local_user role run during initial provisioning).
 [workstations]
-# chrisfu-mbp.prole.org ansible_user=chrisfu
+morgana.prole.org   ansible_user=chrisfu
+zinfandel.prole.org ansible_user=chrisfu
+
+# ── Engineer workstations — Windows ──────────────────────────────────────────
+# workstation_kerberos.yml targets this group to deploy Chrome/Edge SPNEGO
+# policy via registry (HKLM\SOFTWARE\Policies\Google\Chrome and
+# HKLM\SOFTWARE\Policies\Microsoft\Edge).
+#
+# Prerequisites:
+#   - WinRM enabled:  winrm quickconfig  (run once as Administrator)
+#   - Or OpenSSH:     Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
+#   - ansible_user must be a local Administrator or domain admin
+#
+# If the machine is joined to the PROLE.ORG Samba AD domain it already has
+# Kerberos via Windows SSPI — no MIT Kerberos client needed.
+# If not joined, add ansible_winrm_transport=kerberos after domain-joining.
+[workstations_windows]
+morgoth.prole.org    ansible_user=chrisfu ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore
+fairyland.prole.org  ansible_user=chrisfu ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore
+
+[workstations:children]
+workstations_windows
 

infrastructure/playbooks/workstation_kerberos.yml

@@ -89,6 +89,7 @@
               {{ d }} = {{ r.realm }}
           {% endfor %}
           {% endfor %}
+      when: ansible_os_family != "Windows"
 
     # macOS also checks this legacy path; symlink for compatibility.
     - name: Symlink macOS legacy Kerberos config
@@ -191,14 +192,40 @@
         - /etc/chromium/policies/managed
       when: ansible_os_family != "Darwin"
 
+    # -----------------------------------------------------------------------
+    # 2c. Chrome + Edge managed policy — Windows
+    # Policy lives in the registry under HKLM\SOFTWARE\Policies\<vendor>\<app>.
+    # No GPO infrastructure required — win_regedit writes keys directly.
+    # If the machine is later joined to PROLE.ORG AD, these keys can be
+    # replaced by a proper GPO; they are idempotent either way.
+    # -----------------------------------------------------------------------
+    - name: Set Chrome SPNEGO policy keys (Windows)
+      ansible.windows.win_regedit:
+        path: "{{ item.path }}"
+        name: "{{ item.name }}"
+        data: "{{ chrome_negotiate_domains }}"
+        type: String
+        state: present
+      loop:
+        - path: HKLM:\SOFTWARE\Policies\Google\Chrome
+          name: AuthServerAllowlist
+        - path: HKLM:\SOFTWARE\Policies\Google\Chrome
+          name: AuthNegotiateDelegateAllowlist
+        - path: HKLM:\SOFTWARE\Policies\Microsoft\Edge
+          name: AuthServerAllowlist
+        - path: HKLM:\SOFTWARE\Policies\Microsoft\Edge
+          name: AuthNegotiateDelegateAllowlist
+      when: ansible_os_family == "Windows"
+      notify: Restart Chrome (Windows)
+
     # -----------------------------------------------------------------------
     # 3. Verify — print where to check policy was applied
     # -----------------------------------------------------------------------
     - name: Show policy verification URL
       ansible.builtin.debug:
         msg: >
-          Chrome policy applied.
+          Chrome/Edge policy applied on {{ inventory_hostname }}.
-          Verify at chrome://policy in a browser on {{ inventory_hostname }}.
+          Verify at chrome://policy (or edge://policy) in a browser.
           Expected: AuthServerAllowlist = {{ chrome_negotiate_domains }}
 
   handlers:
@@ -210,3 +237,10 @@
           Chrome policy updated on {{ inventory_hostname }}.
           Ask the user to quit Chrome completely (Cmd-Q) and relaunch.
           Managed preferences take effect on next launch — no reinstall needed.
+
+    - name: Restart Chrome (Windows)
+      ansible.builtin.debug:
+        msg: >
+          Chrome/Edge policy updated on {{ inventory_hostname }}.
+          Ask the user to close all Chrome and Edge windows and relaunch.
+          Registry policy takes effect on next browser start — no reinstall needed.