[iscsi]
pi.prole.org
raspberry.prole.org
myrddin.prole.org
retropie.prole.org
merlin.prole.org
gandalf.prole.org

[pihole]
pi.prole.org
raspberry.prole.org

[ad_dc]
myrddin.prole.org

[k3s_servers]
myrddin.prole.org

[k3s_agents]
merlin.prole.org
gandalf.prole.org

[k3s_hosts:children]
k3s_servers
k3s_agents

[linux_hosts]
pi.prole.org
raspberry.prole.org
myrddin.prole.org
retropie.prole.org
merlin.prole.org
gandalf.prole.org

[ssl_hosts]
myrddin.prole.org

[mariadb_primary]
merlin.prole.org

[mariadb_replica]
raspberry.prole.org

[mariadb:children]
mariadb_primary
mariadb_replica

[tailscale]
merlin.prole.org
gandalf.prole.org

[merlin_bootstrap]
merlin ansible_host=10.0.0.36 ansible_user=ansible

# ── Engineer workstations — macOS / Linux ────────────────────────────────────
# workstation_kerberos.yml targets this group to deploy:
#   - /etc/krb5.conf  (or /Library/Preferences/edu.mit.Kerberos on macOS)
#     pointing to myrddin.prole.org PROLE.ORG KDC
#   - Chrome/Edge managed policy (AuthServerAllowlist = *.prole.org)
#     via /Library/Managed Preferences/ (macOS) or
#     /etc/opt/chrome/policies/managed/ (Linux)
#
# Ensure the ansible_user has passwordless-sudo or run with --ask-become-pass.
[workstations]
morgana.prole.org   ansible_user=chrisfu ansible_connection=local
zinfandel.prole.org ansible_user=chrisfu ansible_ssh_private_key_file=~/.ssh/id_knoe_ed25519

# ── Engineer workstations — Windows ──────────────────────────────────────────
# workstation_kerberos.yml targets this group to deploy Chrome/Edge SPNEGO
# policy via registry (HKLM\SOFTWARE\Policies\Google\Chrome and
# HKLM\SOFTWARE\Policies\Microsoft\Edge).
#
# Prerequisites:
#   - WinRM enabled:  winrm quickconfig  (run once as Administrator)
#   - Or OpenSSH:     Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
#   - ansible_user must be a local Administrator or domain admin
#
# If the machine is joined to the PROLE.ORG Samba AD domain it already has
# Kerberos via Windows SSPI — no MIT Kerberos client needed.
# If not joined, add ansible_winrm_transport=kerberos after domain-joining.
[workstations_windows]
morgoth.prole.org    ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore ansible_winrm_scheme=http ansible_port=5985
fairyland.prole.org  ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore ansible_winrm_scheme=http ansible_port=5985

[workstations_windows:vars]
ansible_become=false
ansible_become_method=runas

[workstations:children]
workstations_windows