update terraform and ansible scripts for keycloak

ansible/configure_tasks.yaml

@@ -7,6 +7,9 @@
 - name: hub init
   ansible.builtin.include_tasks: hub_init.yaml
   when: "'hub' in group_names"
+- name: Keycloak init
+  ansible.builtin.include_tasks: keycloak_init_tasks.yaml
+  when: "'hub' in group_names"
 - name: Handle certificates
   ansible.builtin.include_tasks: certs.yaml
   when: "ca_certs != 'internal'"

ansible/hub_api_tasks.yaml

@@ -19,7 +19,13 @@
     headers:
       Content-Type: "application/json-patch+json"
     body: |-
-      [{ "op": "add", "path": "/unixHomeDirectory", "value":"{{ admin.linux_home_dir }}"}, { "op": "add", "path":"/unixUserName", "value":"{{ admin.linux_username }}" }]
+      [
+        { "op": "add", "path": "/firstName", "value": "Hub" },
+        { "op": "add", "path": "/lastName", "value": "Administrator" },
+        { "op": "add", "path": "/displayName", "value": "Hub Administrator" },
+        { "op": "add", "path": "/unixHomeDirectory", "value": "{{ admin.linux_home_dir }}" },
+        { "op": "add", "path": "/unixUserName", "value": "{{ admin.linux_username }}" }
+      ]
   when: "(hub_res.json['unixUserName'] is not defined)"
 
 - name: Get hub excecution profile id

ansible/hub_run.yaml

@@ -1,9 +1,6 @@
 - name: Enable TLS now
   ansible.builtin.command: /usr/local/bin/hubctl internaltls server
   when: ca_certs == "supplied" or ca_certs == "selfsigned"
-- name: Run ldapsync
-  ansible.builtin.command: /usr/local/bin/hubctl ldapsync
-  when: ldap_enabled == "true"
 - name: Enable hub
   ansible.builtin.command: /usr/local/bin/hubctl service enable
 - name: Start hub

ansible/keycloak_init_tasks.yaml

@@ -0,0 +1,48 @@
+- name: Read Keycloak HubSuperAdmin password
+  ansible.builtin.slurp:
+    src: /opt/altair/slchub/var/data/keycloak/admin.txt
+  register: kc_admin_pass_encoded
+  no_log: true
+
+- name: Get Keycloak admin token
+  ansible.builtin.uri:
+    url: "{{ 'https' if ca_certs == 'internal' else 'http' }}://127.0.0.1:8216/realms/master/protocol/openid-connect/token"
+    method: POST
+    body_format: form-urlencoded
+    validate_certs: no
+    body:
+      grant_type: password
+      client_id: admin-cli
+      username: HubSuperAdmin
+      password: "{{ kc_admin_pass_encoded.content | b64decode | trim }}"
+  register: kc_token_res
+  no_log: true
+
+- name: Find admin user in Keycloak
+  ansible.builtin.uri:
+    url: "{{ 'https' if ca_certs == 'internal' else 'http' }}://127.0.0.1:8216/admin/realms/slchub/users?username={{ admin.username | urlencode }}&exact=true"
+    headers:
+      Authorization: "Bearer {{ kc_token_res.json.access_token }}"
+    validate_certs: no
+  register: kc_user_res
+  no_log: true
+
+- name: Assert admin user was found in Keycloak
+  ansible.builtin.assert:
+    that: kc_user_res.json[0].id is defined
+    fail_msg: "No Keycloak user found matching '{{ admin.username }}'"
+
+- name: Set admin user password in Keycloak
+  ansible.builtin.uri:
+    url: "{{ 'https' if ca_certs == 'internal' else 'http' }}://127.0.0.1:8216/admin/realms/slchub/users/{{ kc_user_res.json[0].id }}/reset-password"
+    method: PUT
+    headers:
+      Authorization: "Bearer {{ kc_token_res.json.access_token }}"
+    validate_certs: no
+    body_format: json
+    body:
+      type: password
+      value: "{{ admin.password }}"
+      temporary: false
+    status_code: 204
+  no_log: true

ansible/main.yaml

@@ -4,6 +4,7 @@
     - vars/ldap.yaml
     - vars/common.yaml
     - vars/license.yaml
+    - worker.config/slc_installs.yaml
   vars:
     bootstrap_params: "{{ '--nointernaltls' if ca_certs != 'internal' else ''}}"
   tasks:

ansible/main_configure.yaml

@@ -4,6 +4,7 @@
     - vars/ldap.yaml
     - vars/common.yaml
     - vars/license.yaml
+    - worker.config/slc_installs.yaml
   vars:
     bootstrap_params: "{{ '--nointernaltls' if ca_certs != 'internal' else ''}}"
   tasks:

ansible/main_install.yaml

@@ -4,6 +4,7 @@
     - vars/ldap.yaml
     - vars/common.yaml
     - vars/license.yaml
+    - worker.config/slc_installs.yaml
   vars:
     bootstrap_params: "{{ '--nointernaltls' if ca_certs != 'internal' else ''}}"
   tasks:

ansible/templates/adminpassword.yaml.j2

@@ -1,3 +1,9 @@
 users:
   - userName: {{admin.username}}
     password: {{admin.password}}
+    firstName: Hub
+    lastName: Administrator
+    displayName: Hub Administrator
+    email: hubadmin@example.com
+    memberOf:
+      - HubAdministrators

ansible/vars/common.yaml

@@ -24,13 +24,13 @@ admin:
 # rpmsdirectory: Location on the target machines.
 rpmsdirectory: /hubrpms
 
-slc_rpm: "altairslc2025"
+slc_rpm: "altairslc2026"
 worker_rpm: "slchub-worker"
 hub_rpm: "slchub"
 
-slc_rpm_file: altairslc-5.25.2.0.1636_ga_maintenance-1.x86_64.rpm
-worker_rpm_file: slchub_worker_2025.2.0_alpha808_808_1_x86_64.rpm
-hub_rpm_file: slchub_2025.2.0_alpha808_808_1_x86_64.rpm
+slc_rpm_file: altairslc-5.26.2.0.1117_ga_maintenance-1.x86_64.rpm
+worker_rpm_file: slchub_worker_2026.2.0_alpha133_133_1_x86_64.rpm
+hub_rpm_file: slchub_2026.2.0_alpha133_133_1_x86_64.rpm
 
 slchub_dir: /opt/altair/slchub
 slchub_user: slchub

ansible/worker.config/slc_installs.yaml

@@ -1,2 +1,2 @@
 wps_installs:
-  default: /opt/altair/slc/2025
+  default: /opt/altair/slc/2026

ansible/worker_init.yaml

@@ -10,7 +10,7 @@
 
 - name: Generate SLC auth token (a1 auth)
   ansible.builtin.shell: |-
-    /opt/altair/slc/2025/bin/almutil -a1auth -anyhost -code {{ license.auth_code }} \
+    {{ wps_installs.default }}/bin/almutil -a1auth -anyhost -code {{ license.auth_code }} \
     | tail -n 1 | cut -d':' -f 2 | sed -e 's/^\s*//'
   register: new_auth_result
   failed_when: "'ERROR' in new_auth_result.stderr"
@@ -23,7 +23,7 @@
 - name: Check for existing SLC install (For AltairOne Units)
   ansible.builtin.shell: |-
     hubctl slcinstall list | awk '{print $1}' | tail -n +3 \
-    | grep /opt/altair/slc/2025
+    | grep {{ wps_installs.default }}
   ignore_errors: yes
   register: a1_slc_install
   environment:
@@ -34,7 +34,7 @@
 
 - name: Copy SLC install information (For AltairOne Units)
   ansible.builtin.command:
-    cmd: "hubctl slcinstall add /opt/altair/slc/2025"
+    cmd: "hubctl slcinstall add {{ wps_installs.default }}"
   environment:
     ALM_HHWU: "TRUE"
     ALM_HHWU_TOKEN: "{{ auth_token }}"
@@ -44,7 +44,7 @@
 - name: Check for existing SLC install (For ALM)
   ansible.builtin.shell: |-
     hubctl slcinstall list | awk '{print $1}' | tail -n +3 \
-    | grep /opt/altair/slc/2025
+    | grep {{ wps_installs.default }}
   register: alm_slc_install
   environment:
     ALM_HHWU: "FALSE"
@@ -54,7 +54,7 @@
 
 - name: Copy SLC install information (For ALM)
   ansible.builtin.command:
-    cmd: "hubctl slcinstall add /opt/altair/slc/2025"
+    cmd: "hubctl slcinstall add {{ wps_installs.default }}"
   environment:
     ALM_HHWU: "FALSE"
     ALTAIR_LICENSE_PATH: "{{ license.license_path }}"

terraform/azure_azuredns/certificates.tf

@@ -18,6 +18,15 @@ resource "acme_certificate" "hub" {
   account_key_pem          = acme_registration.reg.account_key_pem
   certificate_p12_password = var.acme_cert_password
 
+  # Azure DNS refuses non-recursive (RD=0) queries from arbitrary IPs, which
+  # is what LEGO uses for its authoritative propagation check. Disabling the
+  # authoritative check and using a public recursive resolver instead routes
+  # the check through RD=1 queries that Azure accepts from known resolvers.
+  disable_complete_propagation = true
+  recursive_nameservers        = ["8.8.8.8:53", "1.1.1.1:53"]
+
+  depends_on = [azurerm_dns_zone.zone]
+
   dns_challenge {
     provider = "azuredns"
     config = {