From a161888b8ffef95239eb4417c799867b7c4d2188 Mon Sep 17 00:00:00 2001
From: Daniel Marquardt <p1r9t3@codetical.com>
Date: Fri, 24 Jul 2026 18:35:01 -0700
Subject: [PATCH] Imported from GitHub repo

---
 ansible.cfg                  |  2 ++
 collections/requirements.yml |  3 +++
 inventory/prod/linux.yml     |  8 ++++++++
 inventory/prod/windows.yml   | 28 ++++++++++++++++++++++++++++
 playbook_update_linux.yaml   | 35 +++++++++++++++++++++++++++++++++++
 playbook_windows_update.yaml | 31 +++++++++++++++++++++++++++++++
 roles/requirements.yml       |  3 +++
 7 files changed, 110 insertions(+)
 create mode 100644 ansible.cfg
 create mode 100644 collections/requirements.yml
 create mode 100644 inventory/prod/linux.yml
 create mode 100644 inventory/prod/windows.yml
 create mode 100644 playbook_update_linux.yaml
 create mode 100644 playbook_windows_update.yaml
 create mode 100644 roles/requirements.yml

diff --git a/ansible.cfg b/ansible.cfg
new file mode 100644
index 0000000..6aec026
--- /dev/null
+++ b/ansible.cfg
@@ -0,0 +1,2 @@
+[defaults]
+interpreter_python=auto_silent
\ No newline at end of file
diff --git a/collections/requirements.yml b/collections/requirements.yml
new file mode 100644
index 0000000..9c1858c
--- /dev/null
+++ b/collections/requirements.yml
@@ -0,0 +1,3 @@
+collections:
+  # Installs the latest version from Ansible Galaxy
+  - name: ansible.windows
\ No newline at end of file
diff --git a/inventory/prod/linux.yml b/inventory/prod/linux.yml
new file mode 100644
index 0000000..1db3a12
--- /dev/null
+++ b/inventory/prod/linux.yml
@@ -0,0 +1,8 @@
+all:
+  children:
+    ubuntu:
+      hosts:
+        web01.internal.codetical.com:
+        pelican.internal.codetical.com:
+        pinas.internal.codetical.com:
+        pirateship.internal.codetical.com:
\ No newline at end of file
diff --git a/inventory/prod/windows.yml b/inventory/prod/windows.yml
new file mode 100644
index 0000000..717ba36
--- /dev/null
+++ b/inventory/prod/windows.yml
@@ -0,0 +1,28 @@
+all:
+  children:
+    domain_controllers:
+      hosts:
+        dc01.internal.codetical.com:
+      vars:
+        ansible_connection: winrm
+        ansible_port: 5986
+        #ansible_winrm_transport: kerberos
+        ansible_winrm_transport: ntlm
+        ansible_winrm_scheme: https
+        ansible_winrm_server_cert_validation: ignore
+        ansible_winrm_kinit_mode: managed
+    windows:
+      hosts:
+        dc02.internal.codetical.com:
+      vars:
+        ansible_connection: winrm
+        ansible_port: 5986
+        #ansible_winrm_transport: kerberos
+        ansible_winrm_transport: ntlm
+        ansible_winrm_scheme: https
+        ansible_winrm_server_cert_validation: ignore
+        ansible_winrm_kinit_mode: managed
+    win_all:
+      children:
+        domain_controllers:
+        windows:
\ No newline at end of file
diff --git a/playbook_update_linux.yaml b/playbook_update_linux.yaml
new file mode 100644
index 0000000..0bf3c49
--- /dev/null
+++ b/playbook_update_linux.yaml
@@ -0,0 +1,35 @@
+---
+- name: System maintenance and patching
+  hosts: ubuntu
+  become: true
+  tasks:
+    - name: Update package cache and upgrade all packages (Ubuntu/Debian)
+      ansible.builtin.apt:
+        upgrade: dist
+        update_cache: true
+      when: ansible_facts["os_family"] == "Debian"
+      become: true
+
+    - name: Upgrade all packages (RHEL/CentOS/Rocky)
+      ansible.builtin.dnf:
+        name: "*"
+        state: latest
+      when: ansible_facts["os_family"] == "RedHat"
+      become: true
+
+    - name: Check if a reboot is required (Ubuntu/Debian)
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: reboot_required_file
+      when: ansible_facts["os_family"] == "Debian"
+      become: true
+
+    - name: Reboot the server if required
+      ansible.builtin.reboot:
+        msg: "Reboot initiated by Ansible due to system updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+      when: 
+        - ansible_facts["os_family"] == "Debian"
+        - reboot_required_file.stat.exists
+      become: true
diff --git a/playbook_windows_update.yaml b/playbook_windows_update.yaml
new file mode 100644
index 0000000..93bf989
--- /dev/null
+++ b/playbook_windows_update.yaml
@@ -0,0 +1,31 @@
+- name: Apply Windows Updates
+  hosts: win_all
+  gather_facts: yes
+  vars:
+    initial_reboot: |-
+      {{ 86400 <
+          (( ((ansible_date_time.date+" "+ansible_date_time.time)|to_datetime('%Y-%m-%d %H:%M:%S')) -
+              ansible_facts.lastboot|to_datetime('%Y-%m-%d %H:%M:%SZ')).total_seconds())|abs }}
+  tasks:
+  - block:
+    - name: Install Updates And Reboot
+      ansible.windows.win_updates:
+        category_names:
+          - SecurityUpdates
+          - CriticalUpdates
+          - UpdateRollups
+          - DefinitionUpdates
+          - Updates
+        reboot: false
+        state: installed
+      become: yes
+      become_method: runas
+      become_user: SYSTEM
+      register: update_results
+
+    - name: Reboot explicitly if required
+      ansible.windows.win_reboot:
+        reboot_timeout: 3600
+        post_reboot_delay: 120
+        test_command: 'powershell.exe -Command "Get-Service WinRM"'
+      when: update_results.reboot_required
\ No newline at end of file
diff --git a/roles/requirements.yml b/roles/requirements.yml
new file mode 100644
index 0000000..0e84217
--- /dev/null
+++ b/roles/requirements.yml
@@ -0,0 +1,3 @@
+roles:
+  - name: manala.apt
+    src: manala.apt
\ No newline at end of file