fix(playbooks): add missing repo_baseos and repo_epel roles

CHANGELOG.md

@@ -25,6 +25,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* **playbooks/clamav, playbooks/duplicity, playbooks/fangfrisch, playbooks/influxdb, playbooks/mongodb, playbooks/python_venv**: Enable `repo_baseos` (CRB) and `repo_epel` on Rocky 9+ before the `python_venv` role to fix `No match for argument: python3-virtualenv` / `nothing provides python3-wheel-wheel needed by python3-virtualenv`.
+* **playbooks/setup_graylog_datanode, playbooks/setup_graylog_server, playbooks/setup_icinga2_master, playbooks/setup_rocketchat**: Extend existing `repo_baseos` `when` condition from `== "9"` to `| int >= 9` (Rocky 10+), and extend `repo_epel` version list to include RHEL/Rocky 10.
 * **playbooks/freeipa_client, playbooks/freeipa_server**: Set `strategy: 'linear'` explicitly so the playbooks work even when the user's `ansible.cfg` defaults to a strategy that reuses the target Python interpreter (e.g. `mitogen_linear`). The ansible-freeipa modules rely on `ipalib`'s global API singleton and otherwise fail with `API.bootstrap() already called` on the second module call.
 * **role:mariadb_server**: Fix MariaDB starting in the `unconfined_service_t` SELinux domain on RHEL 10, which leaves `/var/lib/mysql/mysql.sock` mislabeled and breaks `php-fpm`/`httpd_t` clients (e.g. Icinga Web 2 login: `SQLSTATE[HY000] [2002] Permission denied`). The unit drop-in's `ExecStartPre=-/bin/chcon -t mysqld_exec_t /usr/sbin/mariadbd` workaround for [MDEV-30520](https://jira.mariadb.org/browse/MDEV-30520) cannot relabel the binary on EL10+, where the packaged `mariadb.service` applies `ProtectSystem` that mounts `/usr` read-only inside the service sandbox. The role now sets the `mysqld_exec_t` file context for `/usr/sbin/mariadbd` persistently via `semanage fcontext` + `restorecon` (outside the systemd sandbox) and notifies a restart so the daemon comes up in `mysqld_t`.
 * **role:icinga2_master**: Fix `selinux` role failing on RHEL 10 with `SELinux boolean icinga2_can_connect_all is not defined in persistent policy` (and `[Errno 11]` for the other Icinga/Nagios booleans). The `icinga2-selinux` policy module references `nagios_*_plugin_t` types that were moved out of the EL10 base policy into the separate `nagios-selinux` package (EPEL), so without it the `icinga2-selinux` `%post` silently fails and the booleans never appear. The role now installs `nagios-selinux` as a separate pre-install task on RHEL 10 so its `%post` registers the required types before `icinga2-selinux`'s `%post` runs.

playbooks/README.md

@@ -203,7 +203,7 @@ Calls the following roles (in order):
 Calls the following roles (in order):
 
 * [repo_baseos](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_baseos): `duplicity__skip_repo_baseos`
-* [repo_epel](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_epel)
+* [repo_epel](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_epel): `duplicity__skip_repo_epel`
 * [python_venv](https://github.com/Linuxfabrik/lfops/tree/main/roles/python_venv): `duplicity__skip_python_venv`
 * [haveged](https://github.com/Linuxfabrik/lfops/tree/main/roles/haveged): `duplicity__skip_haveged`
 * [duplicity](https://github.com/Linuxfabrik/lfops/tree/main/roles/duplicity)
@@ -258,7 +258,9 @@ Calls the following roles (in order):
 
 Calls the following roles (in order):
 
-* [python_venv](https://github.com/Linuxfabrik/lfops/tree/main/roles/python_venv): `clamav__skip_python_venv`
+* [repo_baseos](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_baseos): `fangfrisch__skip_repo_baseos`
+* [repo_epel](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_epel): `fangfrisch__skip_repo_epel`
+* [python_venv](https://github.com/Linuxfabrik/lfops/tree/main/roles/python_venv): `fangfrisch__skip_python_venv`
 * [fangfrisch](https://github.com/Linuxfabrik/lfops/tree/main/roles/fangfrisch)
 
 
@@ -453,6 +455,8 @@ Calls the following roles (in order):
 Calls the following roles (in order):
 
 * [repo_influxdb](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_influxdb)
+* [repo_baseos](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_baseos): `influxdb__skip_repo_baseos`
+* [repo_epel](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_epel): `influxdb__skip_repo_epel`
 * [python_venv](https://github.com/Linuxfabrik/lfops/tree/main/roles/python_venv): `influxdb__skip_python_venv`
 * [influxdb](https://github.com/Linuxfabrik/lfops/tree/main/roles/influxdb)
 
@@ -614,6 +618,8 @@ Calls the following roles (in order):
 Calls the following roles (in order):
 
 * [kernel_settings](https://github.com/Linuxfabrik/lfops/tree/main/roles/kernel_settings): `mongodb__skip_kernel_settings`
+* [repo_baseos](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_baseos): `mongodb__skip_repo_baseos`
+* [repo_epel](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_epel): `mongodb__skip_repo_epel`
 * [python_venv](https://github.com/Linuxfabrik/lfops/tree/main/roles/python_venv): `mongodb__skip_python_venv`
 * [repo_mongodb](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_mongodb): `mongodb__skip_repo_mongodb`
 * [mongodb](https://github.com/Linuxfabrik/lfops/tree/main/roles/mongodb)
@@ -771,6 +777,8 @@ Calls the following roles (in order):
 
 Calls the following roles (in order):
 
+* [repo_baseos](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_baseos): `python_venv__skip_repo_baseos`
+* [repo_epel](https://github.com/Linuxfabrik/lfops/tree/main/roles/repo_epel): `python_venv__skip_repo_epel`
 * [python](https://github.com/Linuxfabrik/lfops/tree/main/roles/python): `python_venv__skip_python`
 * [python_venv](https://github.com/Linuxfabrik/lfops/tree/main/roles/python_venv)
 

playbooks/clamav.yml

@@ -12,45 +12,46 @@
 
   roles:
 
+    # On Rocky 9+, CRB (now in the Rocky default repo file, formerly in EPEL) must be
+    # enabled so python3-virtualenv can be installed.
     - role: 'linuxfabrik.lfops.repo_baseos'
       repo_baseos__crb_repo_enabled__dependent_var: '{{
           repo_epel__repo_baseos__crb_repo_enabled__dependent_var
         }}'
-      # Since the CRB repository is included in Rocky9 default repo file now, this will be done on Rocky9 Systems only. Formerly it came from epel repository.
       when:
-        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] == "9"'
+        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] | int >= 9'
         - 'not clamav__skip_repo_baseos | d(false)'
 
     - role: 'linuxfabrik.lfops.repo_epel'
       when:
-        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9"]'
-        - 'not clamav__skip_repo_epel | default(false)'
+        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9", "10"]'
+        - 'not clamav__skip_repo_epel | d(false)'
 
     - role: 'linuxfabrik.lfops.policycoreutils'
       when:
         - 'ansible_facts["os_family"] == "RedHat"'
-        - 'not clamav__skip_policycoreutils | default(false)'
+        - 'not clamav__skip_policycoreutils | d(false)'
 
     - role: 'linuxfabrik.lfops.selinux'
       selinux__booleans__dependent_var: '{{
           clamav__selinux__booleans__dependent_var
         }}'
       when:
         - 'ansible_facts["os_family"] == "RedHat"'
-        - 'not clamav__skip_selinux | default(false)'
+        - 'not clamav__skip_selinux | d(false)'
 
     - role: 'linuxfabrik.lfops.python_venv'
       python_venv__venvs__dependent_var: '{{
           fangfrisch__python_venv__venvs__dependent_var
         }}'
       when:
-        - 'not clamav__skip_python_venv | default(false)'
+        - 'not clamav__skip_python_venv | d(false)'
 
     - role: 'linuxfabrik.lfops.clamav'
 
     - role: 'linuxfabrik.lfops.fangfrisch'
       when:
-        - 'not clamav__skip_fangfrisch | default(false)'
+        - 'not clamav__skip_fangfrisch | d(false)'
 
 
   post_tasks:

playbooks/duplicity.yml

@@ -12,19 +12,20 @@
 
   roles:
 
+    # On Rocky 9+, CRB (now in the Rocky default repo file, formerly in EPEL) must be
+    # enabled so python3-virtualenv can be installed.
     - role: 'linuxfabrik.lfops.repo_baseos'
       repo_baseos__crb_repo_enabled__dependent_var: '{{
           repo_epel__repo_baseos__crb_repo_enabled__dependent_var
         }}'
-      # Since the CRB repository is included in Rocky9 default repo file now, this will be done on Rocky9 Systems only. Formerly it came from epel repository.
       when:
-        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] == "9"'
+        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] | int >= 9'
         - 'not duplicity__skip_repo_baseos | d(false)'
 
     - role: 'linuxfabrik.lfops.repo_epel'
       when:
-        - 'ansible_facts["os_family"] == "RedHat"'
-        - 'ansible_facts["distribution_major_version"] in ["7", "8", "9"]'
+        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9", "10"]'
+        - 'not duplicity__skip_repo_epel | d(false)'
 
     - role: 'linuxfabrik.lfops.python_venv'
       python_venv__venvs__dependent_var: '{{

playbooks/fangfrisch.yml

@@ -12,12 +12,27 @@
 
   roles:
 
+    # On Rocky 9+, CRB (now in the Rocky default repo file, formerly in EPEL) must be
+    # enabled so python3-virtualenv can be installed.
+    - role: 'linuxfabrik.lfops.repo_baseos'
+      repo_baseos__crb_repo_enabled__dependent_var: '{{
+          repo_epel__repo_baseos__crb_repo_enabled__dependent_var
+        }}'
+      when:
+        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] | int >= 9'
+        - 'not fangfrisch__skip_repo_baseos | d(false)'
+
+    - role: 'linuxfabrik.lfops.repo_epel'
+      when:
+        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9", "10"]'
+        - 'not fangfrisch__skip_repo_epel | d(false)'
+
     - role: 'linuxfabrik.lfops.python_venv'
       python_venv__venvs__dependent_var: '{{
           fangfrisch__python_venv__venvs__dependent_var
         }}'
       when:
-        - 'not clamav__skip_python_venv | default(false)'
+        - 'not fangfrisch__skip_python_venv | d(false)'
 
     - role: 'linuxfabrik.lfops.fangfrisch'
 

playbooks/influxdb.yml

@@ -14,6 +14,21 @@
 
     - role: 'linuxfabrik.lfops.repo_influxdb'
 
+    # On Rocky 9+, CRB (now in the Rocky default repo file, formerly in EPEL) must be
+    # enabled so python3-virtualenv can be installed.
+    - role: 'linuxfabrik.lfops.repo_baseos'
+      repo_baseos__crb_repo_enabled__dependent_var: '{{
+          repo_epel__repo_baseos__crb_repo_enabled__dependent_var
+        }}'
+      when:
+        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] | int >= 9'
+        - 'not influxdb__skip_repo_baseos | d(false)'
+
+    - role: 'linuxfabrik.lfops.repo_epel'
+      when:
+        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9", "10"]'
+        - 'not influxdb__skip_repo_epel | d(false)'
+
     - role: 'linuxfabrik.lfops.python_venv'
       python_venv__venvs__dependent_var: '{{
           influxdb__python_venv__venvs__dependent_var

playbooks/mongodb.yml

@@ -18,6 +18,21 @@
       when:
         - 'not mongodb__skip_kernel_settings | d(false)'
 
+    # On Rocky 9+, CRB (now in the Rocky default repo file, formerly in EPEL) must be
+    # enabled so python3-virtualenv can be installed.
+    - role: 'linuxfabrik.lfops.repo_baseos'
+      repo_baseos__crb_repo_enabled__dependent_var: '{{
+          repo_epel__repo_baseos__crb_repo_enabled__dependent_var
+        }}'
+      when:
+        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] | int >= 9'
+        - 'not mongodb__skip_repo_baseos | d(false)'
+
+    - role: 'linuxfabrik.lfops.repo_epel'
+      when:
+        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9", "10"]'
+        - 'not mongodb__skip_repo_epel | d(false)'
+
     - role: 'linuxfabrik.lfops.python_venv'
       python_venv__venvs__dependent_var: '{{
           mongodb__python_venv__venvs__dependent_var
@@ -27,7 +42,7 @@
 
     - role: 'linuxfabrik.lfops.repo_mongodb'
       when:
-        - 'not mongodb__skip_repo_mongodb | default(false)'
+        - 'not mongodb__skip_repo_mongodb | d(false)'
 
     - role: 'linuxfabrik.lfops.mongodb'
 

playbooks/python_venv.yml

@@ -12,6 +12,21 @@
 
   roles:
 
+    # On Rocky 9+, CRB (now in the Rocky default repo file, formerly in EPEL) must be
+    # enabled so python3-virtualenv can be installed.
+    - role: 'linuxfabrik.lfops.repo_baseos'
+      repo_baseos__crb_repo_enabled__dependent_var: '{{
+          repo_epel__repo_baseos__crb_repo_enabled__dependent_var
+        }}'
+      when:
+        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] | int >= 9'
+        - 'not python_venv__skip_repo_baseos | d(false)'
+
+    - role: 'linuxfabrik.lfops.repo_epel'
+      when:
+        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9", "10"]'
+        - 'not python_venv__skip_repo_epel | d(false)'
+
     - role: 'linuxfabrik.lfops.python'
       when:
         - 'not python_venv__skip_python | d(false)'

playbooks/setup_graylog_datanode.yml

@@ -15,20 +15,21 @@
     - role: 'linuxfabrik.lfops.policycoreutils'
       when:
         - 'ansible_facts["os_family"] == "RedHat"'
-        - 'not setup_graylog_datanode__skip_policycoreutils | default(false)'
+        - 'not setup_graylog_datanode__skip_policycoreutils | d(false)'
 
+    # On Rocky 9+, CRB (now in the Rocky default repo file, formerly in EPEL) must be
+    # enabled so python3-virtualenv can be installed.
     - role: 'linuxfabrik.lfops.repo_baseos'
       repo_baseos__crb_repo_enabled__dependent_var: '{{
           repo_epel__repo_baseos__crb_repo_enabled__dependent_var
         }}'
-      # Since the CRB repository is included in Rocky9 default repo file now, this will be done on Rocky9 Systems only. Formerly it came from epel repository.
       when:
-        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] == "9"'
+        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] | int >= 9'
         - 'not setup_graylog_datanode__skip_repo_baseos | d(false)'
 
     - role: 'linuxfabrik.lfops.repo_epel'
       when:
-        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9"]'
+        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9", "10"]'
 
     - role: 'linuxfabrik.lfops.python_venv'
       python_venv__venvs__dependent_var: '{{
@@ -49,7 +50,7 @@
 
     - role: 'linuxfabrik.lfops.mongodb'
       when:
-        - 'not setup_graylog_datanode__skip_mongodb | default(false)'
+        - 'not setup_graylog_datanode__skip_mongodb | d(false)'
 
     - role: 'linuxfabrik.lfops.repo_graylog'
       when:
@@ -61,7 +62,7 @@
         }}'
       when:
         - 'ansible_facts["os_family"] == "RedHat"'
-        - 'not setup_graylog_datanode__skip_selinux | default(false)'
+        - 'not setup_graylog_datanode__skip_selinux | d(false)'
 
     - role: 'linuxfabrik.lfops.graylog_datanode'
 

playbooks/setup_graylog_server.yml

@@ -15,7 +15,7 @@
     - role: 'linuxfabrik.lfops.policycoreutils'
       when:
         - 'ansible_facts["os_family"] == "RedHat"'
-        - 'not setup_graylog_server__skip_policycoreutils | default(false)'
+        - 'not setup_graylog_server__skip_policycoreutils | d(false)'
 
     - role: 'linuxfabrik.lfops.selinux'
       selinux__booleans__dependent_var: '{{
@@ -27,20 +27,21 @@
         }}'
       when:
         - 'ansible_facts["os_family"] == "RedHat"'
-        - 'not setup_graylog_server__skip_selinux | default(false)'
+        - 'not setup_graylog_server__skip_selinux | d(false)'
 
+    # On Rocky 9+, CRB (now in the Rocky default repo file, formerly in EPEL) must be
+    # enabled so python3-virtualenv can be installed.
     - role: 'linuxfabrik.lfops.repo_baseos'
       repo_baseos__crb_repo_enabled__dependent_var: '{{
           repo_epel__repo_baseos__crb_repo_enabled__dependent_var
         }}'
-      # Since the CRB repository is included in Rocky9 default repo file now, this will be done on Rocky9 Systems only. Formerly it came from epel repository.
       when:
-        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] == "9"'
+        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] | int >= 9'
         - 'not setup_graylog_server__skip_repo_baseos | d(false)'
 
     - role: 'linuxfabrik.lfops.repo_epel'
       when:
-        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9"]'
+        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9", "10"]'
 
     - role: 'linuxfabrik.lfops.python_venv'
       python_venv__venvs__dependent_var: '{{
@@ -64,7 +65,7 @@
 
     - role: 'linuxfabrik.lfops.mongodb'
       when:
-        - 'not setup_graylog_server__skip_mongodb | default(false)'
+        - 'not setup_graylog_server__skip_mongodb | d(false)'
 
     - role: 'linuxfabrik.lfops.repo_graylog'
       when:

playbooks/setup_icinga2_master.yml

@@ -81,18 +81,19 @@
 
   roles:
 
+    # On Rocky 9+, CRB (now in the Rocky default repo file, formerly in EPEL) must be
+    # enabled so python3-virtualenv can be installed.
     - role: 'linuxfabrik.lfops.repo_baseos'
       repo_baseos__crb_repo_enabled__dependent_var: '{{
           repo_epel__repo_baseos__crb_repo_enabled__dependent_var
         }}'
-      # Since the CRB repository is included in Rocky9 default repo file now, this will be done on Rocky9 Systems only. Formerly it came from epel repository.
       when:
-        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] == "9"'
+        - 'ansible_facts["distribution"] == "Rocky" and ansible_facts["distribution_major_version"] | int >= 9'
         - 'not setup_icinga2_master__skip_repo_baseos | d(false)'
 
     - role: 'linuxfabrik.lfops.repo_epel'
       when:
-        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9"]'
+        - 'ansible_facts["os_family"] == "RedHat" and ansible_facts["distribution_major_version"] in ["7", "8", "9", "10"]'
         - 'not setup_icinga2_master__repo_epel__skip_role__internal_var'
 
     - role: 'linuxfabrik.lfops.repo_mariadb'