Roles only run on intended supported OS, and minor cleanup of when statements to match

Fix license and readme files
Agents, style, and editor
2026-09-01 22:01:59 -05:00 · 2026-09-01 21:48:28 -05:00 · 2026-09-01 21:46:43 -05:00 · 2026-08-15 21:42:48 -05:00 · 2026-08-11 00:34:15 -05:00 · 2026-08-11 00:28:29 -05:00
848 changed files with 11858 additions and 22294 deletions
@@ -0,0 +1,3 @@
 ---
 skip_list:
  - var-naming[no-role-prefix]
@@ -0,0 +1,109 @@
 # EditorConfig Specification: https://EditorConfig.org
 root = true
 # Universal Defaults
 [*]
 charset = utf-8
 end_of_line = lf
 indent_size = 2
 indent_style = space
 insert_final_newline = true
 trim_trailing_whitespace = true
 # Markdown & Documentation
 [*.md]
 trim_trailing_whitespace = false
 # Ansible & YAML Configuration
 [*.{yml,yaml}]
 indent_size = 2
 indent_style = space
 # Infrastructure as Code (OpenTofu / Terraform)
 [*.{tf,tfvars,tofu}]
 indent_size = 2
 indent_style = space
 # JSON Data Files
 [*.json]
 indent_size = 2
 indent_style = space
 # Rust (Rust standard mandates 4 spaces)
 [*.rs]
 indent_size = 4
 indent_style = space
 # Python
 [*.py]
 indent_size = 4
 indent_style = space
 # Perl
 [*.{pl,pm,t,pod}]
 indent_size = 4
 indent_style = space
 # Systems Programming (C, C++, Headers, eBPF)
 [*.{c,cc,cpp,cxx,h,hh,hpp,hxx,bpf.c,bpf.h}]
 indent_size = 4
 indent_style = space
 # Low-Level Assembly (x86_64, aarch64, riscv, Linker Scripts)
 [*.{s,S,asm,ld,lds}]
 indent_style = tab
 indent_size = 8
 # Device Tree (Linux Kernel Hardware Trees)
 [*.{dts,dtsi}]
 indent_style = tab
 indent_size = 8
 # Parser & Lexer Grammars (Bison / Flex / Yacc)
 [*.{y,l,yy,ll}]
 indent_style = tab
 indent_size = 8
 # Linux Kernel Kconfig / Kbuild
 [{Kconfig*,Kbuild*,*.kconfig}]
 indent_style = tab
 indent_size = 8
 # Makefiles & Build Systems (Hard tabs mandated by spec)
 [{Makefile*,*.mk}]
 indent_style = tab
 # AWK & Sed Scripts
 [*.{awk,sed}]
 indent_size = 4
 indent_style = space
 # Java
 [*.java]
 indent_size = 4
 indent_style = space
 # Go (Golang standard enforces hardware tabs)
 [*.go]
 indent_style = tab
 indent_size = 4
 # PHP
 [*.php]
 indent_size = 4
 indent_style = space
 # UNIX / POSIX Shells (Bash, Sh, Ksh, Csh, Tcsh, Zsh)
 [*.{sh,bash,ksh,csh,tcsh,zsh}]
 indent_size = 2
 indent_style = space
 # Windows PowerShell & Batch Scripts
 [*.{ps1,psm1,psd1}]
 indent_size = 4
 indent_style = space
 [*.{bat,cmd}]
 end_of_line = crlf
 indent_size = 2
 indent_style = space
@@ -0,0 +1,7 @@
 ---
 extends: default
 rules:
  line-length:
    max: 160
  comments-indentation: disable
@@ -0,0 +1,556 @@
 # AGENTS.md
 > ### Normative Requirement Levels (RFC 2119 / RFC 8174)
 > The key words **MUST**, **MUST NOT**, **REQUIRED**, **SHALL**, **SHALL NOT**, **SHOULD**, **SHOULD NOT**, **RECOMMENDED**, **NOT RECOMMENDED**, **MAY**, and **OPTIONAL** in this document are to be interpreted as described in [BCP 14](https://www.rfc-editor.org/info/bcp14) ([RFC 2119](https://www.rfc-editor.org/rfc/rfc2119.txt) and [RFC 8174](https://www.rfc-editor.org/rfc/rfc8174.txt)) when, and only when, they appear in all capitals, as shown here.
 ### Governance Hierarchy & Precedence
 1. **Federal Mandates & Core Security Controls** (`AGENTS.md` Sections 1–4, 13, 16–20) take ultimate precedence over all other guidelines.
 2. **Technical & Architectural Standards** (`AGENTS.md`) take precedence over stylistic preferences (`STYLE.md`).
 3. **Correctness > Performance > Cost > Style**: Formatting or performance optimizations MUST NOT compromise compliance, idempotency, or operational resilience.
 ## 1. Security & Compliance Baselines
 1. **Compliance by Default & Framework Hierarchy**: All architectural designs, system configurations, and automated implementations MUST strictly adhere to established security and compliance frameworks in the following priority order:
   - **Federal & Legal Mandates**:
     - NDAA Section 889 and TAA (Trade Agreements Act) compliance for all underlying hardware, appliances, cloud regions, and firmware.
     - Executive Order 14028 (Improving the Nation's Cybersecurity) and OMB M-22-18 / M-23-16 software supply chain mandates.
   - **Core Security Frameworks & NIST Special Publications**:
     - Master Catalog: **NIST SP 800-53 (Rev. 5)** (Security and Privacy Controls).
     - Domain-Specific NIST Companion Standards (Triggered and enforced whenever the respective technology domain is utilized):
       - *Containers & Virtualization*: **NIST SP 800-190** (Application Container Security) & **SP 800-125A/B**.
       - *Microservices & Service Mesh*: **NIST SP 800-204 (A/B/C)** (Microservices Architecture, Service Mesh & API Gateways).
       - *Zero Trust Architecture*: **NIST SP 800-207** (Zero Trust Architecture).
       - *Software Development Lifecycle*: **NIST SP 800-218** (Secure Software Development Framework - SSDF).
       - *Supply Chain Security*: **NIST SP 800-161 (Rev. 1)** (Cybersecurity Supply Chain Risk Management).
       - *Digital Identity & Cloud Access*: **NIST SP 800-63-3/4** (Digital Identity) & **SP 800-210** (Cloud Access Control).
       - *Configuration & Patching*: **NIST SP 800-128** (Configuration Management) & **SP 800-40 (Rev. 4)** (Patch Management).
       - *Log Management & Telemetry*: **NIST SP 800-92** (Log Management) & **SP 800-137** (Continuous Monitoring).
       - *Controlled Unclassified Information*: **NIST SP 800-171 / SP 800-172** (Protecting CUI).
       - *Media Sanitization*: **NIST SP 800-88 (Rev. 1)** (Media Sanitization).
   - **Technical Hardening Baselines & Agency Guides**:
     - DISA STIGs and CIS Benchmarks (Level 2 where applicable, Level 1 minimum).
     - NSA/CISA Technical Hardening Guides (Kubernetes, Network Infrastructure, IAM).
     - FedRAMP High / DoD Cloud Computing Security Requirements Guide (DoD CC SRG IL4/IL5/IL6).
   - **Industry Regulatory Standards**:
     - PCI-DSS, HIPAA Security Rule, and ISO/IEC 27001/27002 where domain requirements apply.
 2. **Evaluation Hierarchy**: Correctness and compliance MUST supersede performance optimizations; performance MUST supersede cost considerations (`Correctness > Performance > Cost`). Factory defaults must not be assumed secure; explicitly configure baseline security controls.
 ## 2. Supply Chain Integrity & Licensing Policy
 1. **Supply Chain Security & Provenance**:
   - All third-party packages, libraries, collections, and containers MUST adhere to SLSA (Supply-chain Levels for Software Artifacts) Level 3+ and OpenSSF Best Practices.
   - Cryptographic verification (checksums, GPG signatures, or Sigstore/Cosign provenance) MUST be explicitly defined and verified before installing or executing any artifact.
   - Dependencies MUST use pinned versions or immutable digests (e.g., SHA-256 commit hashes or container image digests) rather than mutable tags (e.g., `latest`, `main`).
 2. **Explicit Licensing Governance Matrix**:
   - **Tier 1 (Pre-Approved Permissive & Copyleft)**:
     - Permissive: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0.
     - Weak/File-Level Copyleft: MPL-2.0, LGPLv3 (when linked dynamically).
     - Strong Copyleft (Standalone Applications / System Utilities): GPLv3, AGPLv3 (prohibited as statically linked library dependencies in proprietary applications; approved for standalone infrastructure tools/services).
   - **Tier 2 (Conditional / Requires Human Architectural Review)**:
     - EPL-2.0, EUPL-1.2, or proprietary commercial vendor licenses with explicit contractual coverage.
   - **Tier 3 (Strictly Prohibited / Banned)**:
     - **ZFS / OpenZFS / CDDL-1.0 Kernel Modules**: ZFS is PERMANENTLY PROHIBITED under any circumstance due to:
       1. *Licensing Incompatibility*: Rooted in unmaintained CDDL-1.0 from OpenSolaris, creating fundamental legal incompatibility with the GPLv2 Linux kernel.
       2. *Hardware & Memory Overhead*: Mandates an excessive baseline of 4GB+ ECC RAM merely to import and mount pools (ARC/slab memory starvation).
       3. *DKMS Fragility*: Out-of-tree DKMS module compilation breaks repeatedly during kernel updates on enterprise distributions (RHEL/Fedora).
       4. *On-Disk Divergence & Data Recovery Impossibility*: OpenZFS shares only the name with Oracle Solaris 11 ZFS, possessing completely diverged on-disk structures. In catastrophic corruption events, third-party forensic recovery services cannot salvage corrupted encrypted pools, resulting in permanent unrecoverable data loss.
       - Storage architectures MUST strictly utilize native in-tree Linux filesystems and volume managers (XFS, Ext4, LVM2, dm-crypt/LUKS, dm-snapshot, Btrfs, or Ceph).
     - Source-available non-OSI licenses that restrict commercial, hosted, or competitive use: BSL (Business Source License), SSPL (Server Side Public License), Elastic License, Commons Clause, Confluent Community License, Redis Source Available License (RSAL), HashiCorp BSL.
     - Unlicensed, "All Rights Reserved" code with no grant, or "free for non-commercial use only" restrictions.
   - Any dependency falling into Tier 3 MUST NOT be introduced, referenced, or recommended under any circumstance.
 3. **Language-Specific Package (Pip, NPM, Cargo) Supply Chain Controls**:
   - Direct installation of language packages from public registries (e.g., `pip install` from PyPI, `npm install` from npmjs) directly onto target servers is STRICTLY PROHIBITED.
   - All language-specific modules and dependencies MUST be:
     1. Built into native cryptographically signed OS packages (RPM/DEB) via internal build pipelines; OR
     2. Sourced from an authenticated, internal artifact repository (e.g., private mirror/wheelhouse) containing locked dependency manifests (`requirements.txt` with SHA-256 hashes, `Pipfile.lock`, `poetry.lock`) that have passed static analysis, SBOM generation, and CVE scanning.
 4. **OS Package vs. Standalone Binary Installation Governance**:
   - **OS Packages (RPM/DEB via Cryptographically Signed Repositories)**: Component installation MUST use `state: present` (or parameterized release tags). Automated security patch application is governed centrally by dedicated patch management roles (`ensure_os_patch` / `ensure_os_upgrade`) tracking official vendor errata.
   - **Standalone Binaries, Tarballs & Containers**: MUST enforce exact version pinning and cryptographic SHA-256 digest validation.
 ## 3. Prerequisite Verification & System Preconditions
 1. **Explicit Precondition Validation**:
   - Systems, playbooks, scripts, and modules MUST NEVER assume prerequisites exist (e.g., specific OS release, kernel capabilities, architecture, network routes, package managers, user permissions, or installed binaries).
   - Every execution sequence MUST explicitly test and validate required preconditions before initiating state changes.
 2. **Fail-Fast with Actionable Diagnostics**:
   - If an environmental or technical prerequisite is missing or unsupported, execution MUST fail immediately with an explicit, structured error message identifying the missing requirement, expected vs. observed state, and remediation steps.
   - Do NOT attempt destructive fallback workarounds (e.g., blindly forcing installation on unsupported OS releases or bypassing failed signature checks).
 ## 4. State Management: Least Change & Complete Enforcement
 1. **Principle of Least Change**:
   - Modifications MUST represent the minimal necessary delta from factory/upstream defaults required to satisfy security baselines, compliance rules, and operational requirements.
   - Do NOT rewrite or override stock configurations entirely when targeted configuration directives (e.g., `.d` drop-in directories, specific key-value updates) achieve the desired outcome.
 2. **Complete Desired State Enforcement & Idempotency**:
   - Every automation task and configuration management unit MUST achieve a complete, deterministic, and idempotent desired state.
   - Partial or unmanaged states (e.g., leaving orphaned temporary files, unmanaged legacy configuration entries, or unverified service restarts) are prohibited.
   - Repeated executions against an already compliant system MUST result in zero changes (no state drift, no unnecessary restarts or side effects).
 ## 5. Architectural Decoupling: Code and Data Separation
 1. **Strict Decoupling of Logic and Configuration**:
   - Execution logic (code, playbooks, task lists, scripts) MUST be completely decoupled from platform-specific and environment-specific data (variables, package names, service handles, filesystem paths, OS parameters).
   - Execution flows MUST remain generic, deterministic, and consistent across target environments, with variance driven exclusively by loaded structured data.
 2. **Platform & Architecture Resolution Matrix**:
   - Platform differences (OS distribution, major/minor version, CPU architecture) MUST be resolved via explicit data lookup tables or structured variable files rather than nested procedural conditionals (`if/else` or sprawling `when:` chains) inside task definitions.
   - **Dynamic OS Task & Pre-Task Dispatching Hierarchy**:
     - Where platforms share 90% common tasks but require vendor-specific adjustments (e.g., Debian cdrom cleanup in `sources.list`, Red Hat subscription registration), roles MUST use dynamic `first_found` pre-task inclusion:
       `include_tasks: '{{ lookup("first_found", findme) }}'` searching `{{ distribution }}-{{ major_version }}-{{ arch }}.yml` -> `{{ os_family }}-default.yml` -> `default.yml`.
     - Where platforms require completely distinct execution modules (e.g., Linux vs. Windows 11 Pro PowerShell/WinRM), roles MUST dispatch to dedicated OS family task entrypoints (`tasks/Linux.yml`, `tasks/Windows.yml`).
   - All hardcoded magic strings, static system paths, and embedded constants within execution blocks are strictly prohibited.
 ## 6. Multi-Domain Technical Review & Clarification Protocol
 1. **Panel of Experts Evaluation**:
   - Complex architectural and implementation decisions MUST be evaluated across key technical disciplines: Security & Compliance SME, Systems/OS Architecture SME, Network/Infrastructure SME, and Site Reliability/Operations SME.
   - Trade-offs MUST be explicitly analyzed through this multi-perspective lens, ensuring no single dimension (e.g., raw execution speed or developer convenience) compromises security, maintainability, or operational resilience.
 2. **Mandatory Ambiguity Clarification**:
   - When encountering underspecified requirements, conflicting constraints, or unknown target environment baselines, agents MUST pause and request specific clarification and background context from human engineers.
   - Speculative implementation based on unverified assumptions is strictly prohibited.
 ## 7. Incremental Foundations & Evolutionary Architecture
 1. **Foundational Pragmatism**:
   - Technical solutions MUST prioritize robust, verifiable, and working foundations for current operational requirements before attempting large-scale speculative abstractions.
   - Brittle workarounds or temporary "quick hacks" that accumulate technical debt are prohibited; initial implementations must establish clean, extensible patterns.
 2. **Designed for Incremental Evolution**:
   - All modules, roles, and architectural layers MUST be designed with modularity to support continuous, incremental refinement and scaling over time.
   - Future architectural scaling must build upon and extend verified foundations rather than requiring destructive, rip-and-replace refactors.
 ## 8. Ansible Technical Standards & Role Architecture
 1. **Standardized Role Naming & Scoping**:
   - Roles MUST follow the naming convention `ensure_XXX`, where `XXX` represents the specific package, service, or system capability being managed (e.g., `ensure_sshd`, `ensure_chrony`, `ensure_firewalld`).
   - Each role MUST be single-purpose, cohesive, and completely manage the lifecycle of its target component.
 2. **Deterministic Task Execution Order**:
   - Role task execution MUST follow a standardized lifecycle order across all roles:
     1. **Prerequisite & Fact Validation**: Assert supported OS, architecture, kernel, and dependencies.
     2. **Data Loading**: Load platform-specific variables dynamically based on OS vendor, version, and architecture.
     3. **Installation**: Install or remove packages, binaries, and repositories with cryptographic verification.
     4. **Configuration**: Apply configuration files, drop-in directories, and permissions (least privilege).
     5. **Service Management**: Enable, start, or manage daemon state and register notifications/handlers.
     6. **Post-Validation / Health Verification**: Execute end-state verification to prove correct operational state.
 3. **Platform Data Resolution Hierarchy**:
   - Platform-specific variables MUST reside in `vars/` and follow a deterministic naming schema based on OS Vendor, OS Major Version, and Architecture (e.g., `vars/{{ ansible_distribution }}_{{ ansible_distribution_major_version }}_{{ ansible_architecture }}.yml`).
   - Tasks MUST NOT embed OS-specific branching logic (`when: ansible_os_family == '...'`) for package names, service names, or configuration paths.
 4. **Templates and Static Files Directory Hierarchy**:
   - Templates MUST be organized reflecting target OS distribution, major version, and target filesystem path:
     `templates/{{ ansible_distribution }}/{{ ansible_distribution_major_version }}/${PATH_ON_DISK}/${FILENAME}` (e.g., `templates/RedHat/9/etc/ssh/sshd_config.j2`).
   - Static files and binaries (copied with overwrite enforcement) MUST follow the exact same structural hierarchy:
     `files/{{ ansible_distribution }}/{{ ansible_distribution_major_version }}/${PATH_ON_DISK}/${FILENAME}` (e.g., `files/Ubuntu/22/usr/local/bin/custom_daemon`).
 5. **Role Dependency & Feature Composition**:
   - When a service or role requires a prerequisite system feature, subsystem, or daemon (e.g., a firewall port, a system user, a logging pipeline, or TLS certificates), it MUST declare and depend on the existing `ensure_YYY` role responsible for that feature.
   - Roles MUST NEVER duplicate configuration logic, package installations, or state mutations managed by another role.
 6. **Fleet Scale-Up Maturity & Multi-Node Topology Governance**:
   - **Scale-Dependent Architectural Progression**: Systems MUST adopt the architectural pattern appropriate to their deployment scale:
     - **Tier 1 (< 100 nodes)**: Direct sequential play ordering within standard playbooks.
     - **Tier 2 (100 – 1,000 nodes)**: Decoupled service contracts using non-blocking readiness probes (`wait_for`, endpoint socket polling) before binding cross-node services.
     - **Tier 3 (1,000 – 10,000 nodes)**: Workflow DAG orchestration (AWX/AAP/CI) operating on isolated tenant inventory slices (`--limit`) with dynamic service discovery (DNS, Consul, Vault).
     - **Tier 4 (> 10,000 nodes)**: Bifurcated architecture:
       a. Fleet-wide drift management via staggered pull-based reconciliation (`ansible-pull` or local daemon).
       b. New tenant/host provisioning orchestrated via central workflow pipelines.
   - **Cross-Node Readiness Contracts**: When a service depends on an external service residing on a distinct host (e.g., Web -> DB), the consumer role MUST execute an active readiness assertion against the target endpoint with an explicit timeout. Consumers MUST NOT assume external dependencies exist merely because a prior play completed.
 ## 9. Shift-Left Validation & Universal Fail-Fast Hierarchy
 1. **Shift-Left Failure Hierarchy (All Languages & Frameworks)**:
   - Validation MUST occur at the earliest possible stage in the development and execution lifecycle:
     1. **Static Analysis & Schema Validation (Shift-Left Tier 1)**: Any syntax, type constraint, linting rule, security policy (e.g., Open Policy Agent, Checkov, yamllint, ansible-lint), or structural requirement MUST fail during static analysis before code execution or pipeline progression.
     2. **Preflight Runtime Assertion (Shift-Left Tier 2)**: Environmental requirements, dynamic facts, and input variables MUST be asserted at the very first step of execution before any mutation or side-effect occurs.
     3. **Atomic Execution Failure (Shift-Left Tier 3)**: Operations MUST fail immediately upon encountering an unexpected state, refusing to proceed with partial, corrupt, or unverified changes.
 2. **Actionable Diagnostic Requirement**:
   - All validation failures (static or runtime) MUST produce clear, structured diagnostics stating: the failed constraint, observed vs. expected value, and the explicit remediation step.
 ## 10. Deployment Lifecycle, Health Gateways & Rollback Resilience
 1. **Pre-Change Health & Baseline Validation**:
   - Prior to applying any configuration, infrastructure, or code change, the execution sequence MUST validate that the target environment and dependent services are in a healthy, operational baseline state.
   - Pre-change checks MUST be adapted to the specific component being deployed (e.g., verifying database connectivity, checking existing daemon health, validating DNS/network routing, verifying available disk/memory thresholds).
   - If the pre-change health state fails, deployment MUST halt immediately before mutating any state.
 2. **Post-Change Operational & Functional Verification**:
   - Deployment sequences MUST NOT consider a change successful merely because an installer or configuration module exited with status code zero.
   - Every deployment MUST execute active functional verification against the resulting state:
     - The process/service is active and enabled.
     - Sockets and network endpoints are listening and accepting connections.
     - Application-level synthetic transaction succeeds (e.g., for a web service: HTTP 200 OK with expected payload content, zero 5xx/4xx error pages; for a database: successful query execution).
   - If post-change verification fails, execution MUST fail fast with detailed operational telemetry.
 3. **Reversibility & Non-Destructive Failure**:
   - Deployments MUST be engineered to be non-destructive to prior working states.
   - If a new deployment fails during application or post-verification, the system MUST not leave services in a degraded or corrupted state; atomic rollback strategies, staged deployments, or transaction-safe backups MUST be implemented to preserve or restore the last-known-good operational state.
 ## 11. Infrastructure as Code (Terraform / OpenTofu) Technical Architecture
 1. **Deterministic Single-Directive File Hierarchy**:
   - Every file MUST contain a single directive and MUST follow the naming convention:
     `<DIRECTIVE_TYPE>.<SUBTYPE_OR_DATATYPE>.<HUMAN_NAME>.tf`
     - Resources: `resource.<RESOURCE_TYPE>.<RESOURCE_NAME>.tf` (e.g., `resource.aws_s3_bucket.audit_logs.tf`)
     - Data Sources: `data.<DATA_TYPE>.<DATA_NAME>.tf` (e.g., `data.aws_ami.hardened_linux.tf`)
     - Variables: `variable.<DATATYPE>.<VAR_NAME>.tf` (e.g., `variable.string.environment_name.tf`)
     - Locals: `local.<DATATYPE>.<LOCAL_NAME>.tf` (e.g., `local.map.network_routing.tf`)
     - Outputs: `output.<DATATYPE>.<OUTPUT_NAME>.tf` (e.g., `output.string.database_endpoint.tf`)
     - Checks: `check.<CHECK_TYPE>.<CHECK_NAME>.tf` (e.g., `check.http.ingress_health.tf`)
 2. **Modern Declarative Validation over Legacy Anti-Patterns**:
   - Modern native constructs MUST be used in place of deprecated legacy patterns:
     - Use native `precondition` and `postcondition` lifecycle blocks within resources and data sources for state validation.
     - Use native `check` blocks with `assert` conditions for non-blocking continuous infrastructure health monitoring.
     - Legacy workarounds (e.g., `null_resource` triggers and local-exec scripts used for validation or state orchestration) are strictly prohibited; use `terraform_data` only when custom state triggers are strictly required.
 3. **Refactoring & Historical Lineage (`moved` blocks)**:
   - Any resource renaming, refactoring, or state migration MUST define an explicit `moved` block to prevent destructive destroy-and-recreate actions.
   - Files containing `moved` blocks (`moved.tf` or `moved.<RESOURCE_NAME>.tf`) MUST chronologically group and sort the complete evolution of each resource from oldest to newest transition before moving to subsequent resources.
 ## 12. Dependency Lifecycle, Enterprise OS Backporting & Support Matrix Governance
 1. **Exact Pinning & Staged Upgrade Lifecycle**:
   - All third-party providers, modules, packages, and images MUST be pinned to exact versions or immutable hashes.
   - Upstream releases MUST follow a staged rollout: automated test suite verification -> staging soak period -> production deployment.
 2. **Enterprise OS Versioning & Certified Configuration Discrepancy Protocol (RHEL / Clones / EUS)**:
   - **Backport & Patch-Level Awareness**: For enterprise distributions (e.g., RHEL, AlmaLinux, Rocky Linux) that maintain minor release streams with backported security fixes (e.g., Extended Update Support / EUS), version validation MUST evaluate effective vendor patch level and security compliance rather than naive raw upstream semantic version string comparison.
   - **Certified Baseline Reconciliation**: When third-party vendor certification mandates a specific minor release baseline (e.g., certified on RHEL 9.4), systems MUST lock to that supported stream while actively tracking and verifying vendor-backported security errata through official repository channels.
 3. **Support Matrix Compliance & Upstream Sunset Protocol**:
   - All components MUST remain within actively supported vendor maintenance windows.
   - If an upstream provider, library, or package has not had an active release or security patch within a 12-month period, it MUST be flagged as abandoned, initiating a mandatory 90-day evaluation and migration to an actively supported alternative.
 ## 13. Cryptographic Standards, Post-Quantum Security & Data Protection
 1. **Zero Plaintext Credentials**:
   - Hardcoded secrets, API tokens, cleartext passwords, private keys, and unencrypted credentials in repositories, task files, templates, or commit histories are strictly prohibited.
   - All sensitive data MUST be injected dynamically via approved secrets managers (e.g., HashiCorp Vault, cloud KMS, OS secret stores, or encrypted Ansible Vault with separate key management).
 2. **Log Redaction & Leakage Prevention**:
   - Any automation task or module processing credentials, private keys, or sensitive payload data MUST explicitly suppress logging output (e.g., `no_log: true` in Ansible, `sensitive = true` in Terraform/OpenTofu).
   - CI/CD execution logs, terminal output, and failure diagnostic messages MUST NOT emit sensitive tokens or environment variables.
 3. **Approved Cryptographic Suites & Post-Quantum Cryptography (PQC) Standards**:
   - **Post-Quantum Cryptography (PQC) Mandate**: Systems MUST prefer and implement NIST-standardized Post-Quantum Cryptographic algorithms and hybrid schemes where supported:
     - Key Encapsulation Mechanisms (KEM): FIPS 203 (ML-KEM / Kyber) or Hybrid KEM (e.g., `X25519MLKEM768` / `X25519Kyber768` in TLS 1.3 and SSH).
     - Digital Signatures: FIPS 204 (ML-DSA / Dilithium) and FIPS 205 (SLH-DSA / SPHINCS+).
   - **PQC Network MTU & Fragmentation Mitigation**: Because post-quantum key exchanges produce significantly larger public keys and ciphertexts (800–1568 bytes), network devices and tunnel endpoints (WireGuard/IPsec) MUST enable TCP MSS clamping (`--clamp-mss-to-pmtu`) and jumbo frames on internal mesh networks to eliminate packet fragmentation and handshake drops.
   - **Approved Symmetric Encryption**: AES-256-GCM, AES-256-XTS (for block/disk storage), ChaCha20-Poly1305.
   - **Approved Cryptographic Hashing**: SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, BLAKE2b/s.
   - **Approved Classical Asymmetric Key Exchange & Signatures**: Ed25519 / Ed448, ECDSA (NIST P-384 minimum), RSA (>= 3072-bit minimum).
   - **Approved Password Hashing / KDF**: Argon2id (preferred), PBKDF2 (HMAC-SHA512, >= 600,000 iterations), scrypt.
 4. **Data Protection at Rest**:
   - All persistent data, volume block storage, database storage, object buckets, and backups MUST be encrypted at rest using AES-256-GCM or XTS-AES-256 with automated KMS/HSM key rotation (minimum 365-day rotation cycle).
   - Direct key storage alongside encrypted data is strictly prohibited (envelope encryption mandatory).
 5. **Data Protection in Transit**:
   - All network communication MUST be encrypted in transit using TLS 1.3 (preferred with hybrid PQC key exchange) or TLS 1.2 (minimum, strictly requiring Perfect Forward Secrecy / PFS cipher suites).
   - Mutual TLS (mTLS) with cryptographically validated certificates MUST be enforced for all inter-service, microservice, and cluster RPC communication.
 6. **Strictly Prohibited Protocols & Algorithms**:
   - Deprecated ciphers/hashing: MD5, SHA-1, DES, 3DES, RC4, Blowfish, single AES-CBC without HMAC.
   - Insecure/Cleartext protocols: SSLv2, SSLv3, TLS 1.0, TLS 1.1, SSH-1, unencrypted HTTP, Telnet, FTP, unencrypted SNMPv1/v2c.
 7. **Dynamic Credential Lifecycles & Zero-Downtime Secret Rotation**:
   - **Preference for Dynamic Ephemeral Secrets**: Workloads interacting with databases, cloud APIs, and microservices SHOULD consume short-lived, dynamically generated credentials (e.g., HashiCorp Vault Database Secrets Engine with automatic TTL leases and automatic revocation).
   - **Dual-Credential Rollover Pattern (Two-Phase Commit)**: When persistent credentials (e.g. static database users, API tokens, SSH keys) are rotated, automation MUST NOT perform single-step destructive overwrites. Rotation MUST follow a Two-Phase commit:
     1. Stage and create the new credential alongside the existing active credential.
     2. Update consumer service configuration and reload.
     3. Execute post-change synthetic verification (Section 10.2).
     4. If verification passes, revoke/drop the legacy credential; if verification fails, roll back configuration to the legacy credential and fail fast.
   - **Idempotent Reconciliation**: Automated periodic runs (e.g. hourly fleet drift runs) MUST NOT generate new credentials unless a rotation trigger or TTL expiration has occurred, ensuring repeated runs remain idempotent with zero unnecessary service reloads.
 ## 14. Cross-Platform Portability, Shebang Architecture & Tool Resolution
 1. **Explicit Portability Scope Declaration**:
   - Every script, utility, and automation hook MUST explicitly declare whether it is **Portable (Multi-OS/Multi-Vendor)** or **Target-Specific (Single OS/Platform)**.
 2. **Interpreter Resolution via `env`**:
   - Portable scripts MUST use `#!/usr/bin/env <interpreter>` (e.g., `#!/usr/bin/env bash`, `#!/usr/bin/env python3`) to account for varying binary installation prefixes across operating systems (`/usr/bin`, `/usr/local/bin`, `/opt/homebrew/bin`).
 3. **Downstream Utility Discovery & Syntax Harmonization**:
   - If a script relies on `env` for portability, it MUST NOT assume GNU-specific extensions, BSD-specific flags, or non-standard utility paths (e.g., `/usr/ucb/bin/grep` vs `/usr/bin/grep` vs `/usr/gnu/bin/grep`).
   - Portable scripts MUST either:
     a. Restrict all utility invocations (`grep`, `sed`, `awk`, `find`, `tar`, `date`) strictly to POSIX IEEE Std 1003.1 baseline options; OR
     b. Implement explicit preflight discovery functions (e.g., resolving `command -v ggrep || command -v grep`) and validate required capability flags before execution.
 4. **Target-Specific Scripts**:
   - Scripts designed strictly for a specific OS vendor/release MUST assert the host platform during preflight and use explicit, verified binary paths or managed environment wrappers.
 ## 15. Section 508 Accessibility & Universal Design Baseline
 1. **Section 508 & WCAG 2.1 AA Compliance Mandate**:
   - All automation outputs, diagnostic messages, CLI tooling, technical documentation, and repository structures MUST comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d) and WCAG 2.1 Level AA standards.
 2. **Screen Reader & Assistive Tech Operability**:
   - Diagnostic outputs, terminal logs, and system error messages MUST provide plain, structured textual explanations. Visual-only ASCII decorations, pseudo-tables without headers, and unannounced status color codes (without accompanying textual status strings) are strictly prohibited.
   - Code comments and technical documentation MUST use semantic markdown with explicit alternative text (`alt` text) for all architectural diagrams and workflows.
   - **Audio Cognitive Ergonomics & Flat Data Structures**: Automation variables, task definitions, and configuration schemas SHOULD avoid deeply nested structures (> 4 levels) and repetitive identical keys that cause audio cognitive fatigue on screen readers and speech synthesizers. Task names MUST be phrased as concise, natural spoken sentences.
 3. **Speech-to-Text & Voice-Coding Compatibility**:
   - Identifier naming, API tokens, and command-line flags MUST be phonetically distinguishable and avoid ambiguous single-character or easily mispronounced/misrecognized homophones to support engineers using voice input systems (e.g., Talon Voice, Dragon).
 4. **Editor Configuration Decoupling (`.editorconfig`)**:
   - Repositories MUST provide and maintain a root `.editorconfig` file.
   - This decouples repository-level canonical formatting (e.g., 2-space indentation required for deterministic git diffs) from individual local developer accessibility settings (e.g., custom tab widths, large print, high contrast, or screen-reader indentation announcements).
 ## 16. Host Hardening, Least Privilege & Mandatory Access Control (SELinux / AppArmor)
 1. **Identity & Authentication Hardening**:
   - Direct `root` SSH login (`PermitRootLogin no`) and password-based SSH authentication (`PasswordAuthentication no`) MUST be strictly disabled across all managed hosts.
   - Authentication MUST strictly require cryptographic public keys (Ed25519 preferred, FIDO2/hardware security keys where supported).
 2. **Granular Sudo & Least Privilege**:
   - Administrative escalation MUST use modular drop-in files in `/etc/sudoers.d/` restricted to explicit, granular command paths and user groups.
   - Blanket unmonitored escalation directives (e.g., `ALL=(ALL) NOPASSWD: ALL`) are strictly prohibited.
 3. **Daemon & Workload User Isolation**:
   - Daemons, systemd services, and containerized workloads MUST execute under dedicated, unprivileged system users and groups with restricted shells (`/sbin/nologin` or `/usr/sbin/nologin`).
   - Running userland services or application daemons as `root` is strictly prohibited.
   - Systemd units MUST enable sandboxing directives (`ProtectSystem=strict`, `ProtectHome=true`, `NoNewPrivileges=true`, `PrivateTmp=true`).
 4. **Mandatory Access Control (MAC / LSM)**:
   - Linux Security Modules (SELinux or AppArmor) MUST remain active and in `Enforcing` mode at all times.
   - Setting SELinux to `Permissive` or `Disabled` to work around permission issues is strictly prohibited; custom policies or file context labels (`semanage fcontext`) MUST be applied.
 ## 17. Centralized Audit Logging, System Integrity & Session Governance
 1. **Kernel Audit Subsystem (`auditd`) & Immutable Kernel Locking**:
   - The Linux Audit daemon (`auditd`) MUST be installed, enabled, and configured with immutable rules (`-e 2`) to track critical security events:
     - Authentication, session establishment, and sudo/privilege escalations.
     - Interactive administrative session keystrokes via PAM TTY auditing (`pam_tty_audit.so`).
     - Modifications to sensitive system files (`/etc/passwd`, `/etc/shadow`, `/etc/sudoers*`, `/etc/ssh/sshd_config`, PAM modules).
     - Execution of administrative binaries and system calls modifying kernel state, system time, or network routing.
   - **Immutable Kernel Locking (`auditctl -e 2`)**: The audit configuration MUST be locked in the kernel, preventing even a compromised `root` account from disabling audit logging without a full system reboot.
   - **Volatile Memory Forensic Triage (DFIR)**: Systems SHOULD maintain kernel crashdump (`kdump`) and non-destructive memory acquisition hooks to preserve volatile RAM evidence prior to automated reboot or host teardown.
 2. **Session Termination & Inactivity Locking (NIST AC-11 / AC-12)**:
   - **Shell Inactivity Auto-Logout**: All interactive shells MUST enforce a 15-minute (900-second) maximum idle timeout via a global, read-only configuration (`/etc/profile.d/timeout.sh` setting `readonly TMOUT=900; export TMOUT`).
   - **SSH Daemon Idle Disconnect**: SSH configuration MUST enforce idle disconnects via `ClientAliveInterval 300` and `ClientAliveCountMax 2` (or `ClientAliveCountMax 0`).
   - **Session Screen Locking**: Graphical and console sessions MUST automatically lock after 15 minutes of inactivity, requiring re-authentication.
 3. **Encrypted Remote SIEM / Log Forwarding**:
   - Systems MUST NOT rely solely on local log storage. All system, security, and application logs MUST be forwarded in near-real-time to a centralized SIEM or secure log collector via TLS 1.3/1.2 (Syslog-over-TLS with mutual authentication).
 4. **Structured Telemetry & Log Hygiene**:
   - Logs MUST use standardized structured formats (JSON or structured key-value) with UTC ISO 8601 timestamps and unique correlation/trace IDs.
   - Local log files MUST enforce strict permissions (`0600` or `0640` owned by `root:adm`) with automated log rotation and retention policies defined.
 ## 18. Network Architecture, Segmentation & Ingress/Egress Inspection
 1. **Default-Deny Ingress and Egress Policy**:
   - Host-level firewalls (`nftables`, `firewalld`, `iptables`) and cloud security groups MUST enforce a strict **Default-Deny** posture for both incoming (ingress) and outgoing (egress) traffic.
   - Any allowed network flow MUST be explicitly declared with minimal necessary destination CIDRs, ports, and protocols.
 2. **Mandatory Egress Traffic Inspection & Exfiltration Defense**:
   - Workloads and servers MUST NOT have direct, uninspected outbound Internet access.
   - Outbound connections to external networks MUST be routed through authenticated, inspecting forward proxies or Next-Generation Gateways enforcing:
     - Domain/FQDN allowlisting and strict Server Name Indication (SNI) validation.
     - Content and stream inspection via Data Loss Prevention (DLP) engines (e.g., ICAP proxy integration with ClamAV in Structured Data/DLP mode) to block sensitive data leakage (SSNs, credit cards, private keys).
     - Deep packet inspection to detect Command-and-Control (C2) beaconing and unapproved data exfiltration.
   - Cloud workloads MUST prefer private VPC endpoints / PrivateLink over public internet egress for cloud service communication.
 3. **Administrative Interface Isolation**:
   - Administrative interfaces (SSH, management consoles, database ports, internal metrics endpoints) MUST NEVER be exposed to the public Internet.
   - Access MUST strictly require private network segmentation, VPN with MFA, bastion jump hosts, or Zero-Trust Identity-Aware Proxies (IAP).
 4. **Local Loopback Binding & Network Surface Minimization**:
   - Services and microservices communicating locally on the same host MUST bind strictly to loopback interfaces (`127.0.0.1` / `::1`) or UNIX domain sockets rather than wildcard addresses (`0.0.0.0`).
 ## 19. Vulnerability Management, Security Scanning & Patch SLAs
 1. **Automated Continuous Security Scanning**:
   - Automated vulnerability scanning MUST execute at every stage of the pipeline:
     - Static Application Security Testing (SAST) and secret scanning during pre-commit and CI.
     - Software Bill of Materials (SBOM) generation and dependency vulnerability scanning (Trivy, Grype, OpenSSF Scorecard).
     - Container image and OS package vulnerability scanning prior to deployment.
 2. **Strict Vulnerability Remediation SLAs**:
   - Discovered vulnerabilities MUST be patched or mitigated within strict operational timeframes based on severity:
     - **CISA Known Exploited Vulnerabilities (KEV) & Critical (CVSS >= 9.0)**: Remediation within **7 calendar days**.
     - **High Severity (CVSS 7.0 - 8.9)**: Remediation within **30 calendar days**.
     - **Medium Severity (CVSS 4.0 - 6.9)**: Remediation within **60 calendar days**.
 3. **Formal Exception & Compensating Control Governance**:
   - Deploying code or packages with known unpatched High/Critical vulnerabilities is prohibited unless a formal exception is documented with:
     - Explicit technical rationale and compensating controls (e.g., firewall isolation, WAF rules, disabled vulnerable sub-features).
     - A mandatory expiration date not exceeding **90 calendar days**.
 ## 20. Disaster Recovery, Encrypted Backups & Automated Restore Verification
 1. **Immutable & Encrypted Backup Architecture (3-2-1-1-0 Rule)**:
   - All stateful datasets, configurations, and database volumes MUST maintain an automated backup regimen adhering to the modern 3-2-1-1-0 standard:
     - 3 total copies of data across at least 2 distinct storage media types.
     - 1 copy stored offsite / in an isolated geographic region.
     - 1 copy stored in an **immutable, air-gapped, or WORM (Write-Once-Read-Many)** object-locked state to prevent ransomware deletion or modification.
     - 0 errors verified through automated restore testing.
   - All backup archives MUST be encrypted at rest using approved KMS keys distinct from the production workload encryption keys.
 2. **Automated Synthetic Restore Verification**:
   - A backup is NOT considered valid or compliant merely because the backup archive process exited without error.
   - Automated synthetic restore jobs MUST execute on a scheduled basis within an isolated staging environment to prove data restorability and assert compliance with defined Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO).
 3. **Disaster Recovery as Code (DRaC) & Rebuildability**:
   - Infrastructure, operating system configurations, and application stacks MUST be completely restorable from cold storage using IaC (Terraform/OpenTofu) and automated configuration management (Ansible).
   - Rebuilding any node, cluster, or environment from bare-metal or base images MUST require zero manual interactive intervention.
 4. **Facility Power Loss & Automated UPS Graceful Shutdown**:
   - On-premises infrastructure and OpenStack clusters MUST integrate automated power monitoring (Network UPS Tools / NUT or `apcupsd`).
   - Upon reaching a **20% UPS battery capacity threshold**, automation MUST execute an emergency graceful flush of in-flight database transactions and initiate clean, ordered node shutdowns before catastrophic utility power cutoff.
 ## 21. Autonomous Agent Verification & Quality Gate Checklist
 Before finalizing or committing any playbook, role, script, or infrastructure code change, an agent MUST systematically verify:
 - [ ] **Prerequisites Asserted (Shift-Left Tier 2)**: OS distribution, version, architecture, and tool prerequisites are explicitly tested with structured fail-fast diagnostics.
 - [ ] **Code & Data Decoupled**: Zero hardcoded package names, service handles, or static disk paths inside execution tasks (all externalized to structured `vars/`).
 - [ ] **Security Hardening Enforced**: Non-root daemon users configured, systemd sandboxing parameters enabled, least-privilege permissions applied, and SELinux contexts declared.
 - [ ] **Zero Credential Leaks**: All tasks and variables handling secrets or certificates enforce `no_log: true` (Ansible) or `sensitive = true` (Terraform/OpenTofu).
 - [ ] **Idempotency & Least Change**: Tasks modify only the minimal delta from factory defaults; repeated runs against compliant nodes report `changed=0`.
 - [ ] **Post-Change Verification Active (Section 10.2)**: End-state functional assertions (listening sockets, synthetic HTTP 200 checks, database queries) are implemented.
 - [ ] **Supply Chain & Licensing Verified**: All third-party packages comply with Tier 1 Libre Open Source licensing (zero BSL/SSPL) with cryptographic SHA-256 validation.
 - [ ] **Formatting & Accessibility Compliant (`STYLE.md`)**: Narrow-line formatting applied, Yoda/defensive syntax used, attributes lexicographically sorted, and no decorative ASCII art.
 ## 22. Data Classification, Privacy Sovereignty & Data Lifecycle
 1. **4-Tier Data Classification Matrix**:
   - All systems, databases, object stores, and data pipelines MUST enforce classification tags:
     - **Tier 1 (Public)**: Non-sensitive public marketing/documentation assets.
     - **Tier 2 (Internal)**: Operational telemetry, non-sensitive system logs, internal policies.
     - **Tier 3 (Confidential)**: Business financial records, proprietary source code, internal roadmap data.
     - **Tier 4 (Restricted / PII / PHI / CUI)**: Personally Identifiable Information, Protected Health Information, Payment Card Data, and Controlled Unclassified Information.
 2. **Geographic Data Residency & Sovereignty**:
   - Customer and regulated data MUST remain within designated sovereign jurisdictional boundaries (e.g., EU GDPR data must remain in EU regions; US defense/CUI data must remain in US datacenters).
   - Cross-border data replication or backup transfer without explicit contractual approval is strictly prohibited.
 3. **Cryptographic Erasure & Right-to-be-Forgotten (NIST SP 800-88)**:
   - Systems storing personal data MUST implement automated workflows for account deletion and data purging.
   - Storage media decommissioning and tenant data sanitization MUST execute cryptographic key destruction or NIST SP 800-88 Rev 1 compliant overwriting.
 ## 23. Incident Management, Break-Glass Access & Blameless Retrospectives
 1. **Incident Severity Classification & Response SLAs (NIST SP 800-61)**:
   - **SEV-1 (Critical / Outage / Data Breach)**: Immediate response within **15 minutes**; continuous incident commander coordination until resolution.
   - **SEV-2 (Major Impairment / Redundancy Loss)**: Response within **1 hour**.
   - **SEV-3 (Moderate Degradation / Non-Critical Bug)**: Response within **4 business hours**.
   - **SEV-4 (Minor Issue / Cosmetic Inquiry)**: Response within **24 business hours**.
 2. **Emergency Break-Glass Access & Just-In-Time (JIT) Elevation**:
   - Standing root or administrator access in production environments is STRICTLY PROHIBITED.
   - Emergency operational access MUST require Just-In-Time (JIT) checkout with a maximum **2-hour lease**, generating high-priority SIEM alerts and automated audit trails.
 3. **Mandatory Blameless Root Cause Analysis (RCA)**:
   - Every SEV-1 and SEV-2 incident requires a formal, blameless post-mortem published within **72 hours** of resolution, identifying systemic root causes (5 Whys) and actionable preventive engineering tasks.
 4. **Alert Storm Deduplication & On-Call Cognitive Ergonomics**:
   - Monitoring systems and SIEM collectors MUST enforce alert grouping, root-cause suppression, and deduplication to prevent cognitive overload and alert fatigue during major distributed fleet incidents.
 ## 24. FinOps, Resource Allocation Tagging & Automated Waste Governance
 1. **Mandatory Resource Attribution Tagging**:
   - Every cloud resource, VM, block volume, bucket, and service account MUST declare standardized metadata tags:
     - `Owner`: Individual or team responsible for maintenance.
     - `Environment`: `production`, `staging`, `development`, or `sandbox`.
     - `CostCenter`: Financial billing unit or business allocation code.
     - `Project`: Specific service or application identifier.
     - `ComplianceScope`: `fedramp`, `pci-dss`, `hipaa`, `soc2`, or `general`.
   - Untagged resources in automated environments MUST trigger automated compliance notifications and scheduled reaping.
 2. **Automated Idle Resource Reaping**:
   - Unattached storage volumes, dangling elastic IP addresses, orphan snapshots past retention policy, and idle test instances MUST be automatically flagged and deleted after defined grace periods.
 ## 25. Change Management, Deployment Windows & Production Freezes
 1. **ITIL v4 Change Classification**:
   - **Standard Changes**: Pre-approved, automated, low-risk changes with verified idempotency (e.g., automated routine patch management via `ensure_os_patch`).
   - **Normal Changes**: Standard feature deployments and architectural updates requiring peer code review, CI/CD automated test verification, and Change Advisory Board (CAB) approval.
   - **Emergency Changes**: Hotfixes applied during active SEV-1/SEV-2 incidents with expedited approval and mandatory retrospective review.
 2. **Production Deployment Freezes & Blackout Windows**:
   - Automated CI/CD deployment pipelines MUST enforce deployment freezes during designated business-critical blackout periods (e.g., peak retail events, end-of-fiscal-year reporting).
   - Emergency security hotfixes during freezes require dual-executive authorization.
 ## 26. Service Level Governance: SLAs, SLOs, SLIs & Error Budget Enforcement
 1. **Contractual SLAs vs. Internal Engineering SLOs**:
   - Systems MUST define explicit Service Level Indicators (SLIs) measuring availability, error rate, and 95th/99th percentile latency.
   - Internal Service Level Objectives (SLOs) MUST be engineered to be stricter than contractual customer Service Level Agreements (SLAs) (e.g., 99.99% internal SLO vs. 99.9% external SLA).
 2. **Error Budget Policy & Automated Deployment Gates**:
   - Each service maintains a monthly Error Budget derived from its SLO (e.g., 99.9% availability allows 43.8 minutes of downtime per month).
   - **Error Budget Exhaustion Gate**: If a service exhausts its monthly error budget due to instability or outages, all non-critical feature deployments MUST be automatically blocked in CI/CD, redirecting 100% of engineering capacity to reliability, resilience, and defect resolution until stability is restored.
 ## 27. Financial Systems Architecture, Jurisdictional Tax Sourcing & Unit Economic Metering
 1. **Physical Execution Sourcing & Jurisdictional Tax Metadata**:
   - All provisioned compute instances, container workloads, and storage volumes MUST expose runtime metadata declaring their physical execution location and legal jurisdiction (e.g., `execution_jurisdiction`, `datacenter_state`, `country_iso`).
   - Telemetry and orchestration layers MUST feed this execution jurisdiction data directly into the automated rating and sales tax computation pipeline to guarantee multi-state (e.g., Texas Rule 3.330) and international VAT compliance.
 2. **CapEx vs. OpEx Lifecycle Governance**:
   - Architectural decisions MUST evaluate total cost of ownership (TCO), modeling hardware capitalization, multi-year depreciation schedules, and power/colo expenses against variable cloud OpEx bills.
   - Core predictable baselines (> 12-month steady-state) SHOULD be targeted for high-margin capitalized infrastructure (OpenStack on-premise), with cloud bursting (DigitalOcean edge) restricted to transient ingress or disaster recovery.
 3. **High-Cardinality Multi-Tenant Metering & Profitability Bucketing**:
   - In MSP and multi-tenant environments, every ephemeral and persistent resource (vCPU-hours, RAM gigabyte-hours, block IOPS, network egress bytes, and dynamic credential leases) MUST be tagged with `TenantId` / `CustomerId`.
   - Metered telemetry MUST stream continuously to an automated rating engine (e.g., Kill Bill / Lago) to generate usage-based billing line items and calculate real-time gross margin per customer.
 4. **Interstate Physical Nexus & Asset Entity Segregation (*South Dakota v. Wayfair*)**:
   - On-premises hardware, backup repositories, and regional compute nodes MUST maintain clean legal entity ownership boundaries to prevent unintended interstate corporate tax nexus and asset exposure.
 ## 28. Human-in-the-Loop (HITL) Fiduciary Governance & Deadlock Halting Protocol
 1. **Deterministic Execution vs. Fiduciary Accountability**:
   - Automation systems execute deterministic business logic; human operators retain ultimate legal, regulatory, and fiduciary accountability for all state mutations.
 2. **Mandatory Automated Halting on Ambiguity & Deadlock**:
   - When automation routines (Ansible playbooks, CI/CD pipelines, or agentic workers) encounter conflicting priorities, unresolvable drift, ambiguous tax jurisdictions, or unmapped database schemas, the system MUST NOT guess, extrapolate, or apply destructive overrides (`force: yes`).
   - The execution sequence MUST immediately halt the affected host/service, preserve full state diagnostics, emit an alert to the centralized SIEM, and route the decision to an explicit Human-in-the-Loop (HITL) review queue.
 3. **Interactive Promotion & Migration Gates**:
   - Irreversible production state changes (e.g., live financial ledger schema updates, production database failovers, data purges) MUST include mandatory human authorization pause gates before mutating production state.
 4. **Two-Person Integrity (TPI) for Destructive Operations**:
   - Catastrophic infrastructure operations (e.g., bare-metal node wiping, production database drops, immutable backup purge authorization) MUST enforce a cryptographic Two-Person Integrity (TPI) approval rule, requiring distinct dual-operator credentials.
 ## 29. Third-Party Vendor Risk Management & Subprocessor Governance (TPCRM)
 1. **Mandatory Subprocessor Due Diligence & Certification**:
   - No third-party SaaS, cloud provider, external API, or payment processor can be configured to process production or customer data without an active **SOC 2 Type II** or **ISO/IEC 27001** audit certification on file (renewed annually).
 2. **Binding Data Processing Agreements (DPA / BAA)**:
   - All external infrastructure and service dependencies MUST maintain executed, legally binding Data Processing Agreements (DPAs) or Business Associate Agreements (BAAs) establishing sovereign jurisdiction, breach notification SLAs, and data ownership boundaries.
 3. **Cryptographic Provenance & Network Egress Boundaries**:
   - All external package repositories MUST enforce GPG signature validation (`gpgcheck: 1`, `repo_gpgcheck: 1`) using cryptographically verified vendor keys.
   - Host firewalls and egress proxies MUST strictly restrict outbound network traffic exclusively to allowlisted, vetted subprocessor CIDRs and domain endpoints.
 ## 30. Legacy Systems, Batch Interoperability & Physical Document Ingestion Bridges
 1. **Isolated & Chrooted Ingress Boundaries**:
   - Ingress endpoints accepting data from legacy desktop software (e.g., Sage 100/MAS90, QuickBooks Desktop, Lightspeed POS), flat-file EDI feeds, or scanner OCR dropboxes MUST be strictly isolated.
   - Ingestion services MUST enforce dedicated chrooted system users (`internal-sftp` with no shell access), SSH public key authentication, and segregated filesystem boundaries.
 2. **Cryptographic Manifest & Integrity Verification**:
   - Batch data feeds, CSV exports, and document drop files MUST be accompanied by cryptographic SHA-256 manifest files.
   - Ingestion automation MUST verify cryptographic checksums (`sha256sum -c`) and schema integrity prior to parsing or committing records to production transactional databases.
 3. **Transport Security & At-Rest Encryption**:
   - All legacy data transmissions MUST be encrypted in transit using TLS 1.3 or SFTP.
   - Staged batch files and unprocessed document scans MUST be stored on encrypted volumes with automated expiration and secure deletion (NIST SP 800-88) following successful database ingestion.
 ## 31. Personnel Access Lifecycle & 24-Hour Offboarding SLAs
 1. **Least-Privilege Onboarding & Role-Based Access Control (RBAC)**:
   - Access to production systems, source repositories, and cloud control planes MUST adhere strictly to the principle of least privilege, requiring mandatory background screening and manager authorization.
 2. **Automated 24-Hour Offboarding Access Deprovisioning (NIST SP 800-53 PS-4/PS-5)**:
   - Upon the separation, transfer, or contract termination of any employee, contractor, or third-party maintainer, all associated access MUST be completely revoked within **24 calendar hours**.
   - Deprovisioning automation MUST revoke:
     - SSH authorized keys, VPN certificates, and bastion account access.
     - Central IdP accounts (Keycloak / SSO / Google Workspace) and active sessions.
     - Git repository write permissions and personal access tokens (PATs).
     - Cloud IAM roles, AWS/GCP/OCI service accounts, and API secret keys.
 3. **Periodic Access Recertification**:
   - Production privilege assignments and administrative entitlements MUST undergo automated quarterly access recertification by system owners.
 ## 32. Autonomous Agent & AI Model Governance
 1. **Sandboxing & Least-Privilege Agent Execution**:
   - Autonomous AI coding agents, automation bots, and LLM plugins MUST execute inside restricted sandbox environments with zero direct network egress unless explicitly authorized.
   - Agents MUST NOT be granted unrestricted root access or production deployment execution privileges without an explicit human approval gate (Section 28).
 2. **Prompt Injection Defense & Input Sanitization (OWASP LLM Top 10)**:
   - AI ingestion pipelines processing untrusted external text (e.g., support tickets, customer issue descriptions, web scraped content) MUST enforce strict prompt sanitization and delimiter isolation to prevent prompt injection and automated tool hijacking.
 3. **Data Privacy & Training Exclusion (NIST AI RMF 1.0 / ISO 42001)**:
   - Customer data, proprietary business logic, financial ledgers, and credentials MUST NEVER be transmitted to external AI models that retain or train on input data without explicit enterprise contractual zero-retention guarantees.
 4. **Supply Chain & Licensing Provenance on AI Code Generation**:
   - AI-generated source code and configuration snippets MUST undergo automated licensing and security static analysis (SAST) to ensure zero introduction of prohibited Tier 3 licenses (BSL/SSPL) or unvetted dependencies.
 ## 33. Legal Hold, Electronic Discovery & Evidence Preservation
 1. **Automated Retention Freeze on Legal Hold Declaration (FRCP Rules 26/37 / ISO 27050)**:
   - Upon receipt of a formal Legal Hold notice, automation systems MUST immediately suspend all automated log rotation, data purging, snapshot deletion, and cryptographic media sanitization (Section 22.3) on affected tenant data scopes.
 2. **Immutability & Chain-of-Custody Preservation**:
   - All electronically stored information (ESI) subject to a legal hold MUST be placed in an immutable, write-once-read-many (WORM) storage state with cryptographic SHA-256 integrity sealing.
 3. **Audit Trail of Hold Activation & Release**:
   - The activation, scope definition, and subsequent release of any legal hold MUST generate an immutable, non-repudiable audit event in the centralized SIEM.
 ## 34. Corporate Finance, ASC 606 Revenue Recognition & Multi-Currency Treasury Architecture
 1. **GAAP / IFRS Automated Revenue Recognition (ASC 606 / IFRS 15)**:
   - Automated rating, billing, and subscription engines MUST generate daily deferred revenue amortization schedules.
   - Upfront multi-month and annual subscription payments MUST be booked as unearned deferred revenue liabilities and recognized incrementally over the performance obligation period.
 2. **Multi-Currency Invoicing & FX Currency Risk Mitigation**:
   - Systems executing multi-currency transactions (USD, EUR, GBP, CAD) MUST lock the foreign exchange (FX) spot rate at invoice creation to eliminate unhedged currency fluctuation risk between billing generation and payment clearing.
 3. **Double-Entry Financial Ledger Integrity**:
   - Usage telemetry and automated invoice generation MUST interface with accounting general ledgers via immutable, double-entry batch journals with balanced debits and credits.
 ## 35. Cyber Insurance Warranty Defensibility & Underwriting Compliance Automation
 1. **Automated Insurance Policy Warranty Auditing**:
   - To ensure defensibility and prevent claim denial by commercial Cyber Liability and Errors & Omissions (E&O) insurance carriers (e.g., Lloyd's, Chubb, Travelers), systems MUST automatically generate cryptographically verifiable quarterly compliance bundles.
 2. **Continuous Underwriting Warranties**:
   - Automation MUST continuously verify and produce audit artifacts demonstrating:
     - 100% Hardware Multi-Factor Authentication (MFA) enforcement on all remote access and administrative jump boxes (Section 16.1).
     - 3-2-1-1-0 immutable, air-gapped, and object-locked backups with verified restore drills (Section 20).
     - Continuous vulnerability scanning and remediation within policy SLAs (Section 19.2).
     - Centralized, tamper-evident audit logging retained for a minimum of 365 days (Section 17).
 ## 36. Intellectual Property Assignment (CIIAA) & Workforce Identity Verification
 1. **Cryptographic IP Ownership & Chain-of-Title Provenance**:
   - To guarantee unencumbered corporate intellectual property ownership for M&A, investment due diligence, and copyright enforcement, all repository contributions MUST have unbroken chain of title.
 2. **Committer Verification & Contractual Binding**:
   - Repository pre-receive hooks and CI/CD push gates MUST enforce cryptographic GPG commit signature verification, validating that every commit author maps to an active employee or contractor with an executed Confidential Information and Inventions Assignment Agreement (CIIAA) or contractor IP assignment schedule on file in the corporate HRIS.
 ## 37. Physical Supply Chain Redundancy, Dual-OEM Sourcing & Hardware Capacity
 1. **Multi-Vendor Hardware & Component Fungibility**:
   - On-premises infrastructure, private cloud datacenters, and OpenStack bare-metal clusters MUST maintain dual-OEM hardware specifications (e.g., Dell PowerEdge + Supermicro / AMD EPYC + Intel Xeon) to eliminate single-supplier physical supply chain vulnerabilities and component lead-time bottlenecks.
 2. **Hardware Capacity Planning & Spare Parts Buffering**:
   - Critical infrastructure nodes MUST maintain an on-site cold-spare hardware buffer (minimum 10% replacement ratio for power supplies, NVMe drives, and NICs) backed by enterprise 4-hour on-site vendor hardware replacement SLAs.
@@ -0,0 +1,225 @@
 # STYLE.md
 > ### Normative Requirement Levels (RFC 2119 / RFC 8174)
 > The key words **MUST**, **MUST NOT**, **REQUIRED**, **SHALL**, **SHALL NOT**, **SHOULD**, **SHOULD NOT**, **RECOMMENDED**, **NOT RECOMMENDED**, **MAY**, and **OPTIONAL** in this document are to be interpreted as described in [BCP 14](https://www.rfc-editor.org/info/bcp14) ([RFC 2119](https://www.rfc-editor.org/rfc/rfc2119.txt) and [RFC 8174](https://www.rfc-editor.org/rfc/rfc8174.txt)) when, and only when, they appear in all capitals, as shown here.
 ---
 ## 1. Universal Formatting & Merge Request Optimization
 1. **Merge Request Context & Narrow-Line Formatting**:
   - Code, configuration, and data MUST be structured to maximize human readability and minimize line noise during diff and merge request reviews.
   - Long lines and complex expressions MUST be broken across multiple lines rather than collapsed into dense single-line statements (e.g., compound `if` conditions testing multiple criteria, nested data structures, long parameter lists).
   - Splitting expressions across dedicated lines ensures that future diffs highlight the exact changed variable or condition rather than obscuring edits in the middle of a wide line.
 2. **File Granularity & Concise Sizing**:
   - Files SHOULD remain compact, focused, and single-purpose in languages and configuration formats that support modular decomposition.
   - Monolithic files MUST be decomposed into cohesive, logically grouped sub-components.
 3. **Deterministic Lexicographical Sorting**:
   - Where the order of code blocks, dictionary keys, variable definitions, exports, or lists does not affect semantic execution or program logic, items MUST be sorted alphabetically/lexicographically.
   - Consistent sorting guarantees deterministic diffs and prevents spurious ordering conflicts during parallel merges.
 ---
 ## 2. Defensive Syntax & Error-Exposing Idioms
 1. **Compile-Time & Static Error-Exposing Constructs**:
   - Code MUST be written using defensive syntax idioms that turn common typos or logical accidents into immediate compile-time or static analysis errors.
 2. **Constant-First Comparisons (Yoda Conditions)**:
   - In languages where assignment within conditional expressions is syntactically valid (e.g., C, C++, PHP, Java, Perl), equality comparisons MUST place the constant or literal on the left-hand side:
     - Preferred: `if (1 == variable)` or `if (NULL == ptr)`
     - Prohibited: `if (variable = 1)` accidental assignment bugs.
   - Placing the literal first causes accidental single-equal assignments (`1 = variable`) to immediately fail compilation or linting rather than executing undetected.
 ---
 ## 3. Ansible & YAML Formatting Standards
 1. **Native YAML Syntax & Multiline Arguments**:
   - Module parameters MUST use native YAML key-value mapping over legacy `key=value` inline shorthand strings.
   - Every parameter MUST reside on its own line to ensure concise git diffs and visual clarity during reviews.
 2. **Mandatory Explicit Task & Play Naming**:
   - Every play, task, and block MUST include a descriptive, human-readable `name:` string stating its explicit intent.
 3. **Deterministic Variable & Key Ordering**:
   - Dictionary keys, task arguments, and variable lists MUST be sorted alphabetically unless a specific execution order is functionally required.
 4. **Jinja2 Spacing & Quoting Integrity**:
   - Jinja2 delimiters MUST have consistent inner single-space padding: `{{ variable_name }}` (not `{{variable_name}}`).
   - YAML values starting with template delimiters MUST always be explicitly quoted (`"{{ var }}"`) to prevent parser syntax errors.
 ---
 ## 4. OpenTofu & Terraform Standards
 1. **Standardized Formatting & Indentation**:
   - All HCL code MUST be formatted using standard 2-space indentation (enforced via `tofu fmt` / `terraform fmt`).
 2. **Deterministic Attribute & Block Sorting**:
   - Attributes inside resources, data sources, locals, and variable blocks MUST be sorted alphabetically where evaluation order is order-independent.
   - Meta-arguments (`count`, `for_each`, `lifecycle`, `depends_on`, `provider`) SHOULD appear in a standardized order (meta-arguments at the top, followed by sorted resource arguments, with `lifecycle` and `depends_on` at the bottom).
 3. **Mandatory Documentation Attributes**:
   - Every `variable` and `output` declaration MUST include an explicit `description` string explaining its purpose, expected format, and constraints.
 4. **Multiline Collection Declarations**:
   - Maps, lists, and complex objects MUST be formatted across multiple lines with trailing commas on list/map elements to ensure clean, one-line diffs when elements are appended.
 ---
 ## 5. JSON Formatting Standards
 1. **Strict 2-Space Indentation**:
   - All JSON files MUST be formatted with 2-space indentation and a terminating newline.
 2. **Deterministic Key Sorting**:
   - Keys in JSON objects MUST be sorted alphabetically unless document schemas require specific positional ordering.
 3. **Multiline Formatting for Objects & Arrays**:
   - JSON objects and arrays containing multiple items MUST be expanded across multiple lines. Single-line minification is restricted to binary release artifacts only.
 ---
 ## 6. Rust Standards (Systems & Kernel Rust)
 1. **Standardized Formatting (`rustfmt`)**:
   - Code MUST be formatted with 4-space indentation adhering to the standard `rustfmt` rules.
 2. **Explicit Error Propagation & Prohibition of Panics**:
   - Production code and kernel/system modules MUST NOT use `.unwrap()` or `.expect()` on fallible operations.
   - Errors MUST be propagated explicitly using `Result<T, E>`, `Option<T>`, or custom error types with the `?` operator.
 3. **Safe Rust Default & Explicit Unsafe Auditing**:
   - All code MUST be `#![deny(unsafe_code)]` by default.
   - When `unsafe` blocks are strictly required (e.g., FFI, kernel drivers, memory-mapped I/O), every `unsafe` block MUST include an explicit `// SAFETY:` explanatory comment proving memory safety invariants.
 4. **Deterministic Import & Module Sorting**:
   - `use` declarations MUST be sorted alphabetically and grouped: `std` / `core` / `alloc` -> external crates -> internal modules.
 ---
 ## 7. Systems Programming, Kernel & eBPF Standards (C, C++, Assembly, eBPF)
 1. **Indentation & Block Formatting**:
   - Userland C/C++ MUST use 4-space indentation.
   - Linux Kernel modules, drivers, and low-level subsystem source files MUST follow the Linux Kernel Coding Style (8-character tabs, K&R brace placement).
 2. **Defensive Yoda Comparisons**:
   - Equality comparisons against literals or constants MUST place the constant on the left: `if (0 == result)` and `if (NULL == ptr)`.
 3. **Extended BPF / eBPF Standards**:
   - eBPF C programs (`*.bpf.c`) MUST adhere to BPF CO-RE (Compile Once – Run Everywhere) conventions using `vmlinux.h`.
   - BPF maps and license declarations (`SEC("license")`) MUST be explicitly named and placed at file boundaries.
 4. **Assembly (ASM) & Linker Scripts (`.s`, `.S`, `.ld`, `.lds`)**:
   - Assembly files MUST use standard tab alignment for labels, instructions, operands, and comments.
   - Hardware register names and instruction mnemonics MUST be lowercase.
 5. **Zero Compiler Warnings**:
   - Userland code MUST compile cleanly under `-Wall -Wextra -Werror -Wpedantic` (or MSVC `/W4 /WX`). Kernel code MUST compile cleanly with zero sparse / static analysis warnings.
 ---
 ## 8. Build Systems, Grammars & Device Trees (Make, Kconfig, Bison/Flex, DTS)
 1. **Makefiles & Kbuild (`Makefile`, `*.mk`, `Kconfig`, `Kbuild`)**:
   - Recipe lines in Makefiles MUST be indented with literal tab characters (`\t`).
   - Kconfig option declarations MUST be sorted logically with complete `help` documentation strings.
 2. **Device Tree Source (`.dts`, `.dtsi`)**:
   - DTS node names and properties MUST use standard 8-character tab indentation.
   - Node labels MUST follow standard naming conventions (`node_name@unit_address`).
 3. **Parser & Lexer Grammars (Bison `.y`, Flex `.l`)**:
   - Grammars MUST use tab-indented production rules with explicit semantic error handlers (`yyerror`).
 ---
 ## 9. Shell & Scripting Standards (BASH, SH, KSH, CSH/TCSH, AWK, Sed)
 1. **Strict Execution Header & Shebang**:
   - **Bash**: `#!/usr/bin/env bash` with `set -euo pipefail`.
   - **POSIX / Bourne Shell (`sh`)**: `#!/usr/bin/env sh` with `set -eu`.
   - **Korn Shell (`ksh`)**: `#!/usr/bin/env ksh` with `set -e -u`.
   - **C Shell / TC Shell (`csh` / `tcsh`)**: Scripts in CSH/TCSH are NOT RECOMMENDED for automation logic; if required for legacy shell environments, they MUST begin with `#!/bin/csh -f` or `#!/bin/tcsh -f` and check `$status` after every command.
 2. **Defensive Variable Quoting & Modern Expansion**:
   - Every variable expansion MUST be enclosed in double quotes (e.g., `"$target_dir"`, `"${items[@]}"`) to prevent field splitting and globbing.
   - Command substitution in POSIX/Bash/Ksh MUST use standard `$()` syntax instead of legacy backticks (`` `...` ``).
 3. **AWK & Sed Scripting Standards**:
   - AWK scripts (`.awk`) MUST use 4-space indentation with explicit `BEGIN` and `END` blocks.
   - Complex regular expressions in Sed/AWK MUST be documented with inline comments explaining matching groups.
 4. **Deterministic Exit & Cleanup Traps**:
   - Temporary files or resources created by a script MUST be cleaned up via an explicit `trap cleanup EXIT INT TERM` handler.
 ---
 ## 10. Perl Standards
 1. **Strict Pragmas Mandate**:
   - Every Perl script (`.pl`) and module (`.pm`) MUST explicitly enable strict mode and warnings at the top of the file:
     ```perl
     #!/usr/bin/env perl
     use strict;
     use warnings;
     use utf8;
     ```
 2. **Formatting & Scoping**:
   - Indentation MUST be 4 spaces.
   - All variables MUST be lexically scoped using `my` (package variables `our` used only when strictly necessary).
   - Global package variables (`$var`, `$@`) and direct typeglobs are prohibited.
 3. **Subroutine Signatures**:
   - Modern Perl subroutine signatures (`use feature 'signatures';`) SHOULD be used for explicit argument validation.
 ---
 ## 11. Python Standards
 1. **PEP 8 Adherence & 4-Space Indentation**:
   - All Python code MUST conform to PEP 8 standards with strict 4-space indentation.
 2. **Mandatory Type Annotations (`typing`)**:
   - All function signatures and module interfaces MUST declare complete static type hints (`typing` / Python 3.10+ union types `str | None`).
 3. **Deterministic Import Sorting**:
   - Imports MUST be sorted and grouped in standard order (Standard Library -> Third-Party -> Local) using tools like `isort` or `ruff`.
 4. **Multiline Call & Data Formatting**:
   - Dictionaries, lists, and multi-argument function calls MUST be formatted across multiple lines with trailing commas on multiline structures.
 ---
 ## 12. Enterprise & Compiled Languages (Java & Go)
 1. **Java Standards**:
   - Indentation MUST be 4 spaces.
   - Class members and methods MUST be ordered: static constants -> member fields -> constructors -> public methods -> private methods.
   - Constant-first equality checks: `"constant".equals(variable)` to eliminate `NullPointerException` risks.
 2. **Go (Golang) Standards**:
   - Code MUST be formatted strictly using standard `gofmt` (tab-based indentation).
   - Error handling MUST be explicit and fail-fast: `if err != nil { return fmt.Errorf(...) }`.
   - Struct field declarations and imports MUST be formatted and sorted via `goimports`.
 ---
 ## 13. Web & Backend Scripting (PHP)
 1. **PSR-12 Extended Coding Style**:
   - All PHP code MUST adhere strictly to PSR-12 formatting with 4-space indentation.
 2. **Strict Typing Mandate**:
   - Every PHP file MUST begin with `declare(strict_types=1);` immediately after `<?php`.
   - All function parameters and return types MUST declare explicit types.
 3. **Defensive Yoda Comparisons**:
   - Use constant-first comparisons (`if (true === $flag)` or `if (null === $data)`).
 ---
 ## 14. Windows Scripting Standards (PowerShell & CMD)
 1. **PowerShell (`.ps1`, `.psm1`) Standards**:
   - Scripts MUST include `$ErrorActionPreference = 'Stop'` at the top to enforce fail-fast execution.
   - Indentation MUST be 4 spaces.
   - Use approved PowerShell verb-noun naming conventions for functions (e.g., `Get-Resource`, `Set-Configuration`).
   - All parameters MUST be explicitly typed (`[string]$Path`, `[int]$Count`).
 2. **Windows Command Script (`.bat`, `.cmd`) Standards**:
   - CMD scripts MUST begin with `@echo off` and `setlocal enableextensions enabledelayedexpansion`.
   - Explicitly check `%ERRORLEVEL%` after critical invocations: `if %ERRORLEVEL% neq 0 exit /b %ERRORLEVEL%`.
   - Files MUST use Windows CRLF line endings as required by the Windows Command interpreter.
 ---
 ## 15. Accessible Code Formatting & Documentation Style
 1. **Phonetic & Voice-Coding Naming Clarity**:
   - Variable, function, task, and file names MUST be descriptive, pronounceable, and phonetically distinct.
   - Avoid ambiguous single-character variables (except standard loop indices `i`, `j` where unavoidable), cryptic phonetic abbreviations, or homophones that impede speech-to-text dictation (e.g., Talon Voice) or screen-reader comprehension.
 2. **Audio Cognitive Ergonomics & Spoken Phrasing**:
   - Playbook task names and block descriptions MUST be written as concise, natural spoken sentences (e.g., `name: Ensure Apache Web Daemon Is Active and Enabled`).
   - Configuration maps and data schemas SHOULD avoid nesting deeper than 4 levels to prevent auditory disorientation on speech synthesizers.
 3. **Prohibition of Decorative Visual ASCII Art**:
   - Purely visual ASCII art, boxed comment headers (`/*******************/`), decorative divider lines, and ASCII pseudo-diagrams are strictly prohibited.
   - Code comments MUST use clean, natural phrasing without decorative punctuation noise that confuses screen readers and Braille displays.
 4. **Semantic Documentation & Mandatory Alt Text**:
   - Technical documentation and markdown files MUST use strict hierarchical heading levels (`#`, `##`, `###` in sequential order without skipping levels).
   - All embedded diagrams, architecture flowcharts, and screenshots MUST include meaningful, descriptive `alt` text and plain textual summary descriptions.
 5. **Editor Configuration (.editorconfig) Baseline**:
   - All repository contributors and automation agents MUST respect `.editorconfig` rules across all supported languages.
@@ -7,7 +7,7 @@ fact_caching_connection = ./facts/
 inventory = ./inventory/
 forks = 5
 retry_files_enabled = False
-interpreter_python = auto
+interpreter_python = /usr/bin/python3
 callbacks_enabled = ansible.posix.profile_tasks,ansible.posix.profile_roles
 [ssh_connection]
@@ -1,30 +1,27 @@
 ---
 collections:
-  - name: 'ansible.netcommon'
+  - name: ansible.netcommon
-  - name: 'ansible.mysql'
+  - name: ansible.mysql
-  - name: 'ansible.posix'
+  - name: ansible.posix
-  - name: 'ansible.windows'
+  - name: ansible.windows
-  - name: 'awx.awx'
+  - name: awx.awx
-  - name: 'community.crypto'
+  - name: community.crypto
-  - name: 'community.digitalocean'
+  - name: community.digitalocean
-  - name: 'community.dns'
+  - name: community.dns
-  - name: 'community.general'
+  - name: community.general
-  - name: 'community.grafana'
+  - name: community.grafana
-  - name: 'community.hashi_vault'
+  - name: community.hashi_vault
-  - name: 'community.libvirt'
+  - name: community.libvirt
-  - name: 'community.mysql'
+  - name: community.postgresql
-  - name: 'community.postgresql'
+  - name: community.proxysql
-  - name: 'community.proxysql'
+  - name: community.rabbitmq
-  - name: 'community.rabbitmq'
+  - name: community.windows
-  - name: 'community.windows'
+  - name: community.zabbix
-  - name: 'community.zabbix'
+  - name: containers.podman
-  - name: 'containers.podman'
+  - name: grafana.grafana
-  - name: 'grafana.grafana'
+  - name: gluster.gluster
-  - name: 'gluster.gluster'
+  - name: kubernetes.core
-  - name: 'kubernetes.core'
+  - name: kubevirt.core
-  - name: 'kubevirt.core'
+  - name: openstack.cloud
-  - name: 'openstack.cloud'
+  - name: microsoft.ad
-  - name: 'microsoft.ad'
+  - name: microsoft.iis
  - name: 'microsoft.iis'
 ...
@@ -1,16 +1,13 @@
 ---
 language: python
-python: "2.7"
+python: '2.7'
 # Use the new container infrastructure
 sudo: false
 # Install ansible
 addons:
  apt:
-    packages:
+    packages: [python-pip]
    - python-pip
 install:
  # Install ansible
  - pip install ansible
@@ -20,10 +17,8 @@ install:
  # Create ansible.cfg with correct roles_path
  - printf '[defaults]\nroles_path=../' >ansible.cfg
 script:
  # Basic role syntax check
  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
 notifications:
  webhooks: https://galaxy.ansible.com/api/v1/notifications/
@@ -1,38 +0,0 @@
 Role Name
 =========
 A brief description of the role goes here.
 Requirements
 ------------
 Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
 Role Variables
 --------------
 A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
 Dependencies
 ------------
 A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
 Example Playbook
 ----------------
 Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
    - hosts: servers
      roles:
         - { role: username.rolename, x: 42 }
 License
 -------
 LGPL-3.0-or-later
 Author Information
 ------------------
 An optional section for the role authors to include contact information, or a website (HTML is not allowed).
@@ -1,2 +1,2 @@
 ---
-# defaults file for ensure_ansible_prereq
+...
@@ -1,17 +1,17 @@
 ---
 # handlers file for ensure_ansible_prereq
- name: 'ensure_ansible_prereq.package_facts'
+- name: Ensure_Ansible_Prereq.Package_Facts
  ansible.builtin.package_facts:
- name: 'ensure_ansible_prereq.service_facts'
+- name: Ensure_Ansible_Prereq.Service_Facts
  ansible.builtin.service_facts:
- name: 'ensure_ansible_prereq.service_reload'
+- name: Ensure_Ansible_Prereq.Service_Reload
  when:
    - ansible_facts["system"] == 'Linux'
    - ansible_facts["service_mgr"] == 'systemd'
    - ensure_ansible_prereq is defined
  ansible.builtin.systemd:
    daemon_reload: 'yes'
- name: 'ensure_ansible_prereq.service_restart'
+- name: Ensure_Ansible_Prereq.Service_Restart
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_ansible_prereq is defined
@@ -21,9 +21,7 @@
  ansible.builtin.service:
    enabled: '{{ item.enabled }}'
    name: '{{ item.name }}'
-    state: 'restarted'
+    state: restarted
  loop: '{{ ensure_ansible_prereq.service_list }}'
  loop_control:
    label: '{{ item.name }} will be restarted'
 ...
@@ -1,53 +1,9 @@
 ---
 galaxy_info:
  author: Jason Rothstein
  description: Ensure required pre-req are present for ansible management
-  company: your company (optional)
+  company: fdragon
  # If the issue tracker for your role is not on github, uncomment the
  # next line and provide a value
  # issue_tracker_url: http://example.com/issue/tracker
  # Choose a valid license ID from https://spdx.org - some suggested licenses:
  # - BSD-3-Clause (default)
  # - MIT
  # - GPL-2.0-or-later
  # - GPL-3.0-only
  # - Apache-2.0
  # - CC-BY-4.0
  license: LGPL-3.0-or-later
-
+  min_ansible_version: '2.9'
  min_ansible_version: 2.9
  # If this a Container Enabled role, provide the minimum Ansible Container version.
  # min_ansible_container_version:
  #
  # Provide a list of supported platforms, and for each platform a list of versions.
  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
  # To view available platforms and versions (or releases), visit:
  # https://galaxy.ansible.com/api/v1/platforms/
  #
  # platforms:
  # - name: Fedora
  #   versions:
  #   - all
  #   - 25
  # - name: SomePlatform
  #   versions:
  #   - all
  #   - 1.0
  #   - 7
  #   - 99.99
  galaxy_tags: []
    # List tags for your role here, one per line. A tag is a keyword that describes
    # and categorizes the role. Users find roles by searching for tags. Be sure to
    # remove the '[]' above, if you add tags to this list.
    #
    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
    #       Maximum 20 tags per role.
 dependencies: []
  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
  # if you add dependencies to this list.
@@ -1,9 +1,7 @@
 ---
 # tasks file for ensure_ansible_prereq
- name: 'repository changes'
+- name: Repository Changes
  ansible.builtin.lineinfile:
-    path: '/etc/apt/sources.list'
+    path: /etc/apt/sources.list
-    state: 'absent'
+    state: absent
    regexp: 'deb cdrom:'
 ...
@@ -1,2 +1,2 @@
 ---
-# tasks file for ensure_ansible_prereq
+...
@@ -1,53 +1,64 @@
 ---
 # tasks file for ensure_ansible_prereq
- name: 'include vendor / version specific tasks'
+- name: Assert Target OS Is Supported
  when:
-    - ansible_facts["system"] == 'Linux'
+    - ansible_facts["system"] is defined
  ansible.builtin.assert:
    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
    quiet: true
    that:
      - ansible_facts["system"] == 'Linux'
      - >-
        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Vendor / Version Specific Tasks
  ansible.builtin.include_tasks:
    file: '{{ lookup("first_found", findme) }}'
  vars:
    findme:
      files:
-        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
-        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+          }}-{{ ansible_facts["architecture"] }}.yml'
        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
          }}-default.yml'
        - '{{ ansible_facts["distribution"] }}-default.yml'
-        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
-        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+          }}-{{ ansible_facts["architecture"] }}.yml'
        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
          }}-default.yml'
        - '{{ ansible_facts["os_family"] }}-default.yml'
-        - 'default.yml'
+        - default.yml
-      errors: 'ignore'
+      errors: ignore
- name: 'include vendor / version specific variables'
+- name: Include Vendor / Version Specific Variables
  when:
    - ansible_facts["system"] == 'Linux'
  ansible.builtin.include_vars:
    file: '{{ lookup("first_found", findme) }}'
-    name: 'ensure_ansible_prereq'
+    name: ensure_ansible_prereq
  vars:
    findme:
      files:
-        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
-        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+          }}-{{ ansible_facts["architecture"] }}.yml'
        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
          }}-default.yml'
        - '{{ ansible_facts["distribution"] }}-default.yml'
-        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
-        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+          }}-{{ ansible_facts["architecture"] }}.yml'
        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
          }}-default.yml'
        - '{{ ansible_facts["os_family"] }}-default.yml'
-        - 'default.yml'
+        - default.yml
-      paths:
+      paths: [../vars/]
-        - '../vars/'
+      errors: ignore
-      errors: 'ignore'
+- name: Package Discovery
 - name: 'package discovery'
  when:
    - ansible_facts["system"] == 'Linux'
    - ansible_facts["packages"] is not defined
  ansible.builtin.package_facts:
- name: 'service discovery'
+- name: Service Discovery
  when:
    - ansible_facts["system"] == 'Linux'
    - ansible_facts["services"] is not defined
  ansible.builtin.service_facts:
- name: 'ensure packages'
+- name: Ensure Packages
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_ansible_prereq is defined
    - ensure_ansible_prereq.package_list is defined
    - ensure_ansible_prereq.package_list is iterable
@@ -58,11 +69,10 @@
  loop_control:
    label: '{{ item.name }} will be {{ item.state }}'
  notify:
-    - 'ensure_ansible_prereq.package_facts'
+    - Ensure_Ansible_Prereq.Package_Facts
-    - 'ensure_ansible_prereq.service_facts'
+    - Ensure_Ansible_Prereq.Service_Facts
- name: 'ensure configurations'
+- name: Ensure Configurations
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_ansible_prereq is defined
    - ensure_ansible_prereq.template_list is defined
    - ensure_ansible_prereq.template_list is iterable
@@ -72,7 +82,7 @@
    group: '{{ item.group | default(omit) }}'
    mode: '{{ item.mode | default(omit) }}'
    owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
    serole: '{{ item.serole | default(omit) }}'
    setype: '{{ item.setype | default(omit) }}'
    seuser: '{{ item.seuser | default(omit) }}'
@@ -81,13 +91,12 @@
  loop_control:
    label: '{{ item.dest }} will be ensured'
  notify:
-    - 'ensure_ansible_prereq.package_facts'
+    - Ensure_Ansible_Prereq.Package_Facts
-    - 'ensure_ansible_prereq.service_facts'
+    - Ensure_Ansible_Prereq.Service_Facts
-    - 'ensure_ansible_prereq.service_reload'
+    - Ensure_Ansible_Prereq.Service_Reload
-    - 'ensure_ansible_prereq.service_restart'
+    - Ensure_Ansible_Prereq.Service_Restart
- name: 'ensure services'
+- name: Ensure Services
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_ansible_prereq is defined
    - ensure_ansible_prereq.service_list is defined
    - ensure_ansible_prereq.service_list is iterable
@@ -99,8 +108,26 @@
  loop_control:
    label: '{{ item.name }} will be {{ item.state }}'
  notify:
-    - 'ensure_ansible_prereq.package_facts'
+    - Ensure_Ansible_Prereq.Package_Facts
-    - 'ensure_ansible_prereq.service_facts'
+    - Ensure_Ansible_Prereq.Service_Facts
- name: 'flush handlers'
+- name: Flush Handlers
-  ansible.builtin.meta: 'flush_handlers'
+  ansible.builtin.meta: flush_handlers
-...
+- name: Post Verification Package Discovery
  when:
    - ensure_ansible_prereq is defined
    - ensure_ansible_prereq.package_list is defined
    - ensure_ansible_prereq.package_list is iterable
  ansible.builtin.package_facts:
 - name: Assert Managed Packages Are Installed
  when:
    - ensure_ansible_prereq is defined
    - ensure_ansible_prereq.package_list is defined
    - ensure_ansible_prereq.package_list is iterable
  ansible.builtin.assert:
    fail_msg: "Package {{ item.name }} is not installed"
    quiet: true
    that:
      - item.state != 'present' or ansible_facts['packages'][item.name] is defined
  loop: "{{ ensure_ansible_prereq.package_list }}"
  loop_control:
    label: "{{ item.name }} will be verified"
@@ -1,2 +0,0 @@
 localhost
@@ -1,5 +0,0 @@
 ---
 - hosts: localhost
  remote_user: root
  roles:
    - ensure_ansible_prereq
@@ -1,2 +1,2 @@
 ---
-# vars file for ensure_ansible_prereq
+...
@@ -1,2 +1,2 @@
 ---
-# vars file for ensure_ansible_prereq
+...
@@ -1,16 +1,13 @@
 ---
 language: python
-python: "2.7"
+python: '2.7'
 # Use the new container infrastructure
 sudo: false
 # Install ansible
 addons:
  apt:
-    packages:
+    packages: [python-pip]
    - python-pip
 install:
  # Install ansible
  - pip install ansible
@@ -20,10 +17,8 @@ install:
  # Create ansible.cfg with correct roles_path
  - printf '[defaults]\nroles_path=../' >ansible.cfg
 script:
  # Basic role syntax check
  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
 notifications:
  webhooks: https://galaxy.ansible.com/api/v1/notifications/
@@ -1,163 +0,0 @@
 GNU LESSER GENERAL PUBLIC LICENSE
 Version 3, 29 June 2007
 Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
 Everyone is permitted to copy and distribute verbatim copies of this license
 document, but changing it is not allowed.
 This version of the GNU Lesser General Public License incorporates the terms
 and conditions of version 3 of the GNU General Public License, supplemented
 by the additional permissions listed below.
   0. Additional Definitions.
 As used herein, "this License" refers to version 3 of the GNU Lesser General
 Public License, and the "GNU GPL" refers to version 3 of the GNU General Public
 License.
 "The Library" refers to a covered work governed by this License, other than
 an Application or a Combined Work as defined below.
 An "Application" is any work that makes use of an interface provided by the
 Library, but which is not otherwise based on the Library. Defining a subclass
 of a class defined by the Library is deemed a mode of using an interface provided
 by the Library.
 A "Combined Work" is a work produced by combining or linking an Application
 with the Library. The particular version of the Library with which the Combined
 Work was made is also called the "Linked Version".
 The "Minimal Corresponding Source" for a Combined Work means the Corresponding
 Source for the Combined Work, excluding any source code for portions of the
 Combined Work that, considered in isolation, are based on the Application,
 and not on the Linked Version.
 The "Corresponding Application Code" for a Combined Work means the object
 code and/or source code for the Application, including any data and utility
 programs needed for reproducing the Combined Work from the Application, but
 excluding the System Libraries of the Combined Work.
   1. Exception to Section 3 of the GNU GPL.
 You may convey a covered work under sections 3 and 4 of this License without
 being bound by section 3 of the GNU GPL.
   2. Conveying Modified Versions.
 If you modify a copy of the Library, and, in your modifications, a facility
 refers to a function or data to be supplied by an Application that uses the
 facility (other than as an argument passed when the facility is invoked),
 then you may convey a copy of the modified version:
 a) under this License, provided that you make a good faith effort to ensure
 that, in the event an Application does not supply the function or data, the
 facility still operates, and performs whatever part of its purpose remains
 meaningful, or
 b) under the GNU GPL, with none of the additional permissions of this License
 applicable to that copy.
   3. Object Code Incorporating Material from Library Header Files.
 The object code form of an Application may incorporate material from a header
 file that is part of the Library. You may convey such object code under terms
 of your choice, provided that, if the incorporated material is not limited
 to numerical parameters, data structure layouts and accessors, or small macros,
 inline functions and templates (ten or fewer lines in length), you do both
 of the following:
 a) Give prominent notice with each copy of the object code that the Library
 is used in it and that the Library and its use are covered by this License.
 b) Accompany the object code with a copy of the GNU GPL and this license document.
   4. Combined Works.
 You may convey a Combined Work under terms of your choice that, taken together,
 effectively do not restrict modification of the portions of the Library contained
 in the Combined Work and reverse engineering for debugging such modifications,
 if you also do each of the following:
 a) Give prominent notice with each copy of the Combined Work that the Library
 is used in it and that the Library and its use are covered by this License.
 b) Accompany the Combined Work with a copy of the GNU GPL and this license
 document.
 c) For a Combined Work that displays copyright notices during execution, include
 the copyright notice for the Library among these notices, as well as a reference
 directing the user to the copies of the GNU GPL and this license document.
      d) Do one of the following:
 0) Convey the Minimal Corresponding Source under the terms of this License,
 and the Corresponding Application Code in a form suitable for, and under terms
 that permit, the user to recombine or relink the Application with a modified
 version of the Linked Version to produce a modified Combined Work, in the
 manner specified by section 6 of the GNU GPL for conveying Corresponding Source.
 1) Use a suitable shared library mechanism for linking with the Library. A
 suitable mechanism is one that (a) uses at run time a copy of the Library
 already present on the user's computer system, and (b) will operate properly
 with a modified version of the Library that is interface-compatible with the
 Linked Version.
 e) Provide Installation Information, but only if you would otherwise be required
 to provide such information under section 6 of the GNU GPL, and only to the
 extent that such information is necessary to install and execute a modified
 version of the Combined Work produced by recombining or relinking the Application
 with a modified version of the Linked Version. (If you use option 4d0, the
 Installation Information must accompany the Minimal Corresponding Source and
 Corresponding Application Code. If you use option 4d1, you must provide the
 Installation Information in the manner specified by section 6 of the GNU GPL
 for conveying Corresponding Source.)
   5. Combined Libraries.
 You may place library facilities that are a work based on the Library side
 by side in a single library together with other library facilities that are
 not Applications and are not covered by this License, and convey such a combined
 library under terms of your choice, if you do both of the following:
 a) Accompany the combined library with a copy of the same work based on the
 Library, uncombined with any other library facilities, conveyed under the
 terms of this License.
 b) Give prominent notice with the combined library that part of it is a work
 based on the Library, and explaining where to find the accompanying uncombined
 form of the same work.
   6. Revised Versions of the GNU Lesser General Public License.
 The Free Software Foundation may publish revised and/or new versions of the
 GNU Lesser General Public License from time to time. Such new versions will
 be similar in spirit to the present version, but may differ in detail to address
 new problems or concerns.
 Each version is given a distinguishing version number. If the Library as you
 received it specifies that a certain numbered version of the GNU Lesser General
 Public License "or any later version" applies to it, you have the option of
 following the terms and conditions either of that published version or of
 any later version published by the Free Software Foundation. If the Library
 as you received it does not specify a version number of the GNU Lesser General
 Public License, you may choose any version of the GNU Lesser General Public
 License ever published by the Free Software Foundation.
 If the Library as you received it specifies that a proxy can decide whether
 future versions of the GNU Lesser General Public License shall apply, that
 proxy's public statement of acceptance of any version is permanent authorization
 for you to choose that version for the Library.
@@ -1,4 +1,4 @@
 ---
 # defaults file for ensure_apache
-lets_encrypt_admin: 'root@example.com'
+lets_encrypt_admin: root@example.com
-lets_encrypt_url: 'https://acme-v02.api.letsencrypt.org/directory'
+lets_encrypt_url: https://acme-v02.api.letsencrypt.org/directory
@@ -1,17 +1,17 @@
 ---
 # handlers file for ensure_apache
- name: 'ensure_apache.package_facts'
+- name: Ensure_Apache.Package_Facts
  ansible.builtin.package_facts:
- name: 'ensure_apache.service_facts'
+- name: Ensure_Apache.Service_Facts
  ansible.builtin.service_facts:
- name: 'ensure_apache.service_reload'
+- name: Ensure_Apache.Service_Reload
  when:
    - ansible_facts["system"] == 'Linux'
    - ansible_facts["service_mgr"] == 'systemd'
    - ensure_apache is defined
  ansible.builtin.systemd:
    daemon_reload: 'yes'
- name: 'ensure_apache.service_restart'
+- name: Ensure_Apache.Service_Reload_Config
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_apache is defined
@@ -21,9 +21,7 @@
  ansible.builtin.service:
    enabled: '{{ item.enabled }}'
    name: '{{ item.name }}'
-    state: 'restarted'
+    state: '{{ item.state_handler | default("reloaded") }}'
  loop: '{{ ensure_apache.service_list }}'
  loop_control:
-    label: '{{ item.name }} will be restarted'
+    label: '{{ item.name }} will be {{ item.state_handler | default("reloaded") }}'
 ...
@@ -1,53 +1,10 @@
 ---
 galaxy_info:
  author: Jason Rothstein
  description: Ensure Apache is installed, running, and functional
-  company: your company (optional)
+  company: fdragon
  # If the issue tracker for your role is not on github, uncomment the
  # next line and provide a value
  # issue_tracker_url: http://example.com/issue/tracker
  # Choose a valid license ID from https://spdx.org - some suggested licenses:
  # - BSD-3-Clause (default)
  # - MIT
  # - GPL-2.0-or-later
  # - GPL-3.0-only
  # - Apache-2.0
  # - CC-BY-4.0
  license: LGPL-3.0-or-later
-
+  min_ansible_version: '2.9'
  min_ansible_version: 2.9
  # If this a Container Enabled role, provide the minimum Ansible Container version.
  # min_ansible_container_version:
  #
  # Provide a list of supported platforms, and for each platform a list of versions.
  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
  # To view available platforms and versions (or releases), visit:
  # https://galaxy.ansible.com/api/v1/platforms/
  #
  # platforms:
  # - name: Fedora
  #   versions:
  #   - all
  #   - 25
  # - name: SomePlatform
  #   versions:
  #   - all
  #   - 1.0
  #   - 7
  #   - 99.99
  galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
+dependencies:
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
+  - role: ensure_firewalld
    # remove the '[]' above, if you add tags to this list.
    #
    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
    #       Maximum 20 tags per role.
 dependencies: []
  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
  # if you add dependencies to this list.
@@ -1,37 +1,46 @@
 ---
 # tasks file for ensure_apache
- name: 'include variables'
+- name: Assert Target OS Is Supported
  when:
-    - ansible_facts["system"] == 'Linux'
+    - ansible_facts["system"] is defined
  ansible.builtin.assert:
    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
    quiet: true
    that:
      - ansible_facts["system"] == 'Linux'
      - >-
        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Debian',
        'Fedora', 'OracleLinux', 'Rocky', 'Ubuntu']
 - name: Include Variables
  ansible.builtin.include_vars:
    file: '{{ lookup("first_found", findme) }}'
-    name: 'ensure_apache'
+    name: ensure_apache
  vars:
    findme:
      files:
-        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
-        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+          }}-{{ ansible_facts["architecture"] }}.yml'
        - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"]
          }}-default.yml'
        - '{{ ansible_facts["distribution"] }}-default.yml'
-        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml'
+        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
-        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml'
+          }}-{{ ansible_facts["architecture"] }}.yml'
        - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"]
          }}-default.yml'
        - '{{ ansible_facts["os_family"] }}-default.yml'
-        - 'default.yml'
+        - default.yml
-      paths:
+      paths: [../vars/]
-        - '../vars/'
+      errors: ignore
-      errors: 'ignore'
+- name: Package Discovery
 - name: 'package discovery'
  when:
    - ansible_facts["system"] == 'Linux'
    - ansible_facts["packages"] is not defined
  ansible.builtin.package_facts:
- name: 'service discovery'
+- name: Service Discovery
  when:
    - ansible_facts["system"] == 'Linux'
    - ansible_facts["services"] is not defined
  ansible.builtin.service_facts:
- name: 'ensure sysctl'
+- name: Ensure Sysctl
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_apache is defined
    - ensure_apache.sysctl_list is defined
    - ensure_apache.sysctl_list is iterable
@@ -46,13 +55,12 @@
  loop_control:
    label: '{{ item.name }} will be {{ item.value }}'
  notify:
-    - 'ensure_apache.package_facts'
+    - Ensure_Apache.Package_Facts
-    - 'ensure_apache.service_facts'
+    - Ensure_Apache.Service_Facts
-    - 'ensure_apache.service_reload'
+    - Ensure_Apache.Service_Reload
-    - 'ensure_apache.service_restart'
+    - Ensure_Apache.Service_Reload_Config
- name: 'ensure packages'
+- name: Ensure Packages
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_apache is defined
    - ensure_apache.package_list is defined
    - ensure_apache.package_list is iterable
@@ -63,13 +71,12 @@
  loop_control:
    label: '{{ item.name }} will be {{ item.state }}'
  notify:
-    - 'ensure_apache.package_facts'
+    - Ensure_Apache.Package_Facts
-    - 'ensure_apache.service_facts'
+    - Ensure_Apache.Service_Facts
-    - 'ensure_apache.service_reload'
+    - Ensure_Apache.Service_Reload
-    - 'ensure_apache.service_restart'
+    - Ensure_Apache.Service_Reload_Config
- name: 'ensure seboolean'
+- name: Ensure Seboolean
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_apache is defined
    - ensure_apache.seboolean_list is defined
    - ensure_apache.seboolean_list is iterable
@@ -81,13 +88,12 @@
  loop_control:
    label: '{{ item.name }} will be {{ item.state }}'
  notify:
-    - 'ensure_apache.package_facts'
+    - Ensure_Apache.Package_Facts
-    - 'ensure_apache.service_facts'
+    - Ensure_Apache.Service_Facts
-    - 'ensure_apache.service_reload'
+    - Ensure_Apache.Service_Reload
-    - 'ensure_apache.service_restart'
+    - Ensure_Apache.Service_Reload_Config
- name: 'ensure configurations'
+- name: Ensure Configurations
  when:
    - ansible_facts["system"] == 'Linux'
    - http_vhost is defined
    - ensure_apache is defined
    - ensure_apache.template_list is defined
@@ -98,7 +104,7 @@
    group: '{{ item.group | default(omit) }}'
    mode: '{{ item.mode | default(omit) }}'
    owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
    serole: '{{ item.serole | default(omit) }}'
    setype: '{{ item.setype | default(omit) }}'
    seuser: '{{ item.seuser | default(omit) }}'
@@ -107,33 +113,31 @@
  loop_control:
    label: '{{ item.dest }} will be ensured'
  notify:
-    - 'ensure_apache.package_facts'
+    - Ensure_Apache.Package_Facts
-    - 'ensure_apache.service_facts'
+    - Ensure_Apache.Service_Facts
-    - 'ensure_apache.service_reload'
+    - Ensure_Apache.Service_Reload
-    - 'ensure_apache.service_restart'
+    - Ensure_Apache.Service_Reload_Config
- name: 'ensure firewall'
+- name: Ensure Firewall
  when:
    - ansible_facts["system"] == 'Linux'
    - ansible_facts.packages["firewalld"] is defined
    - ansible_facts.packages["python3-firewall"] is defined
    - ensure_apache is defined
-    - ensure_apache.firewall_list is defined
+    - ensure_apache.firewalld_list is defined
-    - ensure_apache.firewall_list is iterable
+    - ensure_apache.firewalld_list is iterable
  ansible.posix.firewalld:
    permanent: '{{ item.permanent }}'
    service: '{{ item.service }}'
    state: '{{ item.state }}'
-  loop: '{{ ensure_apache.firewall_list }}'
+  loop: '{{ ensure_apache.firewalld_list }}'
  loop_control:
    label: '{{ item.service }} will be {{ item.state }}'
  notify:
-    - 'ensure_apache.package_facts'
+    - Ensure_Apache.Package_Facts
-    - 'ensure_apache.service_facts'
+    - Ensure_Apache.Service_Facts
-    - 'ensure_apache.service_reload'
+    - Ensure_Apache.Service_Reload
-    - 'ensure_apache.service_restart'
+    - Ensure_Apache.Service_Reload_Config
- name: 'ensure permissions'
+- name: Ensure Permissions
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_apache is defined
    - http_vhost is defined
    - http_vhost is iterable
@@ -158,35 +162,33 @@
  loop_control:
    label: '{{ item.path }} will be ensured'
  notify:
-    - 'ensure_apache.package_facts'
+    - Ensure_Apache.Package_Facts
-    - 'ensure_apache.service_facts'
+    - Ensure_Apache.Service_Facts
-    - 'ensure_apache.service_reload'
+    - Ensure_Apache.Service_Reload
-    - 'ensure_apache.service_restart'
+    - Ensure_Apache.Service_Reload_Config
- name: 'ensure vhost document roots'
+- name: Ensure Vhost Document Roots
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_apache is defined
    - http_vhost is defined
    - http_vhost is iterable
    - item.fqdn is defined
  ansible.builtin.file:
-    path: '/srv/http/{{ item.fqdn }}'
+    path: /srv/http/{{ item.fqdn }}
-    state: 'directory'
+    state: directory
-    owner: 'root'
+    owner: root
-    group: 'root'
+    group: root
    mode: '0755'
-    setype: 'httpd_sys_content_t'
+    setype: httpd_sys_content_t
  loop: '{{ http_vhost }}'
  loop_control:
-    label: '/srv/http/{{ item.fqdn }} will be ensured'
+    label: /srv/http/{{ item.fqdn }} will be ensured
  notify:
-    - 'ensure_apache.package_facts'
+    - Ensure_Apache.Package_Facts
-    - 'ensure_apache.service_facts'
+    - Ensure_Apache.Service_Facts
-    - 'ensure_apache.service_reload'
+    - Ensure_Apache.Service_Reload
-    - 'ensure_apache.service_restart'
+    - Ensure_Apache.Service_Reload_Config
- name: 'ensure website content from git repos'
+- name: Ensure Website Content From Git Repos
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_apache is defined
    - http_vhost is defined
    - http_vhost is iterable
@@ -194,19 +196,18 @@
    - item.repo is defined
  ansible.builtin.git:
    accept_hostkey: 'yes'
-    dest: '/srv/http/{{ item.fqdn }}'
+    dest: /srv/http/{{ item.fqdn }}
    repo: '{{ item.repo }}'
  loop: '{{ http_vhost }}'
  loop_control:
-    label: '/srv/http/{{ item.fqdn }} will be populated...'
+    label: /srv/http/{{ item.fqdn }} will be populated...
  notify:
-    - 'ensure_apache.package_facts'
+    - Ensure_Apache.Package_Facts
-    - 'ensure_apache.service_facts'
+    - Ensure_Apache.Service_Facts
-    - 'ensure_apache.service_reload'
+    - Ensure_Apache.Service_Reload
-    - 'ensure_apache.service_restart'
+    - Ensure_Apache.Service_Reload_Config
- name: 'ensure services'
+- name: Ensure Services
  when:
    - ansible_facts["system"] == 'Linux'
    - ensure_apache is defined
    - ensure_apache.service_list is defined
    - ensure_apache.service_list is iterable
@@ -218,10 +219,33 @@
  loop_control:
    label: '{{ item.name }} will be {{ item.state }}'
  notify:
-    - 'ensure_apache.package_facts'
+    - Ensure_Apache.Package_Facts
-    - 'ensure_apache.service_facts'
+    - Ensure_Apache.Service_Facts
-    - 'ensure_apache.service_reload'
+    - Ensure_Apache.Service_Reload
-    - 'ensure_apache.service_restart'
+    - Ensure_Apache.Service_Reload_Config
- name: 'flush handlers'
+- name: Flush Handlers
-  ansible.builtin.meta: 'flush_handlers'
+  ansible.builtin.meta: flush_handlers
-...
+- name: Post Verification Service Discovery
  when:
    - ensure_apache is defined
    - ensure_apache.service_list is defined
    - ensure_apache.service_list is iterable
  ansible.builtin.service_facts:
 - name: Assert Managed Services Are Active
  when:
    - ensure_apache is defined
    - ensure_apache.service_list is defined
    - ensure_apache.service_list is iterable
  ansible.builtin.assert:
    fail_msg: "Service {{ item.name }} is not active"
    quiet: true
    that:
      - >-
        item.state != 'started' or
        (ansible_facts['services'][item.name ~ '.service'] is defined and
        ansible_facts['services'][item.name ~ '.service']['state'] == 'running') or
        (ansible_facts['services'][item.name] is defined and
        ansible_facts['services'][item.name]['state'] == 'running')
  loop: "{{ ensure_apache.service_list }}"
  loop_control:
    label: "{{ item.name }} will be verified"
@@ -1,9 +0,0 @@
 This directory holds configuration files for the Apache HTTP Server;
 any files in this directory which have the ".conf" extension will be
 processed as httpd configuration files.  The directory is used in
 addition to the directory /etc/httpd/conf.modules.d/, which contains
 configuration files necessary to load modules.
 Files are processed in sorted order.  See httpd.conf(5) for more
 information.
@@ -1,93 +0,0 @@
 #
 # Directives controlling the display of server-generated directory listings.
 #
 # Required modules: mod_authz_core, mod_authz_host,
 #                   mod_autoindex, mod_alias
 #
 # To see the listing of a directory, the Options directive for the
 # directory must include "Indexes", and the directory must not contain
 # a file matching those listed in the DirectoryIndex directive.
 #
 #
 # IndexOptions: Controls the appearance of server-generated directory
 # listings.
 #
 IndexOptions FancyIndexing HTMLTable VersionSort
 # We include the /icons/ alias for FancyIndexed directory listings.  If
 # you do not use FancyIndexing, you may comment this out.
 #
 Alias /icons/ "/usr/share/httpd/icons/"
 <Directory "/usr/share/httpd/icons">
    Options Indexes MultiViews FollowSymlinks
    AllowOverride None
    Require all granted
 </Directory>
 #
 # AddIcon* directives tell the server which icon to show for different
 # files or filename extensions.  These are only displayed for
 # FancyIndexed directories.
 #
 AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
 AddIconByType (TXT,/icons/text.gif) text/*
 AddIconByType (IMG,/icons/image2.gif) image/*
 AddIconByType (SND,/icons/sound2.gif) audio/*
 AddIconByType (VID,/icons/movie.gif) video/*
 AddIconByType /icons/bomb.gif application/x-coredump
 AddIcon /icons/binary.gif .bin .exe
 AddIcon /icons/binhex.gif .hqx
 AddIcon /icons/tar.gif .tar
 AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
 AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
 AddIcon /icons/a.gif .ps .ai .eps
 AddIcon /icons/layout.gif .html .shtml .htm .pdf
 AddIcon /icons/text.gif .txt
 AddIcon /icons/c.gif .c
 AddIcon /icons/p.gif .pl .py
 AddIcon /icons/f.gif .for
 AddIcon /icons/dvi.gif .dvi
 AddIcon /icons/uuencoded.gif .uu
 AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
 AddIcon /icons/tex.gif .tex
 AddIcon /icons/back.gif ..
 AddIcon /icons/hand.right.gif README
 AddIcon /icons/folder.gif ^^DIRECTORY^^
 AddIcon /icons/blank.gif ^^BLANKICON^^
 #
 # DefaultIcon is which icon to show for files which do not have an icon
 # explicitly set.
 #
 DefaultIcon /icons/unknown.gif
 #
 # AddDescription allows you to place a short description after a file in
 # server-generated indexes.  These are only displayed for FancyIndexed
 # directories.
 # Format: AddDescription "description" filename
 #
 #AddDescription "GZIP compressed document" .gz
 #AddDescription "tar archive" .tar
 #AddDescription "GZIP compressed tar archive" .tgz
 #
 # ReadmeName is the name of the README file the server will look for by
 # default, and append to directory listings.
 #
 # HeaderName is the name of a file which should be prepended to
 # directory indexes. 
 ReadmeName README.html
 HeaderName HEADER.html
 #
 # IndexIgnore is a set of filenames which directory indexing should ignore
 # and not include in the listing.  Shell-style wildcarding is permitted.
 #
 IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
@@ -1,62 +0,0 @@
 #
 # The following lines prevent .user.ini files from being viewed by Web clients.
 #
 <Files ".user.ini">
    Require all denied
 </Files>
 #
 # Allow php to handle Multiviews
 #
 AddType text/html .php
 #
 # Add index.php to the list of files that will be served as directory
 # indexes.
 #
 DirectoryIndex index.php
 #
 # Redirect to local php-fpm (no mod_php in default configuration)
 #
 <IfModule !mod_php.c>
    # Enable http authorization headers
    SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1
    <FilesMatch \.(php|phar)$>
        SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost"
    </FilesMatch>
 </IfModule>
 #
 # mod_php is deprecated as FPM is now used by default with httpd in event mode
 # mod_php is only used when explicitly enabled or httpd switch to prefork mode
 #
 # mod_php options
 #
 <IfModule  mod_php.c>
    #
    # Cause the PHP interpreter to handle files with a .php extension.
    #
    <FilesMatch \.(php|phar)$>
        SetHandler application/x-httpd-php
    </FilesMatch>
    #
    # Uncomment the following lines to allow PHP to pretty-print .phps
    # files as PHP source code:
    #
    #<FilesMatch \.phps$>
    #    SetHandler application/x-httpd-php-source
    #</FilesMatch>
    #
    # Apache specific PHP configuration options
    # those can be override in each configured vhost
    #
    php_value session.save_handler "files"
    php_value session.save_path    "/var/lib/php/session"
    php_value soap.wsdl_cache_dir  "/var/lib/php/wsdlcache"
    #php_value opcache.file_cache   "/var/lib/php/opcache"
 </IfModule>
@@ -1,219 +0,0 @@
 #
 # When we also provide SSL we have to listen to the 
 # standard HTTPS port in addition.
 #
 Listen 443 https
 ##
 ##  SSL Global Context
 ##
 ##  All SSL configuration in this context applies both to
 ##  the main server and all SSL-enabled virtual hosts.
 ##
 #   Pass Phrase Dialog:
 #   Configure the pass phrase gathering process.
 #   The filtering dialog program (`builtin' is a internal
 #   terminal dialog) has to provide the pass phrase on stdout.
 SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
 #   Inter-Process Session Cache:
 #   Configure the SSL Session Cache: First the mechanism 
 #   to use and second the expiring timeout (in seconds).
 SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
 SSLSessionCacheTimeout  300
 #   Pseudo Random Number Generator (PRNG):
 #   Configure one or more sources to seed the PRNG of the 
 #   SSL library. The seed data should be of good random quality.
 #   WARNING! On some platforms /dev/random blocks if not enough entropy
 #   is available. This means you then cannot use the /dev/random device
 #   because it would lead to very long connection times (as long as
 #   it requires to make more entropy available). But usually those
 #   platforms additionally provide a /dev/urandom device which doesn't
 #   block. So, if available, use this one instead. Read the mod_ssl User
 #   Manual for more details.
 SSLRandomSeed startup file:/dev/urandom  256
 SSLRandomSeed connect builtin
 #SSLRandomSeed startup file:/dev/random  512
 #SSLRandomSeed connect file:/dev/random  512
 #SSLRandomSeed connect file:/dev/urandom 512
 #
 # Use "SSLCryptoDevice" to enable any supported hardware
 # accelerators. Use "openssl engine -v" to list supported
 # engine names.  NOTE: If you enable an accelerator and the
 # server does not start, consult the error logs and ensure
 # your accelerator is functioning properly. 
 #
 SSLCryptoDevice builtin
 #SSLCryptoDevice ubsec
 ##
 ## SSL Virtual Host Context
 ##
 <VirtualHost _default_:443>
 # General setup for the virtual host, inherited from global configuration
 #DocumentRoot "/var/www/html"
 #ServerName www.example.com:443
 # Use separate log files for the SSL virtual host; note that LogLevel
 # is not inherited from httpd.conf.
 ErrorLog logs/ssl_error_log
 TransferLog logs/ssl_access_log
 LogLevel warn
 #   SSL Engine Switch:
 #   Enable/Disable SSL for this virtual host.
 SSLEngine on
 #   List the protocol versions which clients are allowed to connect with.
 #   The OpenSSL system profile is configured by default.  See
 #   update-crypto-policies(8) for more details.
 #SSLProtocol all -SSLv3
 #SSLProxyProtocol all -SSLv3
 #   User agents such as web browsers are not configured for the user's
 #   own preference of either security or performance, therefore this
 #   must be the prerogative of the web server administrator who manages
 #   cpu load versus confidentiality, so enforce the server's cipher order.
 SSLHonorCipherOrder on
 #   SSL Cipher Suite:
 #   List the ciphers that the client is permitted to negotiate.
 #   See the mod_ssl documentation for a complete list.
 #   The OpenSSL system profile is configured by default.  See
 #   update-crypto-policies(8) for more details.
 SSLCipherSuite PROFILE=SYSTEM
 SSLProxyCipherSuite PROFILE=SYSTEM
 #   Point SSLCertificateFile at a PEM encoded certificate.  If
 #   the certificate is encrypted, then you will be prompted for a
 #   pass phrase.  Note that restarting httpd will prompt again.  Keep
 #   in mind that if you have both an RSA and a DSA certificate you
 #   can configure both in parallel (to also allow the use of DSA
 #   ciphers, etc.)
 #   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
 #   require an ECC certificate which can also be configured in
 #   parallel.
 SSLCertificateFile /etc/pki/tls/certs/localhost.crt
 #   Server Private Key:
 #   If the key is not combined with the certificate, use this
 #   directive to point at the key file.  Keep in mind that if
 #   you've both a RSA and a DSA private key you can configure
 #   both in parallel (to also allow the use of DSA ciphers, etc.)
 #   ECC keys, when in use, can also be configured in parallel
 SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
 #   Server Certificate Chain:
 #   Point SSLCertificateChainFile at a file containing the
 #   concatenation of PEM encoded CA certificates which form the
 #   certificate chain for the server certificate. Alternatively
 #   the referenced file can be the same as SSLCertificateFile
 #   when the CA certificates are directly appended to the server
 #   certificate for convenience.
 #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
 #   Certificate Authority (CA):
 #   Set the CA certificate verification path where to find CA
 #   certificates for client authentication or alternatively one
 #   huge file containing all of them (file must be PEM encoded)
 #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
 #   Client Authentication (Type):
 #   Client certificate verification type and depth.  Types are
 #   none, optional, require and optional_no_ca.  Depth is a
 #   number which specifies how deeply to verify the certificate
 #   issuer chain before deciding the certificate is not valid.
 #SSLVerifyClient require
 #SSLVerifyDepth  10
 #   Access Control:
 #   With SSLRequire you can do per-directory access control based
 #   on arbitrary complex boolean expressions containing server
 #   variable checks and other lookup directives.  The syntax is a
 #   mixture between C and Perl.  See the mod_ssl documentation
 #   for more details.
 #<Location />
 #SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
 #            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
 #            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
 #            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
 #            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
 #           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
 #</Location>
 #   SSL Engine Options:
 #   Set various options for the SSL engine.
 #   o FakeBasicAuth:
 #     Translate the client X.509 into a Basic Authorisation.  This means that
 #     the standard Auth/DBMAuth methods can be used for access control.  The
 #     user name is the `one line' version of the client's X.509 certificate.
 #     Note that no password is obtained from the user. Every entry in the user
 #     file needs this password: `xxj31ZMTZzkVA'.
 #   o ExportCertData:
 #     This exports two additional environment variables: SSL_CLIENT_CERT and
 #     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
 #     server (always existing) and the client (only existing when client
 #     authentication is used). This can be used to import the certificates
 #     into CGI scripts.
 #   o StdEnvVars:
 #     This exports the standard SSL/TLS related `SSL_*' environment variables.
 #     Per default this exportation is switched off for performance reasons,
 #     because the extraction step is an expensive operation and is usually
 #     useless for serving static content. So one usually enables the
 #     exportation for CGI and SSI requests only.
 #   o StrictRequire:
 #     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
 #     under a "Satisfy any" situation, i.e. when it applies access is denied
 #     and no other module can change it.
 #   o OptRenegotiate:
 #     This enables optimized SSL connection renegotiation handling when SSL
 #     directives are used in per-directory context. 
 #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
 <FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
 </FilesMatch>
 <Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
 </Directory>
 #   SSL Protocol Adjustments:
 #   The safe and default but still SSL/TLS standard compliant shutdown
 #   approach is that mod_ssl sends the close notify alert but doesn't wait for
 #   the close notify alert from client. When you need a different shutdown
 #   approach you can use one of the following variables:
 #   o ssl-unclean-shutdown:
 #     This forces an unclean shutdown when the connection is closed, i.e. no
 #     SSL close notify alert is sent or allowed to be received.  This violates
 #     the SSL/TLS standard but is needed for some brain-dead browsers. Use
 #     this when you receive I/O errors because of the standard approach where
 #     mod_ssl sends the close notify alert.
 #   o ssl-accurate-shutdown:
 #     This forces an accurate shutdown when the connection is closed, i.e. a
 #     SSL close notify alert is sent and mod_ssl waits for the close notify
 #     alert of the client. This is 100% SSL/TLS standard compliant, but in
 #     practice often causes hanging connections with brain-dead browsers. Use
 #     this only for browsers where you know that their SSL implementation
 #     works correctly. 
 #   Notice: Most problems of broken clients are also related to the HTTP
 #   keep-alive facility, so you usually additionally want to disable
 #   keep-alive for those clients, too. Use variable "nokeepalive" for this.
 #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
 #   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
 #   "force-response-1.0" for this.
 BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
 #   Per-Server Logging:
 #   The home of a custom SSL log file. Use this when you want a
 #   compact non-error SSL logfile on a virtual host basis.
 CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
 </VirtualHost>
@@ -1,36 +0,0 @@
 #
 # UserDir: The name of the directory that is appended onto a user's home
 # directory if a ~user request is received.
 #
 # The path to the end user account 'public_html' directory must be
 # accessible to the webserver userid.  This usually means that ~userid
 # must have permissions of 711, ~userid/public_html must have permissions
 # of 755, and documents contained therein must be world-readable.
 # Otherwise, the client will only receive a "403 Forbidden" message.
 #
 <IfModule mod_userdir.c>
    #
    # UserDir is disabled by default since it can confirm the presence
    # of a username on the system (depending on home directory
    # permissions).
    #
    UserDir disabled
    #
    # To enable requests to /~user/ to serve the user's public_html
    # directory, remove the "UserDir disabled" line above, and uncomment
    # the following line instead:
    # 
    #UserDir public_html
 </IfModule>
 #
 # Control access to UserDir directories.  The following is an example
 # for a site where these directories are restricted to read-only.
 #
 <Directory "/home/*/public_html">
    AllowOverride FileInfo AuthConfig Limit Indexes
    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    Require method GET POST OPTIONS
 </Directory>
@@ -1,78 +0,0 @@
 MDBaseServer on
 MDCertificateAgreement accepted
 MDCertificateAuthority {{ lets_encrypt_url }}
 MDContactEmail {{ lets_encrypt_admin }}
 MDPrivateKeys secp384r1 secp256r1 RSA 4096
 MDRequireHttps temporary
 MDStoreDir md
 <Directory "/srv/http">
    AllowOverride None
    Require all granted
 </Directory>
 {% for item in http_vhost %}
 <Directory "/srv/http/{{ item.fqdn }}">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
 </Directory>
 <VirtualHost *:80>
  ServerName {{ item.fqdn }}
 {% if item.aliases is defined %}
 {% for item_alias in item.aliases %}
  ServerAlias {{ item_alias }}
 {% endfor %}
 {% endif %}
  ServerAdmin webmaster@{{ item.fqdn }}
  DocumentRoot /srv/http/{{ item.fqdn }}
 {% if item.redirect is defined %}
  RedirectMatch "^(?!/\.well-known/).*" {{ item.redirect }}
 {% endif %}
 </VirtualHost>
 MDomain {{ item.fqdn }}
 <VirtualHost *:443>
  SSLEngine on
  SSLProtocol all -TLSv1.1
  SSLProxyProtocol all -TLSv1.1
  SSLHonorCipherOrder on
  SSLCipherSuite PROFILE=SYSTEM
  SSLProxyCipherSuite PROFILE=SYSTEM
  ServerName {{ item.fqdn }}
 {% if item.aliases is defined %}
 {% for item_alias in item.aliases %}
  ServerAlias {{ item_alias }}
 {% endfor %}
 {% endif %}
  ServerAdmin webmaster@{{ item.fqdn }}
  DocumentRoot /srv/http/{{ item.fqdn }}
  Alias /error/ "/var/www/error/"
 {% if item.proxy is defined %}
  ProxyPass "/.well-known" "!"
  ProxyPass "/phpMyAdmin" "!"
  ProxyPass "/phpmyadmin" "!"
  ProxyPass "/" "{{ item.proxy }}"
  ProxyPassReverse "/" "{{ item.proxy }}"
  ProxyTimeout 300
 {% endif %}
 {% if item.rewrite is defined %}
  RewriteEngine On
  RewriteCond %{HTTP:Upgrade} websocket [NC]
  RewriteCond %{HTTP:Connection} upgrade [NC]
  RewriteRule ^/?(.*) ws://{{ item.proxy }}/$1 [P,L]
 {% endif %}
 {% if item.redirect is defined %}
  RedirectMatch "^(?!/\.well-known/).*" {{ item.redirect }}
 {% endif %}
  <Location /.env>
    Require all denied
  </Location>
  <Location /.git>
    Require all denied
  </Location>
 </VirtualHost>
 {% endfor %}
@@ -1,20 +0,0 @@
 # 
 # This configuration file enables the default "Welcome" page if there
 # is no default index page present for the root URL.  To disable the
 # Welcome page, comment out all the lines below. 
 #
 # NOTE: if this file is removed, it will be restored on upgrades.
 #
 <LocationMatch "^/+$">
    Options -Indexes
    ErrorDocument 403 /.noindex.html
 </LocationMatch>
 <Directory /usr/share/httpd/noindex>
    AllowOverride None
    Require all granted
 </Directory>
 Alias /.noindex.html /usr/share/httpd/noindex/index.html
 Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png
 Alias /system_noindex_logo.png /usr/share/httpd/icons/system_noindex_logo.png
@@ -1,69 +0,0 @@
 #
 # This file loads most of the modules included with the Apache HTTP
 # Server itself.
 #
 LoadModule access_compat_module modules/mod_access_compat.so
 LoadModule actions_module modules/mod_actions.so
 LoadModule alias_module modules/mod_alias.so
 LoadModule allowmethods_module modules/mod_allowmethods.so
 LoadModule auth_basic_module modules/mod_auth_basic.so
 LoadModule auth_digest_module modules/mod_auth_digest.so
 LoadModule authn_anon_module modules/mod_authn_anon.so
 LoadModule authn_core_module modules/mod_authn_core.so
 LoadModule authn_dbd_module modules/mod_authn_dbd.so
 LoadModule authn_dbm_module modules/mod_authn_dbm.so
 LoadModule authn_file_module modules/mod_authn_file.so
 LoadModule authn_socache_module modules/mod_authn_socache.so
 LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
 LoadModule authz_core_module modules/mod_authz_core.so
 LoadModule authz_dbd_module modules/mod_authz_dbd.so
 LoadModule authz_dbm_module modules/mod_authz_dbm.so
 LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
 LoadModule authz_host_module modules/mod_authz_host.so
 LoadModule authz_owner_module modules/mod_authz_owner.so
 LoadModule authz_user_module modules/mod_authz_user.so
 LoadModule autoindex_module modules/mod_autoindex.so
 LoadModule cache_module modules/mod_cache.so
 LoadModule cache_disk_module modules/mod_cache_disk.so
 LoadModule cache_socache_module modules/mod_cache_socache.so
 LoadModule data_module modules/mod_data.so
 LoadModule dbd_module modules/mod_dbd.so
 LoadModule deflate_module modules/mod_deflate.so
 LoadModule dir_module modules/mod_dir.so
 LoadModule dumpio_module modules/mod_dumpio.so
 LoadModule echo_module modules/mod_echo.so
 LoadModule env_module modules/mod_env.so
 LoadModule expires_module modules/mod_expires.so
 LoadModule ext_filter_module modules/mod_ext_filter.so
 LoadModule filter_module modules/mod_filter.so
 LoadModule headers_module modules/mod_headers.so
 LoadModule include_module modules/mod_include.so
 LoadModule info_module modules/mod_info.so
 LoadModule log_config_module modules/mod_log_config.so
 LoadModule logio_module modules/mod_logio.so
 LoadModule macro_module modules/mod_macro.so
 LoadModule mime_magic_module modules/mod_mime_magic.so
 LoadModule mime_module modules/mod_mime.so
 LoadModule negotiation_module modules/mod_negotiation.so
 LoadModule remoteip_module modules/mod_remoteip.so
 LoadModule reqtimeout_module modules/mod_reqtimeout.so
 LoadModule request_module modules/mod_request.so
 LoadModule rewrite_module modules/mod_rewrite.so
 LoadModule setenvif_module modules/mod_setenvif.so
 LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
 LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
 LoadModule socache_dbm_module modules/mod_socache_dbm.so
 LoadModule socache_memcache_module modules/mod_socache_memcache.so
 LoadModule socache_redis_module modules/mod_socache_redis.so
 LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
 LoadModule status_module modules/mod_status.so
 LoadModule substitute_module modules/mod_substitute.so
 LoadModule suexec_module modules/mod_suexec.so
 LoadModule unique_id_module modules/mod_unique_id.so
 LoadModule unixd_module modules/mod_unixd.so
 LoadModule userdir_module modules/mod_userdir.so
 LoadModule version_module modules/mod_version.so
 LoadModule vhost_alias_module modules/mod_vhost_alias.so
 LoadModule watchdog_module modules/mod_watchdog.so
@@ -1 +0,0 @@
 LoadModule brotli_module modules/mod_brotli.so
@@ -1,3 +0,0 @@
 LoadModule dav_module modules/mod_dav.so
 LoadModule dav_fs_module modules/mod_dav_fs.so
 LoadModule dav_lock_module modules/mod_dav_lock.so
@@ -1 +0,0 @@
 LoadModule lua_module modules/mod_lua.so
@@ -1,23 +0,0 @@
 # Select the MPM module which should be used by uncommenting exactly
 # one of the following LoadModule lines.  See the httpd.conf(5) man
 # page for more information on changing the MPM.
 # prefork MPM: Implements a non-threaded, pre-forking web server
 # See: http://httpd.apache.org/docs/2.4/mod/prefork.html
 #
 # NOTE: If enabling prefork, the httpd_graceful_shutdown SELinux
 # boolean should be enabled, to allow graceful stop/shutdown.
 #
 #LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
 # worker MPM: Multi-Processing Module implementing a hybrid
 # multi-threaded multi-process web server
 # See: http://httpd.apache.org/docs/2.4/mod/worker.html
 #
 #LoadModule mpm_worker_module modules/mod_mpm_worker.so
 # event MPM: A variant of the worker MPM with the goal of consuming
 # threads only for connections with active processing
 # See: http://httpd.apache.org/docs/2.4/mod/event.html
 #
 LoadModule mpm_event_module modules/mod_mpm_event.so
@@ -1,18 +0,0 @@
 #
 # This file lists modules included with the Apache HTTP Server
 # which are not enabled by default.
 # 
 #LoadModule asis_module modules/mod_asis.so
 #LoadModule buffer_module modules/mod_buffer.so
 #LoadModule heartbeat_module modules/mod_heartbeat.so
 #LoadModule heartmonitor_module modules/mod_heartmonitor.so
 #LoadModule usertrack_module modules/mod_usertrack.so
 #LoadModule dialup_module modules/mod_dialup.so
 #LoadModule charset_lite_module modules/mod_charset_lite.so
 #LoadModule log_debug_module modules/mod_log_debug.so
 #LoadModule log_forensic_module modules/mod_log_forensic.so
 #LoadModule ratelimit_module modules/mod_ratelimit.so
 #LoadModule reflector_module modules/mod_reflector.so
 #LoadModule sed_module modules/mod_sed.so
 #LoadModule speling_module modules/mod_speling.so
@@ -1,18 +0,0 @@
 # This file configures all the proxy modules:
 LoadModule proxy_module modules/mod_proxy.so
 LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
 LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
 LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
 LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
 LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
 LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
 LoadModule proxy_connect_module modules/mod_proxy_connect.so
 LoadModule proxy_express_module modules/mod_proxy_express.so
 LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
 LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
 LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
 LoadModule proxy_http_module modules/mod_proxy_http.so
 LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
 LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
 LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
 LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
@@ -1 +0,0 @@
 LoadModule ssl_module modules/mod_ssl.so
@@ -1,2 +0,0 @@
 # This file configures systemd module:
 LoadModule systemd_module modules/mod_systemd.so
@@ -1,11 +0,0 @@
 # This configuration file loads a CGI module appropriate to the MPM
 # which has been configured in 00-mpm.conf.  mod_cgid should be used
 # with a threaded MPM; mod_cgi with the prefork MPM.
 <IfModule !mpm_prefork_module>
   LoadModule cgid_module modules/mod_cgid.so
 </IfModule>
 <IfModule mpm_prefork_module>
   LoadModule cgi_module modules/mod_cgi.so
 </IfModule>
@@ -1 +0,0 @@
 LoadModule md_module modules/mod_md.so
@@ -1 +0,0 @@
 LoadModule http2_module modules/mod_http2.so
@@ -1 +0,0 @@
 LoadModule proxy_http2_module modules/mod_proxy_http2.so
@@ -1,10 +0,0 @@
 This directory holds configuration files for the Apache HTTP Server;
 any files in this directory which have the ".conf" extension will be
 processed as httpd configuration files.  This directory contains
 configuration fragments necessary only to load modules.
 Administrators should use the directory "/etc/httpd/conf.d" to modify
 the configuration of httpd, or any modules.
 Files are processed in sorted order and should have a two digit
 numeric prefix.  See httpd.conf(5) for more information.
@@ -1,374 +0,0 @@
 #
 # This is the main Apache HTTP server configuration file.  It contains the
 # configuration directives that give the server its instructions.
 # See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
 # In particular, see 
 # <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
 # for a discussion of each configuration directive.
 #
 # See the httpd.conf(5) man page for more information on this configuration,
 # and httpd.service(8) on using and configuring the httpd service.
 #
 # Do NOT simply read the instructions in here without understanding
 # what they do.  They're here only as hints or reminders.  If you are unsure
 # consult the online docs. You have been warned.  
 #
 # Configuration and logfile names: If the filenames you specify for many
 # of the server's control files begin with "/" (or "drive:/" for Win32), the
 # server will use that explicit path.  If the filenames do *not* begin
 # with "/", the value of ServerRoot is prepended -- so 'log/access_log'
 # with ServerRoot set to '/www' will be interpreted by the
 # server as '/www/log/access_log', where as '/log/access_log' will be
 # interpreted as '/log/access_log'.
 #
 # ServerRoot: The top of the directory tree under which the server's
 # configuration, error, and log files are kept.
 #
 # Do not add a slash at the end of the directory path.  If you point
 # ServerRoot at a non-local disk, be sure to specify a local disk on the
 # Mutex directive, if file-based mutexes are used.  If you wish to share the
 # same ServerRoot for multiple httpd daemons, you will need to change at
 # least PidFile.
 #
 ServerRoot "/etc/httpd"
 #
 # Listen: Allows you to bind Apache to specific IP addresses and/or
 # ports, instead of the default. See also the <VirtualHost>
 # directive.
 #
 # Change this to Listen on a specific IP address, but note that if
 # httpd.service is enabled to run at boot time, the address may not be
 # available when the service starts.  See the httpd.service(8) man
 # page for more information.
 #
 #Listen 12.34.56.78:80
 Listen 80
 #
 # Dynamic Shared Object (DSO) Support
 #
 # To be able to use the functionality of a module which was built as a DSO you
 # have to place corresponding `LoadModule' lines at this location so the
 # directives contained in it are actually available _before_ they are used.
 # Statically compiled modules (those listed by `httpd -l') do not need
 # to be loaded here.
 #
 # Example:
 # LoadModule foo_module modules/mod_foo.so
 #
 Include conf.modules.d/*.conf
 #
 # If you wish httpd to run as a different user or group, you must run
 # httpd as root initially and it will switch.  
 #
 # User/Group: The name (or #number) of the user/group to run httpd as.
 # It is usually good practice to create a dedicated user and group for
 # running httpd, as with most system services.
 #
 User apache
 Group apache
 # 'Main' server configuration
 #
 # The directives in this section set up the values used by the 'main'
 # server, which responds to any requests that aren't handled by a
 # <VirtualHost> definition.  These values also provide defaults for
 # any <VirtualHost> containers you may define later in the file.
 #
 # All of these directives may appear inside <VirtualHost> containers,
 # in which case these default settings will be overridden for the
 # virtual host being defined.
 #
 #
 # ServerAdmin: Your address, where problems with the server should be
 # e-mailed.  This address appears on some server-generated pages, such
 # as error documents.  e.g. admin@your-domain.com
 #
 ServerAdmin root@localhost
 #
 # ServerName gives the name and port that the server uses to identify itself.
 # This can often be determined automatically, but we recommend you specify
 # it explicitly to prevent problems during startup.
 #
 # If your host doesn't have a registered DNS name, enter its IP address here.
 #
 #ServerName www.example.com:80
 #
 # Deny access to the entirety of your server's filesystem. You must
 # explicitly permit access to web content directories in other 
 # <Directory> blocks below.
 #
 <Directory />
    AllowOverride none
    Require all denied
 </Directory>
 #
 # Note that from this point forward you must specifically allow
 # particular features to be enabled - so if something's not working as
 # you might expect, make sure that you have specifically enabled it
 # below.
 #
 #
 # DocumentRoot: The directory out of which you will serve your
 # documents. By default, all requests are taken from this directory, but
 # symbolic links and aliases may be used to point to other locations.
 #
 DocumentRoot "/var/www/html"
 #
 # Relax access to content within /var/www.
 #
 <Directory "/var/www">
    AllowOverride None
    # Allow open access:
    Require all granted
 </Directory>
 # Further relax access to the default document root:
 <Directory "/var/www/html">
    #
    # Possible values for the Options directive are "None", "All",
    # or any combination of:
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #
    # The Options directive is both complicated and important.  Please see
    # http://httpd.apache.org/docs/2.4/mod/core.html#options
    # for more information.
    #
    Options Indexes FollowSymLinks
    #
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   AllowOverride FileInfo AuthConfig Limit
    #
    AllowOverride None
    #
    # Controls who can get stuff from this server.
    #
    Require all granted
 </Directory>
 #
 # DirectoryIndex: sets the file that Apache will serve if a directory
 # is requested.
 #
 <IfModule dir_module>
    DirectoryIndex index.html
 </IfModule>
 #
 # The following lines prevent .htaccess and .htpasswd files from being 
 # viewed by Web clients. 
 #
 <Files ".ht*">
    Require all denied
 </Files>
 #
 # ErrorLog: The location of the error log file.
 # If you do not specify an ErrorLog directive within a <VirtualHost>
 # container, error messages relating to that virtual host will be
 # logged here.  If you *do* define an error logfile for a <VirtualHost>
 # container, that host's errors will be logged there and not here.
 #
 ErrorLog "logs/error_log"
 #
 # LogLevel: Control the number of messages logged to the error_log.
 # Possible values include: debug, info, notice, warn, error, crit,
 # alert, emerg.
 #
 LogLevel warn
 <IfModule log_config_module>
    #
    # The following directives define some format nicknames for use with
    # a CustomLog directive (see below).
    #
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    <IfModule logio_module>
      # You need to enable mod_logio.c to use %I and %O
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>
    #
    # The location and format of the access logfile (Common Logfile Format).
    # If you do not define any access logfiles within a <VirtualHost>
    # container, they will be logged here.  Contrariwise, if you *do*
    # define per-<VirtualHost> access logfiles, transactions will be
    # logged therein and *not* in this file.
    #
    #CustomLog "logs/access_log" common
    #
    # If you prefer a logfile with access, agent, and referer information
    # (Combined Logfile Format) you can use the following directive.
    #
    CustomLog "logs/access_log" combined
 </IfModule>
 <IfModule alias_module>
    #
    # Redirect: Allows you to tell clients about documents that used to 
    # exist in your server's namespace, but do not anymore. The client 
    # will make a new request for the document at its new location.
    # Example:
    # Redirect permanent /foo http://www.example.com/bar
    #
    # Alias: Maps web paths into filesystem paths and is used to
    # access content that does not live under the DocumentRoot.
    # Example:
    # Alias /webpath /full/filesystem/path
    #
    # If you include a trailing / on /webpath then the server will
    # require it to be present in the URL.  You will also likely
    # need to provide a <Directory> section to allow access to
    # the filesystem path.
    #
    # ScriptAlias: This controls which directories contain server scripts. 
    # ScriptAliases are essentially the same as Aliases, except that
    # documents in the target directory are treated as applications and
    # run by the server when requested rather than as documents sent to the
    # client.  The same rules about trailing "/" apply to ScriptAlias
    # directives as to Alias.
    #
    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
 </IfModule>
 #
 # "/var/www/cgi-bin" should be changed to whatever your ScriptAliased
 # CGI directory exists, if you have that configured.
 #
 <Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
 </Directory>
 <IfModule headers_module>
    #
    # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
    # backend servers which have lingering "httpoxy" defects.
    # 'Proxy' request header is undefined by the IETF, not listed by IANA
    #
    RequestHeader unset Proxy early
 </IfModule>
 <IfModule mime_module>
    #
    # TypesConfig points to the file containing the list of mappings from
    # filename extension to MIME-type.
    #
    TypesConfig /etc/mime.types
    #
    # AddType allows you to add to or override the MIME configuration
    # file specified in TypesConfig for specific file types.
    #
    #AddType application/x-gzip .tgz
    #
    # AddEncoding allows you to have certain browsers uncompress
    # information on the fly. Note: Not all browsers support this.
    #
    #AddEncoding x-compress .Z
    #AddEncoding x-gzip .gz .tgz
    #
    # If the AddEncoding directives above are commented-out, then you
    # probably should define those extensions to indicate media types:
    #
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    #
    # AddHandler allows you to map certain file extensions to "handlers":
    # actions unrelated to filetype. These can be either built into the server
    # or added with the Action directive (see below)
    #
    # To use CGI scripts outside of ScriptAliased directories:
    # (You will also need to add "ExecCGI" to the "Options" directive.)
    #
    #AddHandler cgi-script .cgi
    # For type maps (negotiated resources):
    #AddHandler type-map var
    #
    # Filters allow you to process content before it is sent to the client.
    #
    # To parse .shtml files for server-side includes (SSI):
    # (You will also need to add "Includes" to the "Options" directive.)
    #
    AddType text/html .shtml
    AddOutputFilter INCLUDES .shtml
 </IfModule>
 #
 # Specify a default charset for all content served; this enables
 # interpretation of all content as UTF-8 by default.  To use the 
 # default browser choice (ISO-8859-1), or to allow the META tags
 # in HTML content to override this choice, comment out this
 # directive:
 #
 AddDefaultCharset UTF-8
 <IfModule mime_magic_module>
    #
    # The mod_mime_magic module allows the server to use various hints from the
    # contents of the file itself to determine its type.  The MIMEMagicFile
    # directive tells the module where the hint definitions are located.
    #
    MIMEMagicFile conf/magic
 </IfModule>
 #
 # Customizable error responses come in three flavors:
 # 1) plain text 2) local redirects 3) external redirects
 #
 # Some examples:
 #ErrorDocument 500 "The server made a boo boo."
 #ErrorDocument 404 /missing.html
 #ErrorDocument 404 "/cgi-bin/missing_handler.pl"
 #ErrorDocument 402 http://www.example.com/subscription_info.html
 #
 #
 # MaxRanges: Maximum number of Ranges in a request before
 # returning the entire resource, or one of the special
 # values 'default', 'none' or 'unlimited'.
 # Default setting is to accept 200 Ranges.
 #MaxRanges unlimited
 #
 # EnableMMAP and EnableSendfile: On systems that support it, 
 # memory-mapping or the sendfile syscall may be used to deliver
 # files.  This usually improves server performance, but must
 # be turned off when serving from networked-mounted 
 # filesystems or if support for these functions is otherwise
 # broken on your system.
 # Defaults if commented: EnableMMAP On, EnableSendfile Off
 #
 #EnableMMAP off
 EnableSendfile on
 # Supplemental configuration
 #
 # Load config files in the "/etc/httpd/conf.d" directory, if any.
 IncludeOptional conf.d/*.conf
@@ -1,397 +0,0 @@
 # Magic data for mod_mime_magic Apache module (originally for file(1) command)
 # The module is described in /manual/mod/mod_mime_magic.html
 #
 # The format is 4-5 columns:
 #    Column #1: byte number to begin checking from, ">" indicates continuation
 #    Column #2: type of data to match
 #    Column #3: contents of data to match
 #    Column #4: MIME type of result
 #    Column #5: MIME encoding of result (optional)
 #------------------------------------------------------------------------------
 # Localstuff:  file(1) magic for locally observed files
 # Add any locally observed files here.
 #------------------------------------------------------------------------------
 # end local stuff
 #------------------------------------------------------------------------------
 #------------------------------------------------------------------------------
 # Java
 0	short		0xcafe
 >2	short		0xbabe		application/java
 #------------------------------------------------------------------------------
 # audio:  file(1) magic for sound formats
 #
 # from Jan Nicolai Langfeldt <janl@ifi.uio.no>,
 #
 # Sun/NeXT audio data
 0	string		.snd
 >12	belong		1		audio/basic
 >12	belong		2		audio/basic
 >12	belong		3		audio/basic
 >12	belong		4		audio/basic
 >12	belong		5		audio/basic
 >12	belong		6		audio/basic
 >12	belong		7		audio/basic
 >12	belong		23		audio/x-adpcm
 # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
 # that uses little-endian encoding and has a different magic number
 # (0x0064732E in little-endian encoding).
 0	lelong		0x0064732E	
 >12	lelong		1		audio/x-dec-basic
 >12	lelong		2		audio/x-dec-basic
 >12	lelong		3		audio/x-dec-basic
 >12	lelong		4		audio/x-dec-basic
 >12	lelong		5		audio/x-dec-basic
 >12	lelong		6		audio/x-dec-basic
 >12	lelong		7		audio/x-dec-basic
 #                                       compressed (G.721 ADPCM)
 >12	lelong		23		audio/x-dec-adpcm
 # Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
 #					AIFF audio data
 8	string		AIFF		audio/x-aiff	
 #					AIFF-C audio data
 8	string		AIFC		audio/x-aiff	
 #					IFF/8SVX audio data
 8	string		8SVX		audio/x-aiff	
 # Creative Labs AUDIO stuff
 #					Standard MIDI data
 0	string	MThd			audio/unknown	
 #>9 	byte	>0			(format %d)
 #>11	byte	>1			using %d channels
 #					Creative Music (CMF) data
 0	string	CTMF			audio/unknown	
 #					SoundBlaster instrument data
 0	string	SBI			audio/unknown	
 #					Creative Labs voice data
 0	string	Creative\ Voice\ File	audio/unknown	
 ## is this next line right?  it came this way...
 #>19	byte	0x1A
 #>23	byte	>0			- version %d
 #>22	byte	>0			\b.%d
 # [GRR 950115:  is this also Creative Labs?  Guessing that first line
 #  should be string instead of unknown-endian long...]
 #0	long		0x4e54524b	MultiTrack sound data
 #0	string		NTRK		MultiTrack sound data
 #>4	long		x		- version %ld
 # Microsoft WAVE format (*.wav)
 # [GRR 950115:  probably all of the shorts and longs should be leshort/lelong]
 #					Microsoft RIFF
 0	string		RIFF		
 #					- WAVE format
 >8	string		WAVE		audio/x-wav
 # MPEG audio.
 0   beshort&0xfff0  0xfff0  audio/mpeg
 # C64 SID Music files, from Linus Walleij <triad@df.lth.se>
 0   string      PSID        audio/prs.sid
 #------------------------------------------------------------------------------
 # c-lang:  file(1) magic for C programs or various scripts
 #
 # XPM icons (Greg Roelofs, newt@uchicago.edu)
 # ideally should go into "images", but entries below would tag XPM as C source
 0	string		/*\ XPM		image/x-xbm	7bit
 # this first will upset you if you're a PL/1 shop... (are there any left?)
 # in which case rm it; ascmagic will catch real C programs
 #					C or REXX program text
 0	string		/*		text/plain
 #					C++ program text
 0	string		//		text/plain
 #------------------------------------------------------------------------------
 # compress:  file(1) magic for pure-compression formats (no archives)
 #
 # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, whap, etc.
 #
 # Formats for various forms of compressed data
 # Formats for "compress" proper have been moved into "compress.c",
 # because it tries to uncompress it to figure out what's inside.
 # standard unix compress
 0	string		\037\235	application/octet-stream	x-compress
 # gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver)
 0       string          \037\213        application/octet-stream	x-gzip
 # According to gzip.h, this is the correct byte order for packed data.
 0	string		\037\036	application/octet-stream
 #
 # This magic number is byte-order-independent.
 #
 0	short		017437		application/octet-stream
 # XXX - why *two* entries for "compacted data", one of which is
 # byte-order independent, and one of which is byte-order dependent?
 #
 # compacted data
 0	short		0x1fff		application/octet-stream
 0	string		\377\037	application/octet-stream
 # huf output
 0	short		0145405		application/octet-stream
 # Squeeze and Crunch...
 # These numbers were gleaned from the Unix versions of the programs to
 # handle these formats.  Note that I can only uncrunch, not crunch, and
 # I didn't have a crunched file handy, so the crunch number is untested.
 #				Keith Waclena <keith@cerberus.uchicago.edu>
 #0	leshort		0x76FF		squeezed data (CP/M, DOS)
 #0	leshort		0x76FE		crunched data (CP/M, DOS)
 # Freeze
 #0	string		\037\237	Frozen file 2.1
 #0	string		\037\236	Frozen file 1.0 (or gzip 0.5)
 # lzh?
 #0	string		\037\240	LZH compressed data
 #------------------------------------------------------------------------------
 # frame:  file(1) magic for FrameMaker files
 #
 # This stuff came on a FrameMaker demo tape, most of which is
 # copyright, but this file is "published" as witness the following:
 #
 0	string		\<MakerFile	application/x-frame
 0	string		\<MIFFile	application/x-frame
 0	string		\<MakerDictionary	application/x-frame
 0	string		\<MakerScreenFon	application/x-frame
 0	string		\<MML		application/x-frame
 0	string		\<Book		application/x-frame
 0	string		\<Maker		application/x-frame
 #------------------------------------------------------------------------------
 # html:  file(1) magic for HTML (HyperText Markup Language) docs
 #
 # from Daniel Quinlan <quinlan@yggdrasil.com>
 # and Anna Shergold <anna@inext.co.uk>
 #
 0   string      \<!DOCTYPE\ HTML    text/html
 0   string      \<!doctype\ html    text/html
 0   string      \<HEAD      text/html
 0   string      \<head      text/html
 0   string      \<TITLE     text/html
 0   string      \<title     text/html
 0   string      \<html      text/html
 0   string      \<HTML      text/html
 0   string      \<!--       text/html
 0   string      \<h1        text/html
 0   string      \<H1        text/html
 # XML eXtensible Markup Language, from Linus Walleij <triad@df.lth.se>
 0   string      \<?xml      text/xml
 #------------------------------------------------------------------------------
 # images:  file(1) magic for image formats (see also "c-lang" for XPM bitmaps)
 #
 # originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
 # additions by janl@ifi.uio.no as well as others. Jan also suggested
 # merging several one- and two-line files into here.
 #
 # XXX - byte order for GIF and TIFF fields?
 # [GRR:  TIFF allows both byte orders; GIF is probably little-endian]
 #
 # [GRR:  what the hell is this doing in here?]
 #0	string		xbtoa		btoa'd file
 # PBMPLUS
 #					PBM file
 0	string		P1		image/x-portable-bitmap	7bit
 #					PGM file
 0	string		P2		image/x-portable-greymap	7bit
 #					PPM file
 0	string		P3		image/x-portable-pixmap	7bit
 #					PBM "rawbits" file
 0	string		P4		image/x-portable-bitmap
 #					PGM "rawbits" file
 0	string		P5		image/x-portable-greymap
 #					PPM "rawbits" file
 0	string		P6		image/x-portable-pixmap
 # NIFF (Navy Interchange File Format, a modification of TIFF)
 # [GRR:  this *must* go before TIFF]
 0	string		IIN1		image/x-niff
 # TIFF and friends
 #					TIFF file, big-endian
 0	string		MM		image/tiff
 #					TIFF file, little-endian
 0	string		II		image/tiff
 # possible GIF replacements; none yet released!
 # (Greg Roelofs, newt@uchicago.edu)
 #
 # GRR 950115:  this was mine ("Zip GIF"):
 #					ZIF image (GIF+deflate alpha)
 0	string		GIF94z		image/unknown
 #
 # GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
 #					FGF image (GIF+deflate beta)
 0	string		FGF95a		image/unknown
 #
 # GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
 # (best; not yet implemented):
 #					PBF image (deflate compression)
 0	string		PBF		image/unknown
 # GIF
 0	string		GIF		image/gif
 # JPEG images
 0	beshort		0xffd8		image/jpeg
 # PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
 0	string		BM		image/bmp
 #>14	byte		12		(OS/2 1.x format)
 #>14	byte		64		(OS/2 2.x format)
 #>14	byte		40		(Windows 3.x format)
 #0	string		IC		icon
 #0	string		PI		pointer
 #0	string		CI		color icon
 #0	string		CP		color pointer
 #0	string		BA		bitmap array
 0	string		\x89PNG		image/png
 0	string		FWS		application/x-shockwave-flash
 0	string		CWS		application/x-shockwave-flash
 #------------------------------------------------------------------------------
 # lisp:  file(1) magic for lisp programs
 #
 # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
 0	string	;;			text/plain	8bit
 # Emacs 18 - this is always correct, but not very magical.
 0	string	\012(			application/x-elc
 # Emacs 19
 0	string	;ELC\023\000\000\000	application/x-elc
 #------------------------------------------------------------------------------
 # mail.news:  file(1) magic for mail and news
 #
 # There are tests to ascmagic.c to cope with mail and news.
 0	string		Relay-Version: 	message/rfc822	7bit
 0	string		#!\ rnews	message/rfc822	7bit
 0	string		N#!\ rnews	message/rfc822	7bit
 0	string		Forward\ to 	message/rfc822	7bit
 0	string		Pipe\ to 	message/rfc822	7bit
 0	string		Return-Path:	message/rfc822	7bit
 0	string		Path:		message/news	8bit
 0	string		Xref:		message/news	8bit
 0	string		From:		message/rfc822	7bit
 0	string		Article 	message/news	8bit
 #------------------------------------------------------------------------------
 # msword: file(1) magic for MS Word files
 #
 # Contributor claims:
 # Reversed-engineered MS Word magic numbers
 #
 0	string		\376\067\0\043			application/msword
 0	string		\333\245-\0\0\0			application/msword
 # disable this one because it applies also to other
 # Office/OLE documents for which msword is not correct. See PR#2608.
 #0	string		\320\317\021\340\241\261	application/msword
 #------------------------------------------------------------------------------
 # printer:  file(1) magic for printer-formatted files
 #
 # PostScript
 0	string		%!		application/postscript
 0	string		\004%!		application/postscript
 # Acrobat
 # (due to clamen@cs.cmu.edu)
 0	string		%PDF-		application/pdf
 #------------------------------------------------------------------------------
 # sc:  file(1) magic for "sc" spreadsheet
 #
 38	string		Spreadsheet	application/x-sc
 #------------------------------------------------------------------------------
 # tex:  file(1) magic for TeX files
 #
 # XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
 #
 # From <conklin@talisman.kaleida.com>
 # Although we may know the offset of certain text fields in TeX DVI
 # and font files, we can't use them reliably because they are not
 # zero terminated. [but we do anyway, christos]
 0	string		\367\002	application/x-dvi
 #0	string		\367\203	TeX generic font data
 #0	string		\367\131	TeX packed font data
 #0	string		\367\312	TeX virtual font data
 #0	string		This\ is\ TeX,	TeX transcript text	
 #0	string		This\ is\ METAFONT,	METAFONT transcript text
 # There is no way to detect TeX Font Metric (*.tfm) files without
 # breaking them apart and reading the data.  The following patterns
 # match most *.tfm files generated by METAFONT or afm2tfm.
 #2	string		\000\021	TeX font metric data
 #2	string		\000\022	TeX font metric data
 #>34	string		>\0		(%s)
 # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
 #0	string		\\input\ texinfo	Texinfo source text
 #0	string		This\ is\ Info\ file	GNU Info text
 # correct TeX magic for Linux (and maybe more)
 # from Peter Tobias (tobias@server.et-inf.fho-emden.de)
 #
 0	leshort		0x02f7		application/x-dvi
 # RTF - Rich Text Format
 0	string		{\\rtf		application/rtf
 #------------------------------------------------------------------------------
 # animation:  file(1) magic for animation/movie formats
 #
 # animation formats, originally from vax@ccwf.cc.utexas.edu (VaX#n8)
 #						MPEG file
 0	string		\000\000\001\263	video/mpeg
 #
 # The contributor claims:
 #   I couldn't find a real magic number for these, however, this
 #   -appears- to work.  Note that it might catch other files, too,
 #   so BE CAREFUL!
 #
 # Note that title and author appear in the two 20-byte chunks
 # at decimal offsets 2 and 22, respectively, but they are XOR'ed with
 # 255 (hex FF)! DL format SUCKS BIG ROCKS.
 #
 #						DL file version 1 , medium format (160x100, 4 images/screen)
 0	byte		1			video/unknown
 0	byte		2			video/unknown
 # Quicktime video, from Linus Walleij <triad@df.lth.se>
 # from Apple quicktime file format documentation.
 4   string      moov        video/quicktime
 4   string      mdat        video/quicktime
 #------------------------------------------------------------------------------
 # application/x-coredump for LE/BE ELF
 #
 0       string          \177ELF
 >5      byte            1
 >16     leshort         4               application/x-coredump
 0       string          \177ELF
 >5      byte            2
 >16     beshort         4               application/x-coredump
@@ -1,11 +0,0 @@
 # Note that logs are not compressed unless "compress" is configured,
 # which can be done either here or globally in /etc/logrotate.conf.
 /var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    delaycompress
    postrotate
        /bin/systemctl reload httpd.service > /dev/null 2>/dev/null || true
    endscript
 }
@@ -1,9 +0,0 @@
 /var/log/php-fpm/*log {
    missingok
    notifempty
    sharedscripts
    delaycompress
    postrotate
 	/bin/kill -SIGUSR1 `cat /run/php-fpm/php-fpm.pid 2>/dev/null` 2>/dev/null || true
    endscript
 }
@@ -1,135 +0,0 @@
 ;;;;;;;;;;;;;;;;;;;;;
 ; FPM Configuration ;
 ;;;;;;;;;;;;;;;;;;;;;
 ; All relative paths in this configuration file are relative to PHP's install
 ; prefix.
 ;;;;;;;;;;;;;;;;;;
 ; Global Options ;
 ;;;;;;;;;;;;;;;;;;
 [global]
 ; Pid file
 ; Default Value: none
 pid = /run/php-fpm/php-fpm.pid
 ; Error log file
 ; If it's set to "syslog", log is sent to syslogd instead of being written
 ; in a local file.
 ; Default Value: /var/log/php-fpm.log
 error_log = /var/log/php-fpm/error.log
 ; syslog_facility is used to specify what type of program is logging the
 ; message. This lets syslogd specify that messages from different facilities
 ; will be handled differently.
 ; See syslog(3) for possible values (ex daemon equiv LOG_DAEMON)
 ; Default Value: daemon
 ;syslog.facility = daemon
 ; syslog_ident is prepended to every message. If you have multiple FPM
 ; instances running on the same server, you can change the default value
 ; which must suit common needs.
 ; Default Value: php-fpm
 ;syslog.ident = php-fpm
 ; Log level
 ; Possible Values: alert, error, warning, notice, debug
 ; Default Value: notice
 ;log_level = notice
 ; Log limit on number of characters in the single line (log entry). If the
 ; line is over the limit, it is wrapped on multiple lines. The limit is for
 ; all logged characters including message prefix and suffix if present. However
 ; the new line character does not count into it as it is present only when
 ; logging to a file descriptor. It means the new line character is not present
 ; when logging to syslog.
 ; Default Value: 1024
 ;log_limit = 4096
 ; Log buffering specifies if the log line is buffered which means that the
 ; line is written in a single write operation. If the value is false, then the
 ; data is written directly into the file descriptor. It is an experimental
 ; option that can potentionaly improve logging performance and memory usage
 ; for some heavy logging scenarios. This option is ignored if logging to syslog
 ; as it has to be always buffered.
 ; Default value: yes
 ;log_buffering = no
 ; If this number of child processes exit with SIGSEGV or SIGBUS within the time
 ; interval set by emergency_restart_interval then FPM will restart. A value
 ; of '0' means 'Off'.
 ; Default Value: 0
 ;emergency_restart_threshold = 0
 ; Interval of time used by emergency_restart_interval to determine when
 ; a graceful restart will be initiated.  This can be useful to work around
 ; accidental corruptions in an accelerator's shared memory.
 ; Available Units: s(econds), m(inutes), h(ours), or d(ays)
 ; Default Unit: seconds
 ; Default Value: 0
 ;emergency_restart_interval = 0
 ; Time limit for child processes to wait for a reaction on signals from master.
 ; Available units: s(econds), m(inutes), h(ours), or d(ays)
 ; Default Unit: seconds
 ; Default Value: 0
 ;process_control_timeout = 0
 ; The maximum number of processes FPM will fork. This has been designed to control
 ; the global number of processes when using dynamic PM within a lot of pools.
 ; Use it with caution.
 ; Note: A value of 0 indicates no limit
 ; Default Value: 0
 ;process.max = 128
 ; Specify the nice(2) priority to apply to the master process (only if set)
 ; The value can vary from -19 (highest priority) to 20 (lowest priority)
 ; Note: - It will only work if the FPM master process is launched as root
 ;       - The pool process will inherit the master process priority
 ;         unless specified otherwise
 ; Default Value: no set
 ;process.priority = -19
 ; Send FPM to background. Set to 'no' to keep FPM in foreground for debugging.
 ; Default Value: yes
 daemonize = yes
 ; Set open file descriptor rlimit for the master process.
 ; Default Value: system defined value
 ;rlimit_files = 1024
 ; Set max core size rlimit for the master process.
 ; Possible Values: 'unlimited' or an integer greater or equal to 0
 ; Default Value: system defined value
 ;rlimit_core = 0
 ; Specify the event mechanism FPM will use. The following is available:
 ; - select     (any POSIX os)
 ; - poll       (any POSIX os)
 ; - epoll      (linux >= 2.5.44)
 ; Default Value: not set (auto detection)
 ;events.mechanism = epoll
 ; When FPM is built with systemd integration, specify the interval,
 ; in seconds, between health report notification to systemd.
 ; Set to 0 to disable.
 ; Available Units: s(econds), m(inutes), h(ours)
 ; Default Unit: seconds
 ; Default value: 10
 ;systemd_interval = 10
 ;;;;;;;;;;;;;;;;;;;;
 ; Pool Definitions ;
 ;;;;;;;;;;;;;;;;;;;;
 ; Multiple pools of child processes may be started with different listening
 ; ports and different management options.  The name of the pool will be
 ; used in logs and stats. There is no limitation on the number of pools which
 ; FPM can handle. Your system will tell you anyway :)
 ; Include one or more files. If glob(3) exists, it is used to include a bunch of
 ; files from a glob(3) pattern. This directive can be used everywhere in the
 ; file.
 include=/etc/php-fpm.d/*.conf
@@ -1,438 +0,0 @@
 ; Start a new pool named 'www'.
 ; the variable $pool can be used in any directive and will be replaced by the
 ; pool name ('www' here)
 [www]
 ; Per pool prefix
 ; It only applies on the following directives:
 ; - 'access.log'
 ; - 'slowlog'
 ; - 'listen' (unixsocket)
 ; - 'chroot'
 ; - 'chdir'
 ; - 'php_values'
 ; - 'php_admin_values'
 ; When not set, the global prefix (or @php_fpm_prefix@) applies instead.
 ; Note: This directive can also be relative to the global prefix.
 ; Default Value: none
 ;prefix = /path/to/pools/$pool
 ; Unix user/group of processes
 ; Note: The user is mandatory. If the group is not set, the default user's group
 ;       will be used.
 ; RPM: apache user chosen to provide access to the same directories as httpd
 user = apache
 ; RPM: Keep a group allowed to write in log dir.
 group = apache
 ; The address on which to accept FastCGI requests.
 ; Valid syntaxes are:
 ;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
 ;                            a specific port;
 ;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
 ;                            a specific port;
 ;   'port'                 - to listen on a TCP socket to all addresses
 ;                            (IPv6 and IPv4-mapped) on a specific port;
 ;   '/path/to/unix/socket' - to listen on a unix socket.
 ; Note: This value is mandatory.
 listen = /run/php-fpm/www.sock
 ; Set listen(2) backlog.
 ; Default Value: 511
 ;listen.backlog = 511
 ; Set permissions for unix socket, if one is used. In Linux, read/write
 ; permissions must be set in order to allow connections from a web server.
 ; Default Values: user and group are set as the running user
 ;                 mode is set to 0660
 ;listen.owner = nobody
 ;listen.group = nobody
 ;listen.mode = 0660
 ; When POSIX Access Control Lists are supported you can set them using
 ; these options, value is a comma separated list of user/group names.
 ; When set, listen.owner and listen.group are ignored
 listen.acl_users = apache,nginx
 ;listen.acl_groups =
 ; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
 ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
 ; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
 ; must be separated by a comma. If this value is left blank, connections will be
 ; accepted from any ip address.
 ; Default Value: any
 listen.allowed_clients = 127.0.0.1
 ; Specify the nice(2) priority to apply to the pool processes (only if set)
 ; The value can vary from -19 (highest priority) to 20 (lower priority)
 ; Note: - It will only work if the FPM master process is launched as root
 ;       - The pool processes will inherit the master process priority
 ;         unless it specified otherwise
 ; Default Value: no set
 ; process.priority = -19
 ; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user
 ; or group is differrent than the master process user. It allows to create process
 ; core dump and ptrace the process for the pool user.
 ; Default Value: no
 ; process.dumpable = yes
 ; Choose how the process manager will control the number of child processes.
 ; Possible Values:
 ;   static  - a fixed number (pm.max_children) of child processes;
 ;   dynamic - the number of child processes are set dynamically based on the
 ;             following directives. With this process management, there will be
 ;             always at least 1 children.
 ;             pm.max_children      - the maximum number of children that can
 ;                                    be alive at the same time.
 ;             pm.start_servers     - the number of children created on startup.
 ;             pm.min_spare_servers - the minimum number of children in 'idle'
 ;                                    state (waiting to process). If the number
 ;                                    of 'idle' processes is less than this
 ;                                    number then some children will be created.
 ;             pm.max_spare_servers - the maximum number of children in 'idle'
 ;                                    state (waiting to process). If the number
 ;                                    of 'idle' processes is greater than this
 ;                                    number then some children will be killed.
 ;  ondemand - no children are created at startup. Children will be forked when
 ;             new requests will connect. The following parameter are used:
 ;             pm.max_children           - the maximum number of children that
 ;                                         can be alive at the same time.
 ;             pm.process_idle_timeout   - The number of seconds after which
 ;                                         an idle process will be killed.
 ; Note: This value is mandatory.
 pm = dynamic
 ; The number of child processes to be created when pm is set to 'static' and the
 ; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
 ; This value sets the limit on the number of simultaneous requests that will be
 ; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
 ; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
 ; CGI. The below defaults are based on a server without much resources. Don't
 ; forget to tweak pm.* to fit your needs.
 ; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
 ; Note: This value is mandatory.
 pm.max_children = 50
 ; The number of child processes created on startup.
 ; Note: Used only when pm is set to 'dynamic'
 ; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
 pm.start_servers = 5
 ; The desired minimum number of idle server processes.
 ; Note: Used only when pm is set to 'dynamic'
 ; Note: Mandatory when pm is set to 'dynamic'
 pm.min_spare_servers = 5
 ; The desired maximum number of idle server processes.
 ; Note: Used only when pm is set to 'dynamic'
 ; Note: Mandatory when pm is set to 'dynamic'
 pm.max_spare_servers = 35
 ; The number of seconds after which an idle process will be killed.
 ; Note: Used only when pm is set to 'ondemand'
 ; Default Value: 10s
 ;pm.process_idle_timeout = 10s;
 ; The number of requests each child process should execute before respawning.
 ; This can be useful to work around memory leaks in 3rd party libraries. For
 ; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
 ; Default Value: 0
 ;pm.max_requests = 500
 ; The URI to view the FPM status page. If this value is not set, no URI will be
 ; recognized as a status page. It shows the following informations:
 ;   pool                 - the name of the pool;
 ;   process manager      - static, dynamic or ondemand;
 ;   start time           - the date and time FPM has started;
 ;   start since          - number of seconds since FPM has started;
 ;   accepted conn        - the number of request accepted by the pool;
 ;   listen queue         - the number of request in the queue of pending
 ;                          connections (see backlog in listen(2));
 ;   max listen queue     - the maximum number of requests in the queue
 ;                          of pending connections since FPM has started;
 ;   listen queue len     - the size of the socket queue of pending connections;
 ;   idle processes       - the number of idle processes;
 ;   active processes     - the number of active processes;
 ;   total processes      - the number of idle + active processes;
 ;   max active processes - the maximum number of active processes since FPM
 ;                          has started;
 ;   max children reached - number of times, the process limit has been reached,
 ;                          when pm tries to start more children (works only for
 ;                          pm 'dynamic' and 'ondemand');
 ; Value are updated in real time.
 ; Example output:
 ;   pool:                 www
 ;   process manager:      static
 ;   start time:           01/Jul/2011:17:53:49 +0200
 ;   start since:          62636
 ;   accepted conn:        190460
 ;   listen queue:         0
 ;   max listen queue:     1
 ;   listen queue len:     42
 ;   idle processes:       4
 ;   active processes:     11
 ;   total processes:      15
 ;   max active processes: 12
 ;   max children reached: 0
 ;
 ; By default the status page output is formatted as text/plain. Passing either
 ; 'html', 'xml' or 'json' in the query string will return the corresponding
 ; output syntax. Example:
 ;   http://www.foo.bar/status
 ;   http://www.foo.bar/status?json
 ;   http://www.foo.bar/status?html
 ;   http://www.foo.bar/status?xml
 ;
 ; By default the status page only outputs short status. Passing 'full' in the
 ; query string will also return status for each pool process.
 ; Example:
 ;   http://www.foo.bar/status?full
 ;   http://www.foo.bar/status?json&full
 ;   http://www.foo.bar/status?html&full
 ;   http://www.foo.bar/status?xml&full
 ; The Full status returns for each process:
 ;   pid                  - the PID of the process;
 ;   state                - the state of the process (Idle, Running, ...);
 ;   start time           - the date and time the process has started;
 ;   start since          - the number of seconds since the process has started;
 ;   requests             - the number of requests the process has served;
 ;   request duration     - the duration in µs of the requests;
 ;   request method       - the request method (GET, POST, ...);
 ;   request URI          - the request URI with the query string;
 ;   content length       - the content length of the request (only with POST);
 ;   user                 - the user (PHP_AUTH_USER) (or '-' if not set);
 ;   script               - the main script called (or '-' if not set);
 ;   last request cpu     - the %cpu the last request consumed
 ;                          it's always 0 if the process is not in Idle state
 ;                          because CPU calculation is done when the request
 ;                          processing has terminated;
 ;   last request memory  - the max amount of memory the last request consumed
 ;                          it's always 0 if the process is not in Idle state
 ;                          because memory calculation is done when the request
 ;                          processing has terminated;
 ; If the process is in Idle state, then informations are related to the
 ; last request the process has served. Otherwise informations are related to
 ; the current request being served.
 ; Example output:
 ;   ************************
 ;   pid:                  31330
 ;   state:                Running
 ;   start time:           01/Jul/2011:17:53:49 +0200
 ;   start since:          63087
 ;   requests:             12808
 ;   request duration:     1250261
 ;   request method:       GET
 ;   request URI:          /test_mem.php?N=10000
 ;   content length:       0
 ;   user:                 -
 ;   script:               /home/fat/web/docs/php/test_mem.php
 ;   last request cpu:     0.00
 ;   last request memory:  0
 ;
 ; Note: There is a real-time FPM status monitoring sample web page available
 ;       It's available in: @EXPANDED_DATADIR@/fpm/status.html
 ;
 ; Note: The value must start with a leading slash (/). The value can be
 ;       anything, but it may not be a good idea to use the .php extension or it
 ;       may conflict with a real PHP file.
 ; Default Value: not set
 ;pm.status_path = /status
 ; The ping URI to call the monitoring page of FPM. If this value is not set, no
 ; URI will be recognized as a ping page. This could be used to test from outside
 ; that FPM is alive and responding, or to
 ; - create a graph of FPM availability (rrd or such);
 ; - remove a server from a group if it is not responding (load balancing);
 ; - trigger alerts for the operating team (24/7).
 ; Note: The value must start with a leading slash (/). The value can be
 ;       anything, but it may not be a good idea to use the .php extension or it
 ;       may conflict with a real PHP file.
 ; Default Value: not set
 ;ping.path = /ping
 ; This directive may be used to customize the response of a ping request. The
 ; response is formatted as text/plain with a 200 response code.
 ; Default Value: pong
 ;ping.response = pong
 ; The access log file
 ; Default: not set
 ;access.log = log/$pool.access.log
 ; The access log format.
 ; The following syntax is allowed
 ;  %%: the '%' character
 ;  %C: %CPU used by the request
 ;      it can accept the following format:
 ;      - %{user}C for user CPU only
 ;      - %{system}C for system CPU only
 ;      - %{total}C  for user + system CPU (default)
 ;  %d: time taken to serve the request
 ;      it can accept the following format:
 ;      - %{seconds}d (default)
 ;      - %{miliseconds}d
 ;      - %{mili}d
 ;      - %{microseconds}d
 ;      - %{micro}d
 ;  %e: an environment variable (same as $_ENV or $_SERVER)
 ;      it must be associated with embraces to specify the name of the env
 ;      variable. Some exemples:
 ;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
 ;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
 ;  %f: script filename
 ;  %l: content-length of the request (for POST request only)
 ;  %m: request method
 ;  %M: peak of memory allocated by PHP
 ;      it can accept the following format:
 ;      - %{bytes}M (default)
 ;      - %{kilobytes}M
 ;      - %{kilo}M
 ;      - %{megabytes}M
 ;      - %{mega}M
 ;  %n: pool name
 ;  %o: output header
 ;      it must be associated with embraces to specify the name of the header:
 ;      - %{Content-Type}o
 ;      - %{X-Powered-By}o
 ;      - %{Transfert-Encoding}o
 ;      - ....
 ;  %p: PID of the child that serviced the request
 ;  %P: PID of the parent of the child that serviced the request
 ;  %q: the query string
 ;  %Q: the '?' character if query string exists
 ;  %r: the request URI (without the query string, see %q and %Q)
 ;  %R: remote IP address
 ;  %s: status (response code)
 ;  %t: server time the request was received
 ;      it can accept a strftime(3) format:
 ;      %d/%b/%Y:%H:%M:%S %z (default)
 ;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
 ;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
 ;  %T: time the log has been written (the request has finished)
 ;      it can accept a strftime(3) format:
 ;      %d/%b/%Y:%H:%M:%S %z (default)
 ;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
 ;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
 ;  %u: remote user
 ;
 ; Default: "%R - %u %t \"%m %r\" %s"
 ;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
 ; The log file for slow requests
 ; Default Value: not set
 ; Note: slowlog is mandatory if request_slowlog_timeout is set
 slowlog = /var/log/php-fpm/www-slow.log
 ; The timeout for serving a single request after which a PHP backtrace will be
 ; dumped to the 'slowlog' file. A value of '0s' means 'off'.
 ; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
 ; Default Value: 0
 ;request_slowlog_timeout = 0
 ; Depth of slow log stack trace.
 ; Default Value: 20
 ;request_slowlog_trace_depth = 20
 ; The timeout for serving a single request after which the worker process will
 ; be killed. This option should be used when the 'max_execution_time' ini option
 ; does not stop script execution for some reason. A value of '0' means 'off'.
 ; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
 ; Default Value: 0
 ;request_terminate_timeout = 0
 ; Set open file descriptor rlimit.
 ; Default Value: system defined value
 ;rlimit_files = 1024
 ; Set max core size rlimit.
 ; Possible Values: 'unlimited' or an integer greater or equal to 0
 ; Default Value: system defined value
 ;rlimit_core = 0
 ; Chroot to this directory at the start. This value must be defined as an
 ; absolute path. When this value is not set, chroot is not used.
 ; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
 ; of its subdirectories. If the pool prefix is not set, the global prefix
 ; will be used instead.
 ; Note: chrooting is a great security feature and should be used whenever
 ;       possible. However, all PHP paths will be relative to the chroot
 ;       (error_log, sessions.save_path, ...).
 ; Default Value: not set
 ;chroot =
 ; Chdir to this directory at the start.
 ; Note: relative path can be used.
 ; Default Value: current directory or / when chroot
 ;chdir = /var/www
 ; Redirect worker stdout and stderr into main error log. If not set, stdout and
 ; stderr will be redirected to /dev/null according to FastCGI specs.
 ; Note: on highloaded environement, this can cause some delay in the page
 ; process time (several ms).
 ; Default Value: no
 ;catch_workers_output = yes
 ; Clear environment in FPM workers
 ; Prevents arbitrary environment variables from reaching FPM worker processes
 ; by clearing the environment in workers before env vars specified in this
 ; pool configuration are added.
 ; Setting to "no" will make all environment variables available to PHP code
 ; via getenv(), $_ENV and $_SERVER.
 ; Default Value: yes
 ;clear_env = no
 ; Limits the extensions of the main script FPM will allow to parse. This can
 ; prevent configuration mistakes on the web server side. You should only limit
 ; FPM to .php extensions to prevent malicious users to use other extensions to
 ; execute php code.
 ; Note: set an empty value to allow all extensions.
 ; Default Value: .php
 ;security.limit_extensions = .php .php3 .php4 .php5 .php7
 ; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
 ; the current environment.
 ; Default Value: clean env
 ;env[HOSTNAME] = $HOSTNAME
 ;env[PATH] = /usr/local/bin:/usr/bin:/bin
 ;env[TMP] = /tmp
 ;env[TMPDIR] = /tmp
 ;env[TEMP] = /tmp
 ; Additional php.ini defines, specific to this pool of workers. These settings
 ; overwrite the values previously defined in the php.ini. The directives are the
 ; same as the PHP SAPI:
 ;   php_value/php_flag             - you can set classic ini defines which can
 ;                                    be overwritten from PHP call 'ini_set'.
 ;   php_admin_value/php_admin_flag - these directives won't be overwritten by
 ;                                     PHP call 'ini_set'
 ; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
 ; Defining 'extension' will load the corresponding shared extension from
 ; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
 ; overwrite previously defined php.ini values, but will append the new value
 ; instead.
 ; Note: path INI options can be relative and will be expanded with the prefix
 ; (pool, global or @prefix@)
 ; Default Value: nothing is defined by default except the values in php.ini and
 ;                specified at startup with the -d argument
 ;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
 ;php_flag[display_errors] = off
 php_admin_value[error_log] = /var/log/php-fpm/www-error.log
 php_admin_flag[log_errors] = on
 ;php_admin_value[memory_limit] = 128M
 ; Set the following data paths to directories owned by the FPM process user.
 ;
 ; Do not change the ownership of existing system directories, if the process
 ; user does not have write permission, create dedicated directories for this
 ; purpose.
 ;
 ; See warning about choosing the location of these directories on your system
 ; at http://php.net/session.save-path
 php_value[session.save_handler] = files
 php_value[session.save_path]    = /var/lib/php/session
 php_value[soap.wsdl_cache_dir]  = /var/lib/php/wsdlcache
 ;php_value[opcache.file_cache]  = /var/lib/php/opcache
@@ -1,148 +0,0 @@
 ; Enable Zend OPcache extension module
 zend_extension=opcache
 ; Determines if Zend OPCache is enabled
 opcache.enable=1
 ; Determines if Zend OPCache is enabled for the CLI version of PHP
 opcache.enable_cli=1
 ; The OPcache shared memory storage size.
 ;opcache.memory_consumption=128
 ; The amount of memory for interned strings in Mbytes.
 ;opcache.interned_strings_buffer=8
 ; The maximum number of keys (scripts) in the OPcache hash table.
 ; Only numbers between 200 and 1000000 are allowed.
 ;opcache.max_accelerated_files=10000
 ; The maximum percentage of "wasted" memory until a restart is scheduled.
 ;opcache.max_wasted_percentage=5
 ; When this directive is enabled, the OPcache appends the current working
 ; directory to the script key, thus eliminating possible collisions between
 ; files with the same name (basename). Disabling the directive improves
 ; performance, but may break existing applications.
 ;opcache.use_cwd=1
 ; When disabled, you must reset the OPcache manually or restart the
 ; webserver for changes to the filesystem to take effect.
 ;opcache.validate_timestamps=1
 ; How often (in seconds) to check file timestamps for changes to the shared
 ; memory storage allocation. ("1" means validate once per second, but only
 ; once per request. "0" means always validate)
 ;opcache.revalidate_freq=2
 ; Enables or disables file search in include_path optimization
 ;opcache.revalidate_path=0
 ; If disabled, all PHPDoc comments are dropped from the code to reduce the
 ; size of the optimized code.
 ;opcache.save_comments=1
 ; Allow file existence override (file_exists, etc.) performance feature.
 ;opcache.enable_file_override=0
 ; A bitmask, where each bit enables or disables the appropriate OPcache
 ; passes
 ;opcache.optimization_level=0x7FFFBFFF
 ; This hack should only be enabled to work around "Cannot redeclare class"
 ; errors.
 ;opcache.dups_fix=0
 ; The location of the OPcache blacklist file (wildcards allowed).
 ; Each OPcache blacklist file is a text file that holds the names of files
 ; that should not be accelerated.
 opcache.blacklist_filename=/etc/php-zts.d/opcache*.blacklist
 ; Allows exclusion of large files from being cached. By default all files
 ; are cached.
 ;opcache.max_file_size=0
 ; Check the cache checksum each N requests.
 ; The default value of "0" means that the checks are disabled.
 ;opcache.consistency_checks=0
 ; How long to wait (in seconds) for a scheduled restart to begin if the cache
 ; is not being accessed.
 ;opcache.force_restart_timeout=180
 ; OPcache error_log file name. Empty string assumes "stderr".
 ;opcache.error_log=
 ; All OPcache errors go to the Web server log.
 ; By default, only fatal errors (level 0) or errors (level 1) are logged.
 ; You can also enable warnings (level 2), info messages (level 3) or
 ; debug messages (level 4).
 ;opcache.log_verbosity_level=1
 ; Preferred Shared Memory back-end. Leave empty and let the system decide.
 ;opcache.preferred_memory_model=
 ; Protect the shared memory from unexpected writing during script execution.
 ; Useful for internal debugging only.
 ;opcache.protect_memory=0
 ; Allows calling OPcache API functions only from PHP scripts which path is
 ; started from specified string. The default "" means no restriction
 ;opcache.restrict_api=
 ; Enables and sets the second level cache directory.
 ; It should improve performance when SHM memory is full, at server restart or
 ; SHM reset. The default "" disables file based caching.
 ; RPM note : file cache directory must be owned by process owner
 ;   for mod_php, see /etc/httpd/conf.d/php.conf
 ;   for php-fpm, see /etc/php-fpm.d/*conf
 ;opcache.file_cache=
 ; Enables or disables opcode caching in shared memory.
 ;opcache.file_cache_only=0
 ; Enables or disables checksum validation when script loaded from file cache.
 ;opcache.file_cache_consistency_checks=1
 ; Implies opcache.file_cache_only=1 for a certain process that failed to
 ; reattach to the shared memory (for Windows only). Explicitly enabled file
 ; cache is required.
 ;opcache.file_cache_fallback=1
 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES.
 ; This should improve performance, but requires appropriate OS configuration.
 opcache.huge_code_pages=0
 ; Validate cached file permissions.
 ; Leads OPcache to check file readability on each access to cached file.
 ; This directive should be enabled in shared hosting environment, when few
 ; users (PHP-FPM pools) reuse the common OPcache shared memory.
 ;opcache.validate_permission=0
 ; Prevent name collisions in chroot'ed environment.
 ; This directive prevents file name collisions in different "chroot"
 ; environments. It should be enabled for sites that may serve requests in
 ; different "chroot" environments.
 ;opcache.validate_root=0
 ; If specified, it produces opcode dumps for debugging different stages of
 ; optimizations.
 ;opcache.opt_debug_level=0
 ; Specifies a PHP script that is going to be compiled and executed at server
 ; start-up.
 ; http://php.net/opcache.preload
 ;opcache.preload=
 ; Preloading code as root is not allowed for security reasons. This directive
 ; facilitates to let the preloading to be run as another user.
 ; http://php.net/opcache.preload_user
 ;opcache.preload_user=
 ; Prevents caching files that are less than this number of seconds old. It
 ; protects from caching of incompletely updated files. In case all file updates
 ; on your site are atomic, you may increase performance by setting it to "0".
 ;opcache.file_update_protection=2
 ; Absolute path used to store shared lockfiles (for *nix only).
 ;opcache.lockfile_path=/tmp
@@ -1,2 +0,0 @@
 ; Enable bz2 extension module
 extension=bz2
@@ -1,2 +0,0 @@
 ; Enable calendar extension module
 extension=calendar
@@ -1,2 +0,0 @@
 ; Enable ctype extension module
 extension=ctype
@@ -1,2 +0,0 @@
 ; Enable curl extension module
 extension=curl
@@ -1,2 +0,0 @@
 ; Enable dom extension module
 extension=dom
@@ -1,2 +0,0 @@
 ; Enable exif extension module
 extension=exif
@@ -1,2 +0,0 @@
 ; Enable fileinfo extension module
 extension=fileinfo
@@ -1,2 +0,0 @@
 ; Enable ftp extension module
 extension=ftp
@@ -1,2 +0,0 @@
 ; Enable gettext extension module
 extension=gettext
@@ -1,2 +0,0 @@
 ; Enable iconv extension module
 extension=iconv
@@ -1,2 +0,0 @@
 ; Enable json extension module
 extension=json
@@ -1,2 +0,0 @@
 ; Enable mbstring extension module
 extension=mbstring
@@ -1,2 +0,0 @@
 ; Enable mysqlnd extension module
 extension=mysqlnd
@@ -1,2 +0,0 @@
 ; Enable pdo extension module
 extension=pdo
@@ -1,2 +0,0 @@
 ; Enable phar extension module
 extension=phar
@@ -1,2 +0,0 @@
 ; Enable simplexml extension module
 extension=simplexml
@@ -1,2 +0,0 @@
 ; Enable sockets extension module
 extension=sockets
@@ -1,2 +0,0 @@
 ; Enable sodium extension module
 extension=sodium
@@ -1,2 +0,0 @@
 ; Enable sqlite3 extension module
 extension=sqlite3
@@ -1,2 +0,0 @@
 ; Enable tokenizer extension module
 extension=tokenizer
@@ -1,2 +0,0 @@
 ; Enable xml extension module
 extension=xml
@@ -1,2 +0,0 @@
 ; Enable xmlwriter extension module
 extension=xmlwriter
@@ -1,2 +0,0 @@
 ; Enable xsl extension module
 extension=xsl
@@ -1,2 +0,0 @@
 ; Enable mysqli extension module
 extension=mysqli
@@ -1,2 +0,0 @@
 ; Enable pdo_mysql extension module
 extension=pdo_mysql
@@ -1,2 +0,0 @@
 ; Enable pdo_sqlite extension module
 extension=pdo_sqlite
@@ -1,2 +0,0 @@
 ; Enable xmlreader extension module
 extension=xmlreader
@@ -1,11 +0,0 @@
 ; The blacklist file is a text file that holds the names of files
 ; that should not be accelerated. The file format is to add each filename
 ; to a new line. The filename may be a full path or just a file prefix
 ; (i.e., /var/www/x  blacklists all the files and directories in /var/www
 ; that start with 'x'). Line starting with a ; are ignored (comments).
 ; Files are usually triggered by one of the following three reasons:
 ; 1) Directories that contain auto generated code, like Smarty or ZFW cache.
 ; 2) Code that does not work well when accelerated, due to some delayed
 ;    compile time evaluation.
 ; 3) Code that triggers an OPcache bug.
@@ -1,154 +0,0 @@
 ; Enable Zend OPcache extension module
 zend_extension=opcache
 ; Determines if Zend OPCache is enabled
 opcache.enable=1
 ; Determines if Zend OPCache is enabled for the CLI version of PHP
 opcache.enable_cli=1
 ; The OPcache shared memory storage size.
 ;opcache.memory_consumption=128
 ; The amount of memory for interned strings in Mbytes.
 ;opcache.interned_strings_buffer=8
 ; The maximum number of keys (scripts) in the OPcache hash table.
 ; Only numbers between 200 and 1000000 are allowed.
 ;opcache.max_accelerated_files=10000
 ; The maximum percentage of "wasted" memory until a restart is scheduled.
 ;opcache.max_wasted_percentage=5
 ; When this directive is enabled, the OPcache appends the current working
 ; directory to the script key, thus eliminating possible collisions between
 ; files with the same name (basename). Disabling the directive improves
 ; performance, but may break existing applications.
 ;opcache.use_cwd=1
 ; When disabled, you must reset the OPcache manually or restart the
 ; webserver for changes to the filesystem to take effect.
 ;opcache.validate_timestamps=1
 ; How often (in seconds) to check file timestamps for changes to the shared
 ; memory storage allocation. ("1" means validate once per second, but only
 ; once per request. "0" means always validate)
 ;opcache.revalidate_freq=2
 ; Enables or disables file search in include_path optimization
 ;opcache.revalidate_path=0
 ; If disabled, all PHPDoc comments are dropped from the code to reduce the
 ; size of the optimized code.
 ;opcache.save_comments=1
 ; If enabled, compilation warnings (including notices and deprecations) will
 ; be recorded and replayed each time a file is included. Otherwise, compilation
 ; warnings will only be emitted when the file is first cached.
 ;opcache.record_warnings=0
 ; Allow file existence override (file_exists, etc.) performance feature.
 ;opcache.enable_file_override=0
 ; A bitmask, where each bit enables or disables the appropriate OPcache
 ; passes
 ;opcache.optimization_level=0x7FFFBFFF
 ; This hack should only be enabled to work around "Cannot redeclare class"
 ; errors.
 ;opcache.dups_fix=0
 ; The location of the OPcache blacklist file (wildcards allowed).
 ; Each OPcache blacklist file is a text file that holds the names of files
 ; that should not be accelerated.
 opcache.blacklist_filename=/etc/php.d/opcache*.blacklist
 ; Allows exclusion of large files from being cached. By default all files
 ; are cached.
 ;opcache.max_file_size=0
 ; How long to wait (in seconds) for a scheduled restart to begin if the cache
 ; is not being accessed.
 ;opcache.force_restart_timeout=180
 ; OPcache error_log file name. Empty string assumes "stderr".
 ;opcache.error_log=
 ; All OPcache errors go to the Web server log.
 ; By default, only fatal errors (level 0) or errors (level 1) are logged.
 ; You can also enable warnings (level 2), info messages (level 3) or
 ; debug messages (level 4).
 ;opcache.log_verbosity_level=1
 ; Preferred Shared Memory back-end. Leave empty and let the system decide.
 ;opcache.preferred_memory_model=
 ; Protect the shared memory from unexpected writing during script execution.
 ; Useful for internal debugging only.
 ;opcache.protect_memory=0
 ; Allows calling OPcache API functions only from PHP scripts which path is
 ; started from specified string. The default "" means no restriction
 ;opcache.restrict_api=
 ; Enables and sets the second level cache directory.
 ; It should improve performance when SHM memory is full, at server restart or
 ; SHM reset. The default "" disables file based caching.
 ; RPM note : file cache directory must be owned by process owner
 ;   for mod_php, see /etc/httpd/conf.d/php.conf
 ;   for php-fpm, see /etc/php-fpm.d/*conf
 ;opcache.file_cache=
 ; Enables or disables opcode caching in shared memory.
 ;opcache.file_cache_only=0
 ; Enables or disables checksum validation when script loaded from file cache.
 ;opcache.file_cache_consistency_checks=1
 ; Implies opcache.file_cache_only=1 for a certain process that failed to
 ; reattach to the shared memory (for Windows only). Explicitly enabled file
 ; cache is required.
 ;opcache.file_cache_fallback=1
 ; Enables or disables copying of PHP code (text segment) into HUGE PAGES.
 ; Under certain circumstances (if only a single global PHP process is
 ; started from which all others fork), this can increase performance
 ; by a tiny amount because TLB misses are reduced.  On the other hand, this
 ; delays PHP startup, increases memory usage and degrades performance
 ; under memory pressure - use with care.
 ; Requires appropriate OS configuration.
 opcache.huge_code_pages=0
 ; Validate cached file permissions.
 ; Leads OPcache to check file readability on each access to cached file.
 ; This directive should be enabled in shared hosting environment, when few
 ; users (PHP-FPM pools) reuse the common OPcache shared memory.
 ;opcache.validate_permission=0
 ; Prevent name collisions in chroot'ed environment.
 ; This directive prevents file name collisions in different "chroot"
 ; environments. It should be enabled for sites that may serve requests in
 ; different "chroot" environments.
 ;opcache.validate_root=0
 ; If specified, it produces opcode dumps for debugging different stages of
 ; optimizations.
 ;opcache.opt_debug_level=0
 ; Specifies a PHP script that is going to be compiled and executed at server
 ; start-up.
 ; https://php.net/opcache.preload
 ;opcache.preload=
 ; Preloading code as root is not allowed for security reasons. This directive
 ; facilitates to let the preloading to be run as another user.
 ; https://php.net/opcache.preload_user
 ;opcache.preload_user=
 ; Prevents caching files that are less than this number of seconds old. It
 ; protects from caching of incompletely updated files. In case all file updates
 ; on your site are atomic, you may increase performance by setting it to "0".
 ;opcache.file_update_protection=2
 ; Absolute path used to store shared lockfiles (for *nix only).
 ;opcache.lockfile_path=/tmp
@@ -1,2 +0,0 @@
 ; Enable bz2 extension module
 extension=bz2
@@ -1,2 +0,0 @@
 ; Enable calendar extension module
 extension=calendar
@@ -1,2 +0,0 @@
 ; Enable ctype extension module
 extension=ctype
@@ -1,2 +0,0 @@
 ; Enable curl extension module
 extension=curl
@@ -1,2 +0,0 @@
 ; Enable dom extension module
 extension=dom
@@ -1,2 +0,0 @@
 ; Enable exif extension module
 extension=exif
@@ -1,2 +0,0 @@
 ; Enable fileinfo extension module
 extension=fileinfo
@@ -1,2 +0,0 @@
 ; Enable ftp extension module
 extension=ftp
@@ -1,2 +0,0 @@
 ; Enable gettext extension module
 extension=gettext
@@ -1,2 +0,0 @@
 ; Enable iconv extension module
 extension=iconv
@@ -1,2 +0,0 @@
 ; Enable json extension module
 extension=json
@@ -1,2 +0,0 @@
 ; Enable mbstring extension module
 extension=mbstring
@@ -1,2 +0,0 @@
 ; Enable mysqlnd extension module
 extension=mysqlnd
@@ -1,2 +0,0 @@
 ; Enable pdo extension module
 extension=pdo
@@ -1,2 +0,0 @@
 ; Enable phar extension module
 extension=phar
@@ -1,2 +0,0 @@
 ; Enable simplexml extension module
 extension=simplexml
@@ -1,2 +0,0 @@
 ; Enable sockets extension module
 extension=sockets
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
jmrothst	a81059d4e4	Roles only run on intended supported OS, and minor cleanup of when statements to match	2026-09-01 22:01:59 -05:00
jmrothst	d38a19c9b5	Fix license and readme files	2026-09-01 21:48:28 -05:00
jmrothst	59c434a51d	Agents, style, and editor	2026-09-01 21:46:43 -05:00
jmrothst	0d061f3ce7	More reload vs restart in dovecot role this time.	2026-08-15 21:42:48 -05:00
jmrothst	cfbca7f333	Add missing fall through case	2026-08-11 00:34:15 -05:00
jmrothst	4f1a023c8d	ansible-lint cleanups	2026-08-11 00:28:29 -05:00
jmrothst	8240771758	Add in place os upgrade for Debian and Ubuntu	2026-08-11 00:08:41 -05:00
jmrothst	0e18e3bdbb	Yet another attempt to fix Oracle Linux vs EPEL	2026-08-10 23:08:42 -05:00
jmrothst	44dd3b642b	Dovecot service restart vs reload	2026-08-10 22:49:29 -05:00
jmrothst	9c90a8e628	Remove the unsupported Fedora 42, and the soon to be unsupported Debian 11	2026-08-10 21:19:46 -05:00
jmrothst	3ecdc2af16	Dovecot to stop using PAM auth	2026-08-10 21:07:06 -05:00
jmrothst	e6daee8d1e	Enabling Spam Assassin	2026-08-10 21:06:33 -05:00
jmrothst	fca5c83e4d	Fix the name on all "name" tasks, but not name variables to pass ansible linting	2026-08-10 21:03:13 -05:00
jmrothst	306397517d	yaml and ansible linting clean ups	2026-08-09 23:04:34 -05:00
jmrothst	6eb2875e44	Make OL get Fedora's EPEL but force it to lower priority over Oracle EPEL so that rpmfusion works, and we hopefully do not break OS patching again	2026-08-09 11:49:52 -05:00
jmrothst	738e938ccc	Add ensure_dbus so that firewalld cli commands work	2026-08-09 11:37:17 -05:00
jmrothst	331f8beb3b	Add firewalld configuration role, and have services that need it depend on it.	2026-08-09 11:29:08 -05:00
jmrothst	6c7ecfc724	Add fail2ban role and clean up yaml lint noise	2026-08-08 23:50:32 -05:00
jmrothst	9b837dd780	Calm down the yaml linters a bit...	2026-08-08 23:50:03 -05:00
jmrothst	22c402c34a	Disabled debug, kept the directives for future debugging if required.	2026-08-08 19:23:56 -05:00
jmrothst	abba503a8f	Removed invalid dovecot config line	2026-08-08 19:07:41 -05:00
jmrothst	3d2f64ece3	Force the generic python3 interpreter for python so we can safely handle in place OS upgrades on Fedora	2026-08-08 19:04:21 -05:00
jmrothst	130ee0811e	convert from community.mysql to ansible.mysql collection	2026-08-08 19:03:51 -05:00
jmrothst	45d6c79f5a	Make some scalability corrections	2026-08-08 18:40:54 -05:00
jmrothst	0213cf4918	Service quota-status isn't working so comment for now	2026-08-08 18:23:54 -05:00
jmrothst	81053b881b	Remove historical Fedora dnf system upgrade variables for unsupported OS	2026-08-07 21:44:29 -05:00
jmrothst	fb70beccf9	Remove EL8 templates, and baddly added templates that never could have worked	2026-08-07 21:43:28 -05:00
jmrothst	483363994d	Remove reference to yum since ansible doesn't support it any longer	2026-08-07 21:40:54 -05:00
jmrothst	d8fc5510d6	Remove disused ensure_clamav role	2026-08-07 21:40:20 -05:00
jmrothst	16ca07dea8	Drop EL8 support along with a role for a unused unmainted repo Signed-off-by: Jason Rothstein <fdragon@fdragon.org>	2026-08-07 21:17:11 -05:00
jmrothst	d626d03b97	Add Fedora 43 & 44 support to Postfix Signed-off-by: Jason Rothstein <fdragon@fdragon.org>	2026-08-07 21:11:32 -05:00
jmrothst	29a0181a13	Fedora 42 is unsupported so force upgrades Signed-off-by: Jason Rothstein <fdragon@fdragon.org>	2026-08-07 21:10:54 -05:00
`@@ -1,2 +1,2 @@`
	`---`	`---`
	`# defaults file for ensure_ansible_prereq`	`...`
		`@@ -1 +0,0 @@`
			`LoadModule brotli_module modules/mod_brotli.so`
		`@@ -1,2 +0,0 @@`
			`# This file configures systemd module:`
			`LoadModule systemd_module modules/mod_systemd.so`
		`@@ -1 +0,0 @@`
			`LoadModule http2_module modules/mod_http2.so`
		`@@ -1 +0,0 @@`
			`LoadModule proxy_http2_module modules/mod_proxy_http2.so`
		`@@ -1,2 +0,0 @@`
			`; Enable bz2 extension module`
			`extension=bz2`
		`@@ -1,2 +0,0 @@`
			`; Enable calendar extension module`
			`extension=calendar`
		`@@ -1,2 +0,0 @@`
			`; Enable ctype extension module`
			`extension=ctype`
		`@@ -1,2 +0,0 @@`
			`; Enable curl extension module`
			`extension=curl`