cyber-0 updated with more examples

inventory.ini

@@ -1,19 +1,136 @@
 # inventory.ini — Target hosts for IEC 62443-3-3 SL2 compliance validation
 #
-# [all] group is the default target for site.yml (hosts: all).
-# For local testing, uncomment localhost. For remote targets,
-# ensure SSH credentials are configured or use -K for sudo.
+# Each platform type has its own group with the connection variables
+# required by the matching example playbook in playbooks/examples/.
 #
-# Usage:
-#   ansible-playbook -i inventory.ini playbooks/site.yml --limit localhost -K
-#   ansible-playbook -i inventory.ini playbooks/site.yml --limit ics_assets
+# Store secrets in Ansible Vault:
+#   ansible-vault encrypt_string 'MyP@ss' --name ansible_password
+#
+# Run a specific platform:
+#   ansible-playbook -i inventory.ini playbooks/examples/windows_server.yml
+#   ansible-playbook -i inventory.ini playbooks/examples/cisco_switch.yml
+#
+# Run all Linux assets:
+#   ansible-playbook -i inventory.ini playbooks/site.yml --limit linux_vms -K
 
+# ── Local control-node self-test ─────────────────────────────────────────────
 [all]
-# For testing on the control node itself:
-# localhost ansible_connection=local
+localhost ansible_connection=local
 
-[ics_assets]
-# Add real ICS/OT targets here. Example:
-# plc-rack01.example.com    ansible_user=auditor
-# hmi-station02.example.com ansible_user=auditor
-# engineering-ws03.example.com
+# ── Linux VMs / Servers (SSH — native Ansible) ───────────────────────────────
+# Example: playbooks/examples/linux_vm.yml
+[linux_vms]
+# linux-vm-01.example.com  ansible_user=auditor
+# linux-vm-02.example.com  ansible_user=auditor  ansible_become=yes
+
+# ── Windows Servers (WinRM) ───────────────────────────────────────────────────
+# Example: playbooks/examples/windows_server.yml
+# Preferred transport: kerberos (domain) or ntlm (workgroup/local admin)
+[windows_servers]
+# win-srv-01.example.com
+# win-srv-02.example.com
+
+[windows_servers:vars]
+ansible_connection=winrm
+ansible_winrm_transport=ntlm
+ansible_winrm_server_cert_validation=ignore
+ansible_port=5985
+# ansible_user=DOMAIN\auditor
+# ansible_password="{{ vault_win_password }}"
+
+# ── Windows Clients / Workstations (WinRM) ────────────────────────────────────
+# Example: playbooks/examples/windows_client.yml
+[windows_clients]
+# win-ws-01.example.com
+# win-ws-02.example.com
+
+[windows_clients:vars]
+ansible_connection=winrm
+ansible_winrm_transport=ntlm
+ansible_winrm_server_cert_validation=ignore
+ansible_port=5985
+# ansible_user=DOMAIN\auditor
+# ansible_password="{{ vault_win_password }}"
+
+# ── MS SQL Servers (WinRM to Windows host; SQL queried via PowerShell) ────────
+# Example: playbooks/examples/mssql_server.yml
+[mssql_servers]
+# sql-srv-01.example.com  mssql_instance=MSSQLSERVER
+# sql-srv-02.example.com  mssql_instance=NAMED_INSTANCE
+
+[mssql_servers:vars]
+ansible_connection=winrm
+ansible_winrm_transport=ntlm
+ansible_winrm_server_cert_validation=ignore
+ansible_port=5985
+# ansible_user=DOMAIN\auditor
+# ansible_password="{{ vault_win_password }}"
+
+# ── VMware vSphere ESXi Hosts (vSphere API via vCenter — no SSH) ──────────────
+# Example: playbooks/examples/vmware_vsphere.yml
+# The inventory host IS the ESXi hostname. Connection goes via vCenter API.
+[vmware_esxi]
+# esxi-01.example.com
+# esxi-02.example.com
+
+[vmware_esxi:vars]
+ansible_connection=local
+vcenter_hostname=vcenter.example.com
+vcenter_username=audit@vsphere.local
+# vcenter_password="{{ vault_vcenter_password }}"
+vmware_validate_certs=false
+
+# ── Hyper-V Clusters (WinRM to cluster node) ──────────────────────────────────
+# Example: playbooks/examples/hyperv_cluster.yml
+[hyperv_hosts]
+# hv-node-01.example.com
+# hv-node-02.example.com
+
+[hyperv_hosts:vars]
+ansible_connection=winrm
+ansible_winrm_transport=ntlm
+ansible_winrm_server_cert_validation=ignore
+ansible_port=5985
+# ansible_user=DOMAIN\auditor
+# ansible_password="{{ vault_win_password }}"
+
+# ── Cisco Switches (IOS / IOS-XE — SSH via network_cli) ──────────────────────
+# Example: playbooks/examples/cisco_switch.yml
+[cisco_switches]
+# sw-core-01.example.com
+# sw-acc-01.example.com
+
+[cisco_switches:vars]
+ansible_connection=ansible.netcommon.network_cli
+ansible_network_os=cisco.ios.ios
+ansible_become=yes
+ansible_become_method=enable
+# ansible_user=audit
+# ansible_password="{{ vault_ios_password }}"
+# ansible_become_password="{{ vault_ios_enable }}"
+
+# ── Cisco Firewalls (ASA — SSH via network_cli) ───────────────────────────────
+# Example: playbooks/examples/cisco_firewall.yml
+[cisco_firewalls]
+# asa-fw-01.example.com
+# asa-fw-02.example.com
+
+[cisco_firewalls:vars]
+ansible_connection=ansible.netcommon.network_cli
+ansible_network_os=cisco.asa.asa
+ansible_become=yes
+ansible_become_method=enable
+# ansible_user=audit
+# ansible_password="{{ vault_asa_password }}"
+# ansible_become_password="{{ vault_asa_enable }}"
+
+# ── Convenience group: all ICS/OT assets (excludes localhost) ────────────────
+[ics_assets:children]
+linux_vms
+windows_servers
+windows_clients
+mssql_servers
+vmware_esxi
+hyperv_hosts
+cisco_switches
+cisco_firewalls