# inventory.ini — Target hosts for IEC 62443-3-3 SL2 compliance validation
#
# Each platform type has its own group with the connection variables
# required by the matching example playbook in playbooks/examples/.
#
# Store secrets in Ansible Vault:
#   ansible-vault encrypt_string 'MyP@ss' --name ansible_password
#
# Run a specific platform:
#   ansible-playbook -i inventory.ini playbooks/examples/windows_server.yml
#   ansible-playbook -i inventory.ini playbooks/examples/cisco_switch.yml
#
# Run all Linux assets:
#   ansible-playbook -i inventory.ini playbooks/site.yml --limit linux_vms -K

# ── Local control-node self-test ─────────────────────────────────────────────
[all]
localhost ansible_connection=local

# ── Linux VMs / Servers (SSH — native Ansible) ───────────────────────────────
# Example: playbooks/examples/linux_vm.yml
[linux_vms]
# linux-vm-01.example.com  ansible_user=auditor
# linux-vm-02.example.com  ansible_user=auditor  ansible_become=yes

# ── Windows Servers (WinRM) ───────────────────────────────────────────────────
# Example: playbooks/examples/windows_server.yml
# Preferred transport: kerberos (domain) or ntlm (workgroup/local admin)
[windows_servers]
# win-srv-01.example.com
# win-srv-02.example.com

[windows_servers:vars]
ansible_connection=winrm
ansible_winrm_transport=ntlm
ansible_winrm_server_cert_validation=ignore
ansible_port=5985
# ansible_user=DOMAIN\auditor
# ansible_password="{{ vault_win_password }}"

# ── Windows Clients / Workstations (WinRM) ────────────────────────────────────
# Example: playbooks/examples/windows_client.yml
[windows_clients]
# win-ws-01.example.com
# win-ws-02.example.com

[windows_clients:vars]
ansible_connection=winrm
ansible_winrm_transport=ntlm
ansible_winrm_server_cert_validation=ignore
ansible_port=5985
# ansible_user=DOMAIN\auditor
# ansible_password="{{ vault_win_password }}"

# ── MS SQL Servers (WinRM to Windows host; SQL queried via PowerShell) ────────
# Example: playbooks/examples/mssql_server.yml
[mssql_servers]
# sql-srv-01.example.com  mssql_instance=MSSQLSERVER
# sql-srv-02.example.com  mssql_instance=NAMED_INSTANCE

[mssql_servers:vars]
ansible_connection=winrm
ansible_winrm_transport=ntlm
ansible_winrm_server_cert_validation=ignore
ansible_port=5985
# ansible_user=DOMAIN\auditor
# ansible_password="{{ vault_win_password }}"

# ── VMware vSphere ESXi Hosts (vSphere API via vCenter — no SSH) ──────────────
# Example: playbooks/examples/vmware_vsphere.yml
# The inventory host IS the ESXi hostname. Connection goes via vCenter API.
[vmware_esxi]
# esxi-01.example.com
# esxi-02.example.com

[vmware_esxi:vars]
ansible_connection=local
vcenter_hostname=vcenter.example.com
vcenter_username=audit@vsphere.local
# vcenter_password="{{ vault_vcenter_password }}"
vmware_validate_certs=false

# ── Hyper-V Clusters (WinRM to cluster node) ──────────────────────────────────
# Example: playbooks/examples/hyperv_cluster.yml
[hyperv_hosts]
# hv-node-01.example.com
# hv-node-02.example.com

[hyperv_hosts:vars]
ansible_connection=winrm
ansible_winrm_transport=ntlm
ansible_winrm_server_cert_validation=ignore
ansible_port=5985
# ansible_user=DOMAIN\auditor
# ansible_password="{{ vault_win_password }}"

# ── Cisco Switches (IOS / IOS-XE — SSH via network_cli) ──────────────────────
# Example: playbooks/examples/cisco_switch.yml
[cisco_switches]
# sw-core-01.example.com
# sw-acc-01.example.com

[cisco_switches:vars]
ansible_connection=ansible.netcommon.network_cli
ansible_network_os=cisco.ios.ios
ansible_become=yes
ansible_become_method=enable
# ansible_user=audit
# ansible_password="{{ vault_ios_password }}"
# ansible_become_password="{{ vault_ios_enable }}"

# ── Cisco Firewalls (ASA — SSH via network_cli) ───────────────────────────────
# Example: playbooks/examples/cisco_firewall.yml
[cisco_firewalls]
# asa-fw-01.example.com
# asa-fw-02.example.com

[cisco_firewalls:vars]
ansible_connection=ansible.netcommon.network_cli
ansible_network_os=cisco.asa.asa
ansible_become=yes
ansible_become_method=enable
# ansible_user=audit
# ansible_password="{{ vault_asa_password }}"
# ansible_become_password="{{ vault_asa_enable }}"

# ── Convenience group: all ICS/OT assets (excludes localhost) ────────────────
[ics_assets:children]
linux_vms
windows_servers
windows_clients
mssql_servers
vmware_esxi
hyperv_hosts
cisco_switches
cisco_firewalls