feat(roles/valkey)!: add a role to install and configure Valkey

CHANGELOG.md

@@ -8,10 +8,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-**Highlights:** On RHEL 8, a MariaDB package upgrade no longer cuts applications on the same host off from their database. Apache no longer loads `mod_info`, which served the complete configuration including other modules' credentials. A broken PHP-FPM configuration aborts the run instead of taking the service down on the restart. Sudo rules deployed by `freeipa_server` can carry their commands again. The Bitwarden lookup can be told to abort instead of silently generating a new password, for runs against hosts whose credentials must already exist. The Grafana graph configuration for the Monitoring Plugins is no longer deployed on every ordinary run and has to be requested explicitly by its tag. Apache serves HTTP/2 to every client that offers it over TLS, which in a typical setup is the reverse proxy in front of an application; the hop from that proxy to the backend is unchanged. LibreNMS keeps its RRD updates in RRDCached and writes them out every 30 minutes, taking a large share of the poller's disk I/O off the host.
+**Highlights:** Valkey gets its own role and playbook instead of being installed under the Redis name, which is what RHEL 10 hosts need now that Red Hat ships no Redis at all; those hosts have to be moved over. On RHEL 8, a MariaDB package upgrade no longer cuts applications on the same host off from their database. Apache no longer loads `mod_info`, which served the complete configuration including other modules' credentials. A broken PHP-FPM configuration aborts the run instead of taking the service down on the restart. Sudo rules deployed by `freeipa_server` can carry their commands again. The Bitwarden lookup can be told to abort instead of silently generating a new password, for runs against hosts whose credentials must already exist. The Grafana graph configuration for the Monitoring Plugins is no longer deployed on every ordinary run and has to be requested explicitly by its tag. Apache serves HTTP/2 to every client that offers it over TLS, which in a typical setup is the reverse proxy in front of an application; the hop from that proxy to the backend is unchanged. LibreNMS keeps its RRD updates in RRDCached and writes them out every 30 minutes, taking a large share of the poller's disk I/O off the host.
 
 ### Breaking Changes
 
+* **role:redis**: `redis__conf_daemonize` and `redis__conf_supervised` are gone; remove them from your inventory. Neither ever reached the running service: a Redis supervised by systemd never daemonizes, and every packaged unit either overrides both on its `ExecStart` line or depends on the `supervised auto` the role deploys. The deployed `redis.conf` keeps the values it had, so nothing changes on a host that used the defaults.
 * **role:librenms**: `librenms__fqdn` and `librenms__config_app_url` are replaced by `librenms__url`, which takes the URL of the instance including the scheme, for example `https://librenms.example.com`. Set it in place of the two, using the URL your users open in the browser even when Apache httpd on the host serves plain HTTP behind a TLS-terminating proxy.
 * **role:librenms**: LibreNMS trusts no reverse proxy any more, where it previously trusted one running on the LibreNMS host itself. It therefore ignores the `X-Forwarded-*` headers of such a proxy, and logs, access control and the detected protocol use the proxy's address instead of the client's. Hosts with a proxy in front of LibreNMS list it in `librenms__config_app_trusted_proxies`; `['127.0.0.1']` restores the previous behaviour.
 * **role:php**: The PHP-FPM pool configuration changed for existing hosts. Sessions now live in a per-pool directory (the default `www` pool moves from `/var/lib/php/session` to `/var/lib/php/session/www`), so logged-in users are signed out once after the upgrade. `memory_limit`, `max_execution_time`, `max_input_vars`, `post_max_size`, `upload_max_filesize`, `session.save_handler` and `session.save_path` are now enforced as `php_admin_value`, so applications can no longer change them at runtime via `ini_set()`. A pool that stores its sessions in redis or memcached sets `php_admin_value_session_save_handler` accordingly. `soap.wsdl_cache_dir` moves from the shared `/var/lib/php/wsdlcache` to a per-pool directory below it. On Debian the pool socket now belongs to `root` and grants the web server access through a POSIX ACL entry, where it used to be owned by the web server user; anything of your own that checks the socket's ownership rather than connecting to it needs adjusting. Worker processes recycle after 500 requests (`pm.max_requests`) instead of running indefinitely, and a worker still serving a single request after 60 seconds is killed (`request_terminate_timeout`, previously off). Hosts with legitimately long-running web requests raise `php__fpm_pool_conf_request_terminate_timeout__group_var`.
@@ -25,6 +26,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * **role:collabora**: `collabora__coolwsd_ssl_settings_ssl_verification` and `collabora__coolwsd_welcome_enable` reach the deployed `coolwsd.xml` again, and SSL verification of the WOPI host now defaults to strict. Both variables were only wired into a few old templates, so on newer versions the value came from the package instead of from the inventory, and most packages ship verification off. A host whose WOPI host presents a self-signed or otherwise untrusted certificate needs `collabora__coolwsd_ssl_settings_ssl_verification: false`, otherwise its documents stop loading.
 * **role:apache_httpd**: `mod_info` is no longer enabled, so `/server-info` stops serving the complete Apache configuration, including the credentials of other modules. Hosts that need the endpoint re-enable the `info` module in their inventory via `apache_httpd__mods__group_var` / `apache_httpd__mods__host_var`.
 * **role:monitoring_plugins**: A source install now places the notification plugins in `/usr/lib64/nagios/plugins`, next to the check plugins, and removes the `/usr/lib64/nagios/plugins/notifications` directory it used before. This is where the shipped Icinga command definitions and the rpm/deb packages have always expected them. Adjust any command definition of your own that points into the `notifications` subdirectory.
+* **role:redis**: RHEL 10 is no longer supported, since Red Hat ships no Redis there. On RHEL 10 the role used to install Valkey under the Redis name, which aborted the run when the configuration file was deployed. Move those hosts to the `valkey` role: put them into the `lfops_valkey` inventory group and rename their `redis__*` variables to `valkey__*`. All other platforms are unaffected.
 * **role:collabora**: Drop support for EOL Collabora 23.05. Upgrade to 24.04 or newer.
 * **role:icingaweb2_module_grafana**: The graph configuration for the Linuxfabrik Monitoring Plugins is only deployed when the role is called with `--tags icingaweb2_module_grafana:monitoring_plugins_graphs`, matching the `icingaweb2_module_director:basket` tag. Run the role with that tag to update `/etc/icingaweb2/modules/grafana/graphs.ini`. The `icingaweb2_module_grafana__skip_monitoring_plugins_graphs_config` variable is gone; remove it from your inventory.
 
@@ -43,6 +45,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * **role:keycloak**: Add `keycloak__limit_nofile`, `keycloak__transaction_default_timeout` and `keycloak__transaction_setup_timeout` for values that were hardcoded in the systemd unit and in `keycloak.conf`.
 * **role:selinux**: A policy module can be defined inline through the `content_te` subkey of `selinux__modules__*_var`, instead of pointing `src` at a directory on the Ansible controller.
 * **role:openvpn_server**: Add `openvpn_server__service_state` to start, stop, restart or reload the OpenVPN service independently of whether it is enabled at boot.
+* **role:valkey**: Add a role and playbook to install and configure Valkey, listening on TCP port 6379 on the loopback interfaces by default. Valkey is taken from the distribution repositories (EPEL on RHEL 8, AppStream on RHEL 9 and 10, the distribution's own repository on Debian 13 and Ubuntu 24.04 / 26.04), and the configuration template matching the installed version is deployed. Debian 12 and Ubuntu 22.04 ship no Valkey and are not supported.
+* **playbook:setup_icinga2_master, playbook:setup_mastodon, playbook:setup_moodle, playbook:setup_nextcloud**: These stacks install Valkey on RHEL 10 and Redis everywhere else, so they can be deployed on RHEL 10 again. Both servers speak the same protocol on the same port, so the applications are configured identically either way. Override `setup_*__skip_redis` / `setup_*__skip_valkey` (`setup_icinga2_master__redis__skip_role` / `setup_icinga2_master__valkey__skip_role`) to force a specific server or to run neither.
 * **role:files**: A file can opt out of the backup copy that is written before it is overwritten, via the `backup` subkey of `files__files__*_var`.
 * **role:collabora**: The `collabora:configure` tag deploys `coolwsd.xml` and the logrotate configuration without touching the packages.
 * **role:docker**: The address pools docker assigns container network subnets from (`default-address-pools`) can be configured.
@@ -54,6 +58,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+* **role:redis**: Redis also listens on the IPv6 loopback `[::1]:6379`, where it previously answered on `127.0.0.1` only, so clients that resolve `localhost` to `::1` are no longer refused. Hosts without an IPv6 loopback are unaffected: the address is marked optional, so Redis logs a warning and carries on instead of aborting.
 * **role:apache_httpd**: Restarting Apache takes about 5 seconds instead of 13 on a host that holds long-lived connections, such as a proxy for WebSockets, because systemd no longer waits out Apache's own shutdown escalation. Apache refuses new connections for the whole of that wait, so this shortens the outage. The hard stop leaks about three semaphores per restart (`ipcs -s`), which a reboot clears; raise `apache_httpd__systemd_timeout_stop_sec` to trade restart speed back for a longer graceful window.
 * **playbook:setup_librenms**: The skip variables of the playbook are all named after the playbook, `setup_librenms__skip_php` for example, instead of after the `librenms` role.
 * **playbook:setup_librenms**: The playbook no longer runs the `apps` role, since the `librenms` role installs `git` itself.

COMPATIBILITY.md

@@ -126,7 +126,7 @@ Which Ansible role is proven to run on which OS?
 | python                                |   x    |   x    |   x    |   x    |    x    |    (x)    |    (x)    |    (x)    | Windows                                      |
 | python_venv                           |   x    |   x    |   x    |   x    |    x    |    (x)    |    (x)    |    (x)    | Fedora 35                                    |
 | qemu_guest_agent                      |  (x)   |  (x)   |   x    |   x    |    x    |    (x)    |    (x)    |    (x)    |                                              |
-| redis                                 |   x    |   x    |   x    |   x    |   (x)   |    (x)    |    (x)    |    (x)    |                                              |
+| redis                                 |   x    |   x    |   x    |   x    |         |    (x)    |    (x)    |    (x)    | RHEL 10: no Redis, use the `valkey` role     |
 | repo_baseos                           |        |        |   x    |   x    |    x    |           |           |           |                                              |
 | repo_collabora                        |        |        |   x    |  (x)   |   (x)   |           |           |           |                                              |
 | repo_collabora_code                   |        |        |   x    |   x    |   (x)   |           |           |           |                                              |
@@ -170,6 +170,7 @@ Which Ansible role is proven to run on which OS?
 | trend_micro_v1es                      |        |        |   x    |   x    |    x    |           |     x     |           |                                              |
 | unattended_upgrades                   |  (x)   |  (x)   |        |        |         |    (x)    |    (x)    |    (x)    |                                              |
 | uptimerobot                           |        |        |        |        |         |           |           |           | controller-side, talks to UptimeRobot API    |
+| valkey                                |        |   x    |   x    |   x    |    x    |           |     x     |     x     | no Valkey in Deb 12 / Ubu 22.04              |
 | vsftpd                                |        |        |   x    |  (x)   |   (x)   |           |           |           |                                              |
 | wordpress                             |        |        |   x    |  (x)   |   (x)   |           |           |           |                                              |
 | yum_utils                             |        |        |   x    |   x    |    x    |           |           |           | Fedora 35                                    |

extensions/molecule/valkey/converge.yml

@@ -0,0 +1,2 @@
+- name: 'Converge valkey playbook'
+  ansible.builtin.import_playbook: 'linuxfabrik.lfops.valkey'

extensions/molecule/valkey/inventory/group_vars/systems_under_test.yml

@@ -0,0 +1,12 @@
+# Variables the playbook under test needs, applied to every system under test.
+#
+# Every value here deliberately differs from the role default, so verify.yml can
+# tell "the running server uses what the inventory asked for" apart from "the
+# running server happens to use the packaged default".
+valkey__conf_databases: 32
+valkey__conf_loglevel: 'verbose'
+valkey__conf_maxmemory: '128M'
+valkey__conf_maxmemory_policy: 'allkeys-lru'
+valkey__conf_requirepass: 'linuxfabrik'
+
+valkey__service_limit_nofile: 20480

extensions/molecule/valkey/inventory/hosts.yml

@@ -0,0 +1,23 @@
+# yamllint disable rule:empty-values
+
+# valkey targets 'lfops_valkey' (see playbooks/valkey.yml: hosts).
+#
+# Debian 12 and Ubuntu 22.04 are deliberately absent: neither ships Valkey in
+# any repository, so the role does not support them (see COMPATIBILITY.md).
+#
+# The remaining hosts each pull a different Valkey version from their
+# distribution repository (RHEL 8/9/10: 8.0, Debian 13: 8.1, Ubuntu 24.04: 7.2,
+# Ubuntu 26.04: 9.0), so this host list also covers every configuration
+# template the role ships.
+lfops_valkey:
+  children:
+    systems_under_test:
+
+systems_under_test:
+  hosts:
+    debian13-vm:
+    rocky8-vm:
+    rocky9-vm:
+    rocky10-vm:
+    ubuntu2404-vm:
+    ubuntu2604-vm:

extensions/molecule/valkey/molecule.yml

@@ -0,0 +1 @@
+# Molecule scenario marker