enroll/debian/changelog

enroll (0.4.2) unstable; urgency=medium

 * Support `--remote-ssh-config [path-to-ssh-config]` as an argument in case extra params are required beyond `--remote-port` or `--remote-user`. Note: `--remote-host` must still be set, but it can be an 'alias' represented by the 'Host' value in the ssh config.

 -- Miguel Jacq <mig@mig5.net>  Tue, 13 Jan 2026 21:55:00 +1100

enroll (0.4.1) unstable; urgency=medium
 * Add interactive output when 'enroll diff --enforce' is invoking Ansible.

 -- Miguel Jacq <mig@mig5.net>  Sun, 11 Jan 2026 10:00:00 +1100

enroll (0.4.0) unstable; urgency=medium
 * Introduce `enroll validate` - a tool to validate a harvest against the state schema, or check for missing or orphaned obsolete artifacts in a harvest.
 * Attempt to generate Jinja2 templates of systemd unit files and Postfix main.cf (now that JinjaTurtle supports it)
 * Update pynacl dependency to resolve CVE-2025-69277
 * Add `--exclude-path` to `enroll diff` command, so that you can ignore certain churn from the diff (stuff you still wanted to harvest as a baseline but don't care if it changes day to day)
 * Add `--ignore-package-versions` to `enroll diff` command, to optionally ignore package upgrades (e.g due to patching) from the diff.
 * Add tags to the playbook for each role, to allow easier targeting of specific roles during play later.
 * Add `--enforce` mode to `enroll diff`. If there is diff detected between the two harvests, and it can enforce restoring the state from the older harvest, it will manifest the state and apply it with ansible.
Only the specific roles that had diffed will be applied (via the new tags capability)

 -- Miguel Jacq <mig@mig5.net>  Sat, 10 Jan 2026 10:30:00 +1100

enroll (0.3.0) unstable; urgency=medium

  * Introduce `enroll explain` - a tool to analyze and explain what's in (or not in) a harvest and why.
  * Centralise the cron and logrotate stuff into their respective roles, we had a bit of duplication between roles based on harvest discovery.
  * Capture other files in the user's home directory such as `.bashrc`, `.bash_aliases`, `.profile`, if these files differ from the `/etc/skel` defaults
  * Ignore files that end with a tilde or - (probably backup files generated by editors or shadow file changes)
  * Manage certain symlinks e.g for apache2/nginx sites-enabled and so on

 -- Miguel Jacq <mig@mig5.net>  Mon, 05 Jan 2026 17:00:00 +1100

enroll (0.2.3) unstable; urgency=medium

  * Introduce --ask-become-pass or -K to support password-required sudo on remote hosts, just like Ansible. It will also fall back to this prompt if a password is required but the arg wasn't passed in.

 -- Miguel Jacq <mig@mig5.net>  Sun, 04 Jan 2026 20:38:00 +1100

enroll (0.2.2) unstable; urgency=medium

  * Fix stat() of parent directory so that we set directory perms correct on --include paths.
  * Set pty for remote calls when sudo is required, to help systems with limits on sudo without pty

 -- Miguel Jacq <mig@mig5.net>  Sat, 03 Jan 2026 09:56:00 +1100

enroll (0.2.1) unstable; urgency=medium

  * Don't accidentally add extra_paths role to usr_local_custom list, resulting in extra_paths appearing twice in manifested playbook
  * Ensure directories in the tree of anything included with --include are defined in the state and manifest so we make dirs before we try to create files

 -- Miguel Jacq <mig@mig5.net>  Fri, 02 Jan 2026 21:30:00 +1100

enroll (0.2.0) unstable; urgency=medium

  * Add version CLI arg
  * Add ability to enroll RH-style systems (DNF5/DNF/RPM)
  * Refactor harvest state to track package versions

 -- Miguel Jacq <mig@mig5.net>  Mon, 29 Dec 2025 17:30:00 +1100

enroll (0.1.7) unstable; urgency=medium
  * Fix an attribution bug for certain files ending up in the wrong package/role.

 -- Miguel Jacq <mig@mig5.net>  Sun, 28 Dec 2025 18:30:00 +1100

enroll (0.1.6) unstable; urgency=medium

  * DRY up some code logic
  * More test coverage

 -- Miguel Jacq <mig@mig5.net>  Sun, 28 Dec 2025 15:30:00 +1100

enroll (0.1.5) unstable; urgency=medium

  * Consolidate logrotate and cron files into their main service/package roles if they exist.
  * Standardise on MAX_FILES_CAP in one place
  * Manage apt stuff in its own role, not in etc_custom

 -- Miguel Jacq <mig@mig5.net>  Sun, 28 Dec 2025 10:00:00 +1100

enroll (0.1.4) unstable; urgency=medium

  * Attempt to capture more stuff from /etc that might not be attributable to a specific package. This includes common singletons and systemd timers
  * Avoid duplicate apt data in package-specific roles.

 -- Miguel Jacq <mig@mig5.net>  Sat, 27 Dec 2025 19:00:00 +1100

enroll (0.1.3) unstable; urgency=medium

  * Allow the user to add extra paths to harvest, or paths to ignore, using `--exclude-path` and `--include-path`
    arguments.
  * Add support for an enroll.ini config file to store arguments per subcommand, to avoid having to remember
    them all for repetitive executions.

 -- Miguel Jacq <mig@mig5.net>  Sat, 20 Dec 2025 18:24:00 +1100

enroll (0.1.2) unstable; urgency=medium

  * Include files from `/usr/local/bin` and `/usr/local/etc` in harvest (assuming they aren't binaries or
    symlinks) and store in `usr_local_custom` role, similar to `etc_custom`.

 -- Miguel Jacq <mig@mig5.net>  Thu, 18 Dec 2025 17:07:00 +1100

enroll (0.1.1) unstable; urgency=medium

  * Add `diff` subcommand which can compare two harvests and send email or webhook notifications in different
    formats.

 -- Miguel Jacq <mig@mig5.net>  Thu, 18 Dec 2025 15:00:00 +1100

enroll (0.1.0) unstable; urgency=medium

  * Add remote mode for harvesting a remote machine via a local workstation (no need to install enroll remotely)
    Optionally use `--no-sudo` if you don't want the remote user to have passwordless sudo when conducting the
    harvest, albeit you'll end up with less useful data (same as if running `enroll harvest` on a machine without
    sudo)
  * Add `--dangerous` flag to capture even sensitive data (use at your own risk!)
  * Add `--sops` flag which makes the harvest and the manifest 'out' data encrypted as a single SOPS data file.
    This would make `--dangerous` a little bit safer, if your intention is just to store the Ansible manifest
    in git or somewhere similar for disaster-recovery purposes (e.g encrypted at rest for safe-keeping).
  * Do a better job at capturing other config files in `/etc/<package>/` even if that package doesn't normally
    ship or manage those files.
  * Don't collect files ending in `.log`

 -- Miguel Jacq <mig@mig5.net>  Wed, 17 Dec 2025 18:00:00 +1100

enroll (0.0.5) unstable; urgency=medium

  * Use JinjaTurtle to generate dynamic template/inventory if it's on the PATH
  * Support --fqdn flag for site-specific inventory and an inventory hosts file
  * Generate an ansible.cfg if not present, to support host_vars plugin and other params
  * Be more permissive with files that we previously thought contained secrets (ignore commented lines)

 -- Miguel Jacq <mig@mig5.net>  Tue, 16 Dec 2025 12:00:00 +1100

enroll (0.0.4) unstable; urgency=medium

  * Fix dash package detection issue
  * Reorder which roles install first

 -- Miguel Jacq <mig@mig5.net>  Mon, 15 Dec 2025 17:00:00 +1100

enroll (0.0.3) unstable; urgency=medium

  * Initial package

 -- Miguel Jacq <mig@mig5.net>  Mon, 15 Dec 2025 12:00:00 +1100