Release 1.1.0

CLAUDE.md

@@ -38,20 +38,23 @@ itential.iag5/
 │   ├── ansible-lint.yml           # CI: lint on push/PR to main
 │   └── publish_ansible_collection.yml  # CI: publish to Galaxy on release
 ├── docs/
-│   ├── reference_guide.md         # Full variable reference (100+ vars)
-│   └── verify_cert_README.md      # TLS verification guide
+│   ├── reference_guide.md              # Full variable reference (100+ vars)
+│   ├── certify.md                  # Post-deployment TLS verification guide
+│   └── verify.md           # Pre-flight environment verification guide
 ├── example_inventories/           # Five reference inventory files
 ├── playbooks/
 │   ├── site.yml                   # Meta playbook — imports all others in order
 │   ├── servers.yml
 │   ├── runners.yml
 │   ├── clients.yml
-│   └── verify_cert.yml
+│   ├── certify.yml            # Post-deployment TLS verification (standalone)
+│   └── verify.yml     # Pre-flight checks — run before install or upgrade
 ├── roles/
 │   ├── gateway/                   # Common variables only (no tasks)
 │   ├── gateway_client/            # IAG5 client install + configure
 │   ├── gateway_server/            # IAG5 server/runner install + configure
-│   └── verify_cert_common/        # Shared TLS verification task files
+│   ├── certify_common/        # Shared TLS verification task files
+│   └── verify_common/ # Shared pre-flight check task files
 └── scripts/
     └── changelog.py              # Generates CHANGELOG.md from git tags
 ```
@@ -76,16 +79,19 @@ Deploys server **or** runner depending on `gateway_application_mode`. Task execu
 3. `install_python.yml` — optional Python 3.12 install (controlled by `gateway_server_features_python`)
 4. `install_tofu.yml` — optional OpenTofu install (controlled by `gateway_server_features_opentofu`)
 5. `upload_certs.yml` — uploads TLS cert/key and CA cert
-6. `configure_gateway.yml` — renders `server.conf.j2` or `runner.conf.j2` to `/etc/gateway/gateway.conf`
+6. `configure_gateway.yml` — renders `server.conf.j2` or `runner.conf.j2` to `/etc/gateway/gateway.conf`; also renders `iagctl.service.j2` to `/usr/lib/systemd/system/iagctl.service` and `iagctl.env.j2` to `/etc/gateway/iagctl.env` (mode 0600) when `gateway_server_store_backend == 'dynamodb'` or proxy is enabled
 7. `configure_firewalld.yml` — opens ports in firewalld (optional)
-8. `verify_cert.yml` — live TLS handshake tests post-deployment
+8. `certify.yml` — live TLS handshake tests post-deployment
 
 Handler: `restart iagctl` — restarts the `iagctl` systemd service (4 retries, 5s delay,
 validates `ActiveState == "active"`).
 
 Defaults are split by domain: `install.yml`, `server.yml`, `store.yml`, `connect.yml`,
 `features.yml`, `registry.yml`, `pki.yml`, `secrets.yml`, `log.yml`, `runner.yml`,
-`common.yml`, `terminal.yml`.
+`common.yml`, `terminal.yml`, `specs.yml`.
+
+`specs.yml` defines minimum hardware requirements for servers and runners used by the
+`verify` pre-flight check.
 
 ### gateway\_client
 
@@ -95,19 +101,29 @@ Deploys the IAG5 CLI client. Task execution order:
 2. `install_gateway_client.yml` — creates user/dirs, downloads + unpacks tarball
 3. `upload_certs.yml` — uploads TLS material
 4. `configure_gateway_client.yml` — renders `gateway.conf.j2` to `~/.gateway.d/gateway.conf`
-5. `verify_cert.yml`
+5. `certify.yml`
 
 Defaults split by domain: `install.yml`, `server.yml`, `pki.yml`, `secrets.yml`, `log.yml`,
 `terminal.yml`.
 
-### verify\_cert\_common
+### certify\_common
+
+Provides shared task files (not called directly) for post-deployment TLS certification:
+
+- `certify_cluster_server_to_runner.yml`
+- `certify_cluster_client_to_server.yml`
+- `certify_connect_server_to_gwm.yml`
+- `summary.yml` (renders a Markdown report via `certify-report.md.j2`)
+
+### verify\_common
 
-Provides shared task files (not called directly) for TLS verification:
+Provides shared task files (not called directly) for pre-flight environment verification.
+All TLS tasks run `delegate_to: localhost` since cert files reside on the control node.
 
-- `verify_cert_cluster_server_to_runner.yml`
-- `verify_cert_cluster_client_to_server.yml`
-- `verify_cert_connect_server_to_gwm.yml`
-- `summary.yml` (renders a Markdown report via `verify-cert-report.md.j2`)
+- `verify-os.yml` — asserts RHEL/Rocky 8/9, x86\_64
+- `verify-specs.yml` — asserts CPU, RAM, and disk against documented minimums
+- `verify-tls-files.yml` — 14 checks on TLS source files (existence, PEM validity, expiry,
+  cert/key match, CA chain, EKU, SANs)
 
 ## Running the Collection
 
@@ -165,7 +181,7 @@ ansible-playbook itential.iag5.runners  -i inventories/production
 ansible-playbook itential.iag5.clients  -i inventories/production
 
 # Post-deployment TLS verification only
-ansible-playbook itential.iag5.verify_cert -i inventories/production
+ansible-playbook itential.iag5.certify -i inventories/production
 ```
 
 ### Ansible Tags
@@ -177,7 +193,7 @@ Tasks are tagged for selective execution:
 | `install` | Package download and installation |
 | `configure` | Configuration file rendering |
 | `upload_certs` | TLS certificate upload |
-| `verify_cert` | Post-deployment TLS verification |
+| `certify` | Post-deployment TLS verification |
 
 ```bash
 ansible-playbook itential.iag5.site -i inventories/production --tags configure
@@ -243,6 +259,10 @@ The full variable reference (100+ variables with types, defaults, and descriptio
 - `gateway_server_features_python` — install Python (default: `false`)
 - `gateway_server_features_opentofu` — install OpenTofu (default: `false`)
 - `gateway_application_mode` — set by playbook: `server` or `runner`
+- `gateway_server_connect_proxy_enabled` — enable outbound proxy for Gateway Manager connection (default: `false`); always writes `GATEWAY_CONNECT_PROXY_*` vars to `iagctl.env`
+- `gateway_server_connect_proxy_url` — proxy URL; required when proxy is enabled
+- `gateway_server_connect_proxy_username` / `gateway_server_connect_proxy_password` — optional proxy credentials
+- `gateway_server_service_env_file` — path to the systemd environment file (default: `/etc/gateway/iagctl.env`)
 
 ## Key Conventions
 
@@ -255,3 +275,6 @@ The full variable reference (100+ variables with types, defaults, and descriptio
 - **Backup on configure:** All `ansible.builtin.template` tasks set `backup: true`.
 - **Idempotent restarts:** The handler validates `ActiveState == "active"` before declaring
   success; it retries up to 4 times with a 5-second delay.
+- **Sensitive env vars in env file:** DynamoDB credentials and proxy credentials are written to
+  `/etc/gateway/iagctl.env` (mode 0600) and loaded via `EnvironmentFile=` in the systemd unit,
+  keeping secrets out of the unit file and `systemctl show` output.

README.md

@@ -27,6 +27,9 @@
         1. [Clients Playbook](#clients-playbook)
         2. [Servers Playbook](#servers-playbook)
         3. [Runners Playbook](#runners-playbook)
+        4. [Verify Environment Playbook](#verify-playbook)
+        5. [Certify IAG5 Playbook](#certify-iag5-playbook)
+        6. [TLS Certification Playbook](#tls-certification-playbook)
 6. [Sample Inventories](#sample-inventories)
     1. [All-in-one Single Node Inventory](#all-in-one-single-node-inventory)
     2. [All-in-one Active/Standby High Availability Inventory](#all-in-one-activestandby-high-availability-inventory)
@@ -422,6 +425,19 @@ all:
           - <IAGCTL-TARBALL>
 ```
 
+### Verify the Environment
+
+Before running the installation, run the pre-flight verification playbook to confirm that all
+target nodes meet OS, hardware, and TLS requirements:
+
+```bash
+cd <WORKING-DIR>
+ansible-playbook itential.iag5.verify -i inventories/<env>
+```
+
+All checks must pass before proceeding. See the [verify guide](docs/verify.md)
+for a full description of checks and how to interpret failures.
+
 ### Run the IAG5 Site Playbook
 
 Navigate to the working directory and execute the following run command.
@@ -469,6 +485,80 @@ cd <WORKING-DIR>
 ansible-playbook itential.iag5.runners -i inventories/dev
 ```
 
+#### Verify Environment Playbook
+
+Verifies OS, hardware, and TLS file requirements across all node types before installation or
+upgrade. Can be run at any time — does not require IAG5 to be installed.
+
+```bash
+cd <WORKING-DIR>
+ansible-playbook itential.iag5.verify -i inventories/dev
+```
+
+See the [verify guide](docs/verify.md) for full details.
+
+#### Certify IAG5 Playbook
+
+Runs a full post-deployment certification of the IAG5 installation. Run this playbook manually after
+a deployment completes. It performs two certifications in sequence per node:
+
+1. **Installation certification** — forensic, read-only checks covering service state, config file
+   properties, TLS file existence and certificate metadata, runtime versions, host information, and
+   network connectivity (server→runner TCP, server→GWM TCP).
+2. **TLS certification** — deep validation covering certificate chain, cert/key matching, SAN
+   validation, mTLS enforcement, proxy exclusion checks, and live TLS handshake tests.
+
+A markdown report is generated per node and fetched to `./certify_reports/` on the control node.
+
+```bash
+cd <WORKING-DIR>
+ansible-playbook itential.iag5.certify -i inventories/dev
+```
+
+##### Tag Reference
+
+Each certification can be run independently using tags:
+
+| Tag | What runs |
+|-----|-----------|
+| `certify-iag5` | Both installation + TLS certification (default) |
+| `certify-install` | Installation certification only |
+| `certify` | TLS certification only |
+
+```bash
+# Installation certification only
+ansible-playbook itential.iag5.certify -i inventories/dev --tags certify-install
+
+# TLS certification only
+ansible-playbook itential.iag5.certify -i inventories/dev --tags certify
+```
+
+##### Report Output
+
+Reports are fetched to `./certify_reports/` relative to the directory where `ansible-playbook` is
+run. Two report files are produced per node:
+
+| Report | Remote path | Control node filename |
+|--------|-------------|----------------------|
+| Installation | `/tmp/certify-iag5-<node_type>-report-<hostname>.md` | `certify-iag5-<node_type>-report-<hostname>.md` |
+| TLS | `/tmp/certify-tls-<hostname>.md` | `certify-tls-<hostname>.md` |
+
+See the [certify guide](docs/certify-tls.md) for a full description of all checks and how to interpret
+results.
+
+#### TLS Certification Playbook
+
+Runs deep TLS certificate validation across all node types without the installation forensics.
+Validates certificate chains, cert/key matching, SANs, mTLS enforcement, and live handshake tests.
+Can be run standalone at any time after deployment.
+
+```bash
+cd <WORKING-DIR>
+ansible-playbook itential.iag5.certify-tls -i inventories/dev
+```
+
+See the [certify guide](docs/certify-tls.md) for full details.
+
 ## Sample Inventories
 
 Below are simplified sample host files that describe the basic configurations to produce the