wip: multisite application feature with stateless and statefull application traits

Reviewed-on: #114

.gitattributes

@@ -2,3 +2,5 @@ bootx64.efi filter=lfs diff=lfs merge=lfs -text
 grubx64.efi filter=lfs diff=lfs merge=lfs -text
 initrd filter=lfs diff=lfs merge=lfs -text
 linux filter=lfs diff=lfs merge=lfs -text
+data/okd/bin/* filter=lfs diff=lfs merge=lfs -text
+data/okd/installer_image/* filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -3,6 +3,7 @@ private_repos/
 
 ### Harmony ###
 harmony.log
+data/okd/installation_files*
 
 ### Helm ###
 # Chart dependencies

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "examples/try_rust_webapp/tryrust.org"]
+	path = examples/try_rust_webapp/tryrust.org
+	url = https://github.com/rust-dd/tryrust.org.git

.sqlx/query-2ea29df2326f7c84bd4100ad510a3fd4878dc2e217dc83f9bf45a402dfd62a91.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT host_id FROM host_role_mapping WHERE role = ?",
+  "describe": {
+    "columns": [
+      {
+        "name": "host_id",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "2ea29df2326f7c84bd4100ad510a3fd4878dc2e217dc83f9bf45a402dfd62a91"
+}

.sqlx/query-8d247918eca10a88b784ee353db090c94a222115c543231f2140cba27bd0f067.json

@@ -0,0 +1,32 @@
+{
+  "db_name": "SQLite",
+  "query": "\n        SELECT\n            p1.id,\n            p1.version_id,\n            p1.data as \"data: Json<PhysicalHost>\"\n        FROM\n            physical_hosts p1\n        INNER JOIN (\n            SELECT\n                id,\n                MAX(version_id) AS max_version\n            FROM\n                physical_hosts\n            GROUP BY\n                id\n        ) p2 ON p1.id = p2.id AND p1.version_id = p2.max_version\n        ",
+  "describe": {
+    "columns": [
+      {
+        "name": "id",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "version_id",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "data: Json<PhysicalHost>",
+        "ordinal": 2,
+        "type_info": "Blob"
+      }
+    ],
+    "parameters": {
+      "Right": 0
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "8d247918eca10a88b784ee353db090c94a222115c543231f2140cba27bd0f067"
+}

.sqlx/query-934035c7ca6e064815393e4e049a7934b0a7fac04a4fe4b2a354f0443d630990.json

@@ -0,0 +1,32 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT id, version_id, data as \"data: Json<PhysicalHost>\" FROM physical_hosts WHERE id = ? ORDER BY version_id DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "name": "id",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "version_id",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "data: Json<PhysicalHost>",
+        "ordinal": 2,
+        "type_info": "Null"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "934035c7ca6e064815393e4e049a7934b0a7fac04a4fe4b2a354f0443d630990"
+}

.sqlx/query-df7a7c9cfdd0972e2e0ce7ea444ba8bc9d708a4fb89d5593a0be2bbebde62aff.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n        INSERT INTO host_role_mapping (host_id, role)\n        VALUES (?, ?)\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "df7a7c9cfdd0972e2e0ce7ea444ba8bc9d708a4fb89d5593a0be2bbebde62aff"
+}

.sqlx/query-f10f615ee42129ffa293e46f2f893d65a237d31d24b74a29c6a8d8420d255ab8.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "INSERT INTO physical_hosts (id, version_id, data) VALUES (?, ?, ?)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 3
+    },
+    "nullable": []
+  },
+  "hash": "f10f615ee42129ffa293e46f2f893d65a237d31d24b74a29c6a8d8420d255ab8"
+}

Cargo.toml

@@ -36,7 +36,7 @@ tokio = { version = "1.40", features = [
 cidr = { features = ["serde"], version = "0.2" }
 russh = "0.45"
 russh-keys = "0.45"
-rand = "0.8"
+rand = "0.9"
 url = "2.5"
 kube = { version = "1.1.0", features = [
   "config",
@@ -65,3 +65,6 @@ directories = "6.0.0"
 thiserror = "2.0.14"
 serde = { version = "1.0.209", features = ["derive", "rc"] }
 serde_json = "1.0.127"
+askama = "0.14"
+sqlx = { version = "0.8", features = ["runtime-tokio", "sqlite" ] }
+reqwest = { version = "0.12", features = ["blocking", "stream", "rustls-tls", "http2", "json"], default-features = false }

Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/rust:1.87.0 AS build
+FROM docker.io/rust:1.89.0 AS build
 
 WORKDIR /app
 
@@ -6,7 +6,7 @@ COPY . .
 
 RUN cargo build --release --bin harmony_composer
 
-FROM docker.io/rust:1.87.0
+FROM docker.io/rust:1.89.0
 
 WORKDIR /app
 

adr/agent_discovery/mdns/Cargo.toml

@@ -13,3 +13,5 @@ dmidecode = "0.2" # For getting the motherboard ID on the agent
 log.workspace=true
 env_logger.workspace=true
 clap = { version = "4.5.46", features = ["derive"] }
+get_if_addrs = "0.5.3"
+local-ip-address = "0.6.5"

adr/agent_discovery/mdns/src/advertise.rs

@@ -10,7 +10,6 @@ use crate::SERVICE_TYPE;
 const SERVICE_PORT: u16 = 43210; // A port for the service. It needs one, even if unused.
 
 pub async fn advertise() {
-
     info!("Starting Harmony Agent...");
 
     // Get a unique ID for this machine.
@@ -29,11 +28,13 @@ pub async fn advertise() {
 
     // Create the service information.
     // The instance name should be unique on the network.
+    let local_ip = local_ip_address::local_ip().unwrap();
     let service_info = ServiceInfo::new(
         SERVICE_TYPE,
         &instance_name,
         "harmony-host.local.", // A hostname for the service
-        (), // No specific IP addresses, let the daemon figure it out
+        local_ip,
+        // "0.0.0.0",
         SERVICE_PORT,
         Some(properties),
     )
@@ -43,9 +44,16 @@ pub async fn advertise() {
     mdns.register(service_info)
         .expect("Failed to register service");
 
-    info!("Service '{}' registered and now being advertised.", instance_name);
+    info!(
+        "Service '{}' registered and now being advertised.",
+        instance_name
+    );
     info!("Agent is running. Press Ctrl+C to exit.");
 
+    for iface in get_if_addrs::get_if_addrs().unwrap() {
+        println!("{:#?}", iface);
+    }
+
     // Keep the agent running indefinitely.
     tokio::signal::ctrl_c().await.unwrap();
     info!("Shutting down agent.");

adr/agent_discovery/mdns/src/discover.rs

@@ -1,4 +1,3 @@
-use log::debug;
 use mdns_sd::{ServiceDaemon, ServiceEvent};
 
 use crate::SERVICE_TYPE;
@@ -74,7 +73,7 @@ pub async fn discover() {
     // }
 }
 
-async fn discover_example() {
+async fn _discover_example() {
     use mdns_sd::{ServiceDaemon, ServiceEvent};
 
     // Create a daemon

data/okd/installer_image/scos-live-initramfs.x86_64.img

@@ -0,0 +1 @@
+scos-9.0.20250510-0-live-initramfs.x86_64.img

data/okd/installer_image/scos-live-kernel.x86_64

@@ -0,0 +1 @@
+scos-9.0.20250510-0-live-kernel.x86_64

data/okd/installer_image/scos-live-rootfs.x86_64.img

@@ -0,0 +1 @@
+scos-9.0.20250510-0-live-rootfs.x86_64.img

demos/cncf-k8s-quebec-meetup-september-2025/storyline.md

@@ -0,0 +1,132 @@
+# Harmony, Orchestrateur d'infrastructure open-source
+
+**Target Duration:** 25 minutes\
+**Tone:** Friendly, expert-to-expert, inspiring.
+
+---
+
+#### **Slide 1: Title Slide**
+
+- **Visual:** Clean and simple. Your company logo (NationTech) and the Harmony logo.
+
+---
+
+#### **Slide 2: The YAML Labyrinth**
+
+**Goal:** Get every head in the room nodding in agreement. Start with their world, not yours.
+
+- **Visual:**
+  - Option A: "The Pull Request from Hell". A screenshot of a GitHub pull request for a seemingly minor change that touches dozens of YAML files across multiple directories. A sea of red and green diffs that is visually overwhelming.
+  - Option B: A complex flowchart connecting dozens of logos: Terraform, Ansible, K8s, Helm, etc.
+- **Narration:**\
+  [...ADD SOMETHING FOR INTRODUCTION...]\
+  "We love the power that tools like Kubernetes and the CNCF landscape have given us. But let's be honest... when did our infrastructure code start looking like _this_?"\
+  "We have GitOps, which is great. But it often means we're managing this fragile cathedral of YAML, Helm charts, and brittle scripts. We spend more time debugging indentation and tracing variables than we do building truly resilient systems."
+
+---
+
+#### **Slide 3: The Real Cost of Infrastructure**
+
+- **Visual:** "The Jenga Tower of Tools". A tall, precarious Jenga tower where each block is the logo of a different tool (Terraform, K8s, Helm, Ansible, Prometheus, ArgoCD, etc.). One block near the bottom is being nervously pulled out.
+- **Narration:**
+  "The real cost isn't just complexity; it's the constant need to choose, learn, integrate, and operate a dozen different tools, each with its own syntax and failure modes. It's the nagging fear that a tiny typo in a config file could bring everything down. Click-ops isn't the answer, but the current state of IaC feels like we've traded one problem for another."
+
+---
+
+#### **Slide 4: The Broken Promise of "Code"**
+
+**Goal:** Introduce the core idea before introducing the product. This makes the solution feel inevitable.
+
+- **(Initial Visual):** A two-panel slide.
+  - **Left Panel Title: "The Plan"** - A terminal showing a green, successful `terraform plan` output.
+  - **Right Panel Title: "The Reality"** - The _next_ screen in the terminal, showing the `terraform apply` failing with a cascade of red error text.
+- **Narration:**
+  "We call our discipline **Infrastructure as Code**. And we've all been here. Our 'compiler' is a `terraform plan` that says everything looks perfect. We get the green light."
+  (Pause for a beat)
+  "And then we `apply`, and reality hits. It fails halfway through, at runtime, when it's most expensive and painful to fix."
+
+**(Click to transition the slide)**
+
+- **(New Visual):** The entire slide is replaced by a clean screenshot of a code editor (like nvim 😉) showing Harmony's Rust DSL. A red squiggly line is under a config line. The error message is clear in the "Problems" panel: `error: Incompatible deployment. Production target 'gcp-prod-cluster' requires a StorageClass with 'snapshots' capability, but 'standard-sc' does not provide it.`
+- **Narration (continued):**
+  "In software development, we solved these problems years ago. We don't accept 'it compiled, but crashed on startup'. We have real tools, type systems, compilers, test frameworks, and IDEs that catch our mistakes before they ever reach production. **So, what if we could treat our entire infrastructure... like a modern, compiled application?**"
+  "What if your infrastructure code could get compile-time checks, straight into the editor... instead of runtime panics and failures at 3 AM in production?"
+
+---
+
+#### **Slide 5: Introducing Harmony**
+
+**Goal:** Introduce Harmony as the answer to the "What If?" question.
+
+- **Visual:** The Harmony logo, large and centered.
+- **Tagline:** `Infrastructure in type-safe Rust. No YAML required.`
+- **Narration:**
+  "This is Harmony. It's an open-source orchestrator that lets you define your entire stack — from a dev laptop to a multi-site bare-metal cluster—in a single, type-safe Rust codebase."
+
+---
+
+#### **Slide 6: Before & After**
+
+- **Visual:** A side-by-side comparison. Left side: A screen full of complex, nested YAML. Right side: 10-15 lines of clean, readable Harmony Rust DSL that accomplishes the same thing.
+- **Narration:**
+  "This is the difference. On the left, the fragile world of strings and templates. On the right, a portable, verifiable program that describes your apps, your infra, and your operations. We unify scaffolding, provisioning, and Day-2 ops, all verified by the Rust compiler. But enough slides... let's see it in action."
+
+---
+
+#### **Slide 7: Live Demo: Zero to Monitored App**
+
+**Goal:** Show, don't just tell. Make it look effortless. This is where you build the "dream."
+
+- **Visual:** Your terminal/IDE, ready to go.
+- **Narration Guide:**
+  "Okay, for this demo, we're going to take a standard web app from GitHub. Nothing special about it."
+  _(Show the repo)_
+  "Now, let's bring it into Harmony. This is the entire definition we need to describe the application and its needs."
+  _(Show the Rust DSL)_
+  "First, let's run it locally on k3d. The exact same definition for dev as for prod."
+  _(Deploy locally, show it works)_
+  "Cool. But a real app needs monitoring. In Harmony, that's just adding a feature to our code."
+  _(Uncomment one line: `.with_feature(Monitoring)` and redeploy)_
+  "And just like that, we have a fully configured Prometheus and Grafana stack, scraping our app. No YAML, no extra config."
+  "Finally, let's push this to our production staging cluster. We just change the target and specify our multi-site Ceph storage."
+  _(Deploy to the remote cluster)_
+  "And there it is. We've gone from a simple web app to a monitored, enterprise-grade service in minutes."
+
+---
+
+#### **Slide 8: Live Demo: Embracing Chaos**
+
+**Goal:** Prove the "predictable" and "resilient" claims in the most dramatic way possible.
+
+- **Visual:** A slide showing a map or diagram of your distributed infrastructure (the different data centers). Then switch back to your terminal.
+- **Narration Guide:**
+  "This is great when things are sunny. But production is chaos. So... let's break things. On purpose."
+  "First, a network failure." _(Kill a switch/link, show app is still up)_
+  "Now, let's power off a storage server." _(Force off a server, show Ceph healing and the app is unaffected)_
+  "How about a control plane node?" _(Force off a k8s control plane, show the cluster is still running)_
+  "Okay, for the grand finale. What if we have a cascading failure? I'm going to kill _another_ storage server. This should cause a total failure in this data center."
+  _(Force off the second server, narrate what's happening)_
+  "And there it is... Ceph has lost quorum in this site... and Harmony has automatically failed everything over to our other datacenter. The app is still running."
+
+---
+
+#### **Slide 9: The New Reality**
+
+**Goal:** Summarize the dream and tell the audience what you want them to do.
+
+- **Visual:** The clean, simple Harmony Rust DSL code from Slide 6. A summary of what was just accomplished is listed next to it: `✓ GitHub to Prod in minutes`, `✓ Type-Safe Validation`, `✓ Built-in Monitoring`, `✓ Automated Multi-Site Failover`.
+- **Narration:**
+  "So, in just a few minutes, we went from a simple web app to a multi-site, monitored, and chaos-proof production deployment. We did it with a small amount of code that is easy to read, easy to verify, and completely portable. This is our vision: to offload the complexity, and make infrastructure simple, predictable, and even fun again."
+
+---
+
+#### **Slide 10: Join Us**
+
+- **Visual:** A clean, final slide with QR codes and links.
+  - GitHub Repo (`github.com/nation-tech/harmony`)
+  - Website (`harmony.sh` or similar)
+  - Your contact info (`jg@nation.tech` / LinkedIn / Twitter)
+- **Narration:**
+  "Harmony is open-source, AGPLv3. We believe this is the future, but we're just getting started. We know this crowd has great infrastructure minds out there, and we need your feedback. Please, check out the project on GitHub. Star it if you like what you see. Tell us what's missing. Let's build this future together. Thank you."
+
+**(Open for Q&A)**

docs/OKD_Host_preparation.md

@@ -0,0 +1,8 @@
+## Bios settings
+
+1. CSM : Disabled (compatibility support to boot gpt formatted drives)
+2. Secure boot : disabled
+3. Boot order :
+    1. Local Hard drive
+    2. PXE IPv4
+4. System clock, make sure it is adjusted, otherwise you will get invalid certificates error

examples/application_monitoring_with_tenant/Cargo.toml

@@ -7,8 +7,9 @@ license.workspace = true
 
 [dependencies]
 env_logger.workspace = true
-harmony = { version = "0.1.0", path = "../../harmony" }
-harmony_cli = { version = "0.1.0", path = "../../harmony_cli" }
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
 logging = "0.1.0"
 tokio.workspace = true
 url.workspace = true

examples/application_monitoring_with_tenant/src/main.rs

@@ -1,15 +1,16 @@
 use std::{path::PathBuf, str::FromStr, sync::Arc};
 
 use harmony::{
-    data::Id,
     inventory::Inventory,
     modules::{
         application::{ApplicationScore, RustWebFramework, RustWebapp, features::Monitoring},
         monitoring::alert_channel::webhook_receiver::WebhookReceiver,
         tenant::TenantScore,
     },
-    topology::{K8sAnywhereTopology, Url, tenant::TenantConfig},
+    topology::{K8sAnywhereTopology, tenant::TenantConfig},
 };
+use harmony_types::id::Id;
+use harmony_types::net::Url;
 
 #[tokio::main]
 async fn main() {
@@ -29,6 +30,7 @@ async fn main() {
         domain: Url::Url(url::Url::parse("https://rustapp.harmony.example.com").unwrap()),
         project_root: PathBuf::from("./examples/rust/webapp"),
         framework: Some(RustWebFramework::Leptos),
+        service_port: 3000,
     });
 
     let webhook_receiver = WebhookReceiver {

examples/cli/src/main.rs

@@ -2,7 +2,7 @@ use harmony::{
     inventory::Inventory,
     modules::{
         dummy::{ErrorScore, PanicScore, SuccessScore},
-        inventory::DiscoverInventoryAgentScore,
+        inventory::LaunchDiscoverInventoryAgentScore,
     },
     topology::LocalhostTopology,
 };
@@ -16,7 +16,9 @@ async fn main() {
             Box::new(SuccessScore {}),
             Box::new(ErrorScore {}),
             Box::new(PanicScore {}),
-            Box::new(DiscoverInventoryAgentScore { discovery_timeout: Some(10) }),
+            Box::new(LaunchDiscoverInventoryAgentScore {
+                discovery_timeout: Some(10),
+            }),
         ],
         None,
     )

examples/lamp/src/main.rs

@@ -2,8 +2,9 @@ use harmony::{
     data::Version,
     inventory::Inventory,
     modules::lamp::{LAMPConfig, LAMPScore},
-    topology::{K8sAnywhereTopology, Url},
+    topology::K8sAnywhereTopology,
 };
+use harmony_types::net::Url;
 
 #[tokio::main]
 async fn main() {

examples/monitoring/Cargo.toml

@@ -6,8 +6,9 @@ readme.workspace = true
 license.workspace = true
 
 [dependencies]
-harmony = { version = "0.1.0", path = "../../harmony" }
-harmony_cli = { version = "0.1.0", path = "../../harmony_cli" }
-harmony_macros = { version = "0.1.0", path = "../../harmony_macros" }
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_macros = { path = "../../harmony_macros" }
+harmony_types = { path = "../../harmony_types" }
 tokio.workspace = true
 url.workspace = true

examples/monitoring/src/main.rs

@@ -22,8 +22,9 @@ use harmony::{
             k8s::pvc::high_pvc_fill_rate_over_two_days,
         },
     },
-    topology::{K8sAnywhereTopology, Url},
+    topology::K8sAnywhereTopology,
 };
+use harmony_types::net::Url;
 
 #[tokio::main]
 async fn main() {

examples/monitoring_with_tenant/Cargo.toml

@@ -7,7 +7,8 @@ license.workspace = true
 
 [dependencies]
 cidr.workspace = true
-harmony = { version = "0.1.0", path = "../../harmony" }
-harmony_cli = { version = "0.1.0", path = "../../harmony_cli" }
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
 tokio.workspace = true
 url.workspace = true

examples/monitoring_with_tenant/src/main.rs

@@ -1,7 +1,6 @@
 use std::{collections::HashMap, str::FromStr};
 
 use harmony::{
-    data::Id,
     inventory::Inventory,
     modules::{
         monitoring::{
@@ -19,10 +18,12 @@ use harmony::{
         tenant::TenantScore,
     },
     topology::{
-        K8sAnywhereTopology, Url,
+        K8sAnywhereTopology,
         tenant::{ResourceLimits, TenantConfig, TenantNetworkPolicy},
     },
 };
+use harmony_types::id::Id;
+use harmony_types::net::Url;
 
 #[tokio::main]
 async fn main() {

examples/nanodc/Cargo.toml

@@ -13,6 +13,7 @@ harmony_types = { path = "../../harmony_types" }
 cidr = { workspace = true }
 tokio = { workspace = true }
 harmony_macros = { path = "../../harmony_macros" }
+harmony_secret = { path = "../../harmony_secret" }
 log = { workspace = true }
 env_logger = { workspace = true }
 url = { workspace = true }

examples/nanodc/src/main.rs

@@ -5,22 +5,25 @@ use std::{
 
 use cidr::Ipv4Cidr;
 use harmony::{
-    hardware::{FirewallGroup, HostCategory, Location, PhysicalHost, SwitchGroup},
+    config::secret::SshKeyPair,
+    data::{FileContent, FilePath},
+    hardware::{HostCategory, Location, PhysicalHost, SwitchGroup},
     infra::opnsense::OPNSenseManagementInterface,
     inventory::Inventory,
     modules::{
         http::StaticFilesHttpScore,
-        ipxe::IpxeScore,
         okd::{
             bootstrap_dhcp::OKDBootstrapDhcpScore,
             bootstrap_load_balancer::OKDBootstrapLoadBalancerScore, dhcp::OKDDhcpScore,
-            dns::OKDDnsScore,
+            dns::OKDDnsScore, ipxe::OKDIpxeScore,
         },
         tftp::TftpScore,
     },
-    topology::{LogicalHost, UnmanagedRouter, Url},
+    topology::{LogicalHost, UnmanagedRouter},
 };
 use harmony_macros::{ip, mac_address};
+use harmony_secret::SecretManager;
+use harmony_types::net::Url;
 
 #[tokio::main]
 async fn main() {
@@ -86,8 +89,7 @@ async fn main() {
     let inventory = Inventory {
         location: Location::new("I am mobile".to_string(), "earth".to_string()),
         switch: SwitchGroup::from([]),
-        firewall: FirewallGroup::from([PhysicalHost::empty(HostCategory::Firewall)
-            .management(Arc::new(OPNSenseManagementInterface::new()))]),
+        firewall_mgmt: Box::new(OPNSenseManagementInterface::new()),
         storage_host: vec![],
         worker_host: vec![
             PhysicalHost::empty(HostCategory::Server)
@@ -124,14 +126,28 @@ async fn main() {
     let load_balancer_score =
         harmony::modules::okd::load_balancer::OKDLoadBalancerScore::new(&topology);
 
+    let ssh_key = SecretManager::get_or_prompt::<SshKeyPair>().await.unwrap();
+
     let tftp_score = TftpScore::new(Url::LocalFolder("./data/watchguard/tftpboot".to_string()));
     let http_score = StaticFilesHttpScore {
         folder_to_serve: Some(Url::LocalFolder(
             "./data/watchguard/pxe-http-files".to_string(),
         )),
         files: vec![],
+        remote_path: None,
+    };
+
+    let kickstart_filename = "inventory.kickstart".to_string();
+    let harmony_inventory_agent = "harmony_inventory_agent".to_string();
+
+    let ipxe_score = OKDIpxeScore {
+        kickstart_filename,
+        harmony_inventory_agent,
+        cluster_pubkey: FileContent {
+            path: FilePath::Relative("cluster_ssh_key.pub".to_string()),
+            content: ssh_key.public,
+        },
     };
-    let ipxe_score = IpxeScore::new();
 
     harmony_tui::run(
         inventory,

examples/okd_installation/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "example-okd-install"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+publish = false
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
+harmony_secret = { path = "../../harmony_secret" }
+harmony_secret_derive = { path = "../../harmony_secret_derive" }
+cidr = { workspace = true }
+tokio = { workspace = true }
+harmony_macros = { path = "../../harmony_macros" }
+log = { workspace = true }
+env_logger = { workspace = true }
+url = { workspace = true }
+serde.workspace = true

examples/okd_installation/env.sh

@@ -0,0 +1,4 @@
+export HARMONY_SECRET_NAMESPACE=example-vms
+export HARMONY_SECRET_STORE=file
+export HARMONY_DATABASE_URL=sqlite://harmony_vms.sqlite RUST_LOG=info 
+export RUST_LOG=info

examples/okd_installation/src/main.rs

@@ -0,0 +1,34 @@
+mod topology;
+
+use crate::topology::{get_inventory, get_topology};
+use harmony::{
+    config::secret::SshKeyPair,
+    data::{FileContent, FilePath},
+    modules::okd::{installation::OKDInstallationPipeline, ipxe::OKDIpxeScore},
+    score::Score,
+    topology::HAClusterTopology,
+};
+use harmony_secret::SecretManager;
+
+#[tokio::main]
+async fn main() {
+    let inventory = get_inventory();
+    let topology = get_topology().await;
+
+    let ssh_key = SecretManager::get_or_prompt::<SshKeyPair>().await.unwrap();
+
+    let mut scores: Vec<Box<dyn Score<HAClusterTopology>>> = vec![Box::new(OKDIpxeScore {
+        kickstart_filename: "inventory.kickstart".to_string(),
+        harmony_inventory_agent: "harmony_inventory_agent".to_string(),
+        cluster_pubkey: FileContent {
+            path: FilePath::Relative("cluster_ssh_key.pub".to_string()),
+            content: ssh_key.public,
+        },
+    })];
+
+    scores.append(&mut OKDInstallationPipeline::get_all_scores().await);
+
+    harmony_cli::run(inventory, topology, scores, None)
+        .await
+        .unwrap();
+}

examples/okd_installation/src/topology.rs

@@ -0,0 +1,77 @@
+use cidr::Ipv4Cidr;
+use harmony::{
+    hardware::{FirewallGroup, HostCategory, Location, PhysicalHost, SwitchGroup},
+    infra::opnsense::OPNSenseManagementInterface,
+    inventory::Inventory,
+    topology::{HAClusterTopology, LogicalHost, UnmanagedRouter},
+};
+use harmony_macros::{ip, ipv4};
+use harmony_secret::{Secret, SecretManager};
+use serde::{Deserialize, Serialize};
+use std::{net::IpAddr, sync::Arc};
+
+#[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
+struct OPNSenseFirewallConfig {
+    username: String,
+    password: String,
+}
+
+pub async fn get_topology() -> HAClusterTopology {
+    let firewall = harmony::topology::LogicalHost {
+        ip: ip!("192.168.1.1"),
+        name: String::from("opnsense-1"),
+    };
+
+    let config = SecretManager::get_or_prompt::<OPNSenseFirewallConfig>().await;
+    let config = config.unwrap();
+
+    let opnsense = Arc::new(
+        harmony::infra::opnsense::OPNSenseFirewall::new(
+            firewall,
+            None,
+            &config.username,
+            &config.password,
+        )
+        .await,
+    );
+    let lan_subnet = ipv4!("192.168.1.0");
+    let gateway_ipv4 = ipv4!("192.168.1.1");
+    let gateway_ip = IpAddr::V4(gateway_ipv4);
+    harmony::topology::HAClusterTopology {
+        domain_name: "demo.harmony.mcd".to_string(),
+        router: Arc::new(UnmanagedRouter::new(
+            gateway_ip,
+            Ipv4Cidr::new(lan_subnet, 24).unwrap(),
+        )),
+        load_balancer: opnsense.clone(),
+        firewall: opnsense.clone(),
+        tftp_server: opnsense.clone(),
+        http_server: opnsense.clone(),
+        dhcp_server: opnsense.clone(),
+        dns_server: opnsense.clone(),
+        control_plane: vec![LogicalHost {
+            ip: ip!("192.168.1.20"),
+            name: "master".to_string(),
+        }],
+        bootstrap_host: LogicalHost {
+            ip: ip!("192.168.1.10"),
+            name: "bootstrap".to_string(),
+        },
+        workers: vec![],
+        switch: vec![],
+    }
+}
+
+pub fn get_inventory() -> Inventory {
+    Inventory {
+        location: Location::new(
+            "Some virtual machine or maybe a physical machine if you're cool".to_string(),
+            "testopnsense".to_string(),
+        ),
+        switch: SwitchGroup::from([]),
+        firewall_mgmt: Box::new(OPNSenseManagementInterface::new()),
+        storage_host: vec![],
+        worker_host: vec![],
+        control_plane_host: vec![],
+    }
+}

examples/okd_installation/ssh_example_key

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAcemw8pbwuvHFaYynxBbS0Cf3ThYuj1Utr7CDqjwySHAAAAJikacCNpGnA
+jQAAAAtzc2gtZWQyNTUxOQAAACAcemw8pbwuvHFaYynxBbS0Cf3ThYuj1Utr7CDqjwySHA
+AAAECiiKk4V6Q5cVs6axDM4sjAzZn/QCZLQekmYQXS9XbEYxx6bDylvC68cVpjKfEFtLQJ
+/dOFi6PVS2vsIOqPDJIcAAAAEGplYW5nYWJAbGlsaWFuZTIBAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----

examples/okd_installation/ssh_example_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBx6bDylvC68cVpjKfEFtLQJ/dOFi6PVS2vsIOqPDJIc jeangab@liliane2

examples/okd_pxe/src/main.rs

@@ -1,7 +1,12 @@
 mod topology;
 
 use crate::topology::{get_inventory, get_topology};
-use harmony::modules::okd::ipxe::OkdIpxeScore;
+use harmony::{
+    config::secret::SshKeyPair,
+    data::{FileContent, FilePath},
+    modules::okd::ipxe::OKDIpxeScore,
+};
+use harmony_secret::SecretManager;
 
 #[tokio::main]
 async fn main() {
@@ -9,13 +14,16 @@ async fn main() {
     let topology = get_topology().await;
 
     let kickstart_filename = "inventory.kickstart".to_string();
-    let cluster_pubkey_filename = "cluster_ssh_key.pub".to_string();
     let harmony_inventory_agent = "harmony_inventory_agent".to_string();
+    let ssh_key = SecretManager::get_or_prompt::<SshKeyPair>().await.unwrap();
 
-    let ipxe_score = OkdIpxeScore {
+    let ipxe_score = OKDIpxeScore {
         kickstart_filename,
         harmony_inventory_agent,
-        cluster_pubkey_filename,
+        cluster_pubkey: FileContent {
+            path: FilePath::Relative("cluster_ssh_key.pub".to_string()),
+            content: ssh_key.public,
+        },
     };
 
     harmony_cli::run(inventory, topology, vec![Box::new(ipxe_score)], None)

examples/okd_pxe/src/topology.rs

@@ -1,28 +1,22 @@
 use cidr::Ipv4Cidr;
 use harmony::{
-    hardware::{FirewallGroup, HostCategory, Location, PhysicalHost, SwitchGroup},
+    config::secret::OPNSenseFirewallCredentials,
+    hardware::{Location, SwitchGroup},
     infra::opnsense::OPNSenseManagementInterface,
     inventory::Inventory,
     topology::{HAClusterTopology, LogicalHost, UnmanagedRouter},
 };
 use harmony_macros::{ip, ipv4};
-use harmony_secret::{Secret, SecretManager};
-use serde::{Deserialize, Serialize};
+use harmony_secret::SecretManager;
 use std::{net::IpAddr, sync::Arc};
 
-#[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
-struct OPNSenseFirewallConfig {
-    username: String,
-    password: String,
-}
-
 pub async fn get_topology() -> HAClusterTopology {
     let firewall = harmony::topology::LogicalHost {
         ip: ip!("192.168.1.1"),
         name: String::from("opnsense-1"),
     };
 
-    let config = SecretManager::get::<OPNSenseFirewallConfig>().await;
+    let config = SecretManager::get_or_prompt::<OPNSenseFirewallCredentials>().await;
     let config = config.unwrap();
 
     let opnsense = Arc::new(
@@ -69,8 +63,7 @@ pub fn get_inventory() -> Inventory {
             "testopnsense".to_string(),
         ),
         switch: SwitchGroup::from([]),
-        firewall: FirewallGroup::from([PhysicalHost::empty(HostCategory::Firewall)
-            .management(Arc::new(OPNSenseManagementInterface::new()))]),
+        firewall_mgmt: Box::new(OPNSenseManagementInterface::new()),
         storage_host: vec![],
         worker_host: vec![],
         control_plane_host: vec![],

examples/opnsense/src/main.rs

@@ -5,7 +5,7 @@ use std::{
 
 use cidr::Ipv4Cidr;
 use harmony::{
-    hardware::{FirewallGroup, HostCategory, Location, PhysicalHost, SwitchGroup},
+    hardware::{HostCategory, Location, PhysicalHost, SwitchGroup},
     infra::opnsense::OPNSenseManagementInterface,
     inventory::Inventory,
     modules::{
@@ -15,9 +15,10 @@ use harmony::{
         opnsense::OPNsenseShellCommandScore,
         tftp::TftpScore,
     },
-    topology::{LogicalHost, UnmanagedRouter, Url},
+    topology::{LogicalHost, UnmanagedRouter},
 };
 use harmony_macros::{ip, mac_address};
+use harmony_types::net::Url;
 
 #[tokio::main]
 async fn main() {
@@ -62,8 +63,7 @@ async fn main() {
             "wk".to_string(),
         ),
         switch: SwitchGroup::from([]),
-        firewall: FirewallGroup::from([PhysicalHost::empty(HostCategory::Firewall)
-            .management(Arc::new(OPNSenseManagementInterface::new()))]),
+        firewall_mgmt: Box::new(OPNSenseManagementInterface::new()),
         storage_host: vec![],
         worker_host: vec![],
         control_plane_host: vec![
@@ -85,6 +85,7 @@ async fn main() {
             "./data/watchguard/pxe-http-files".to_string(),
         )),
         files: vec![],
+        remote_path: None,
     };
 
     harmony_tui::run(

examples/rhob_application_monitoring/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "rhob-application-monitoring"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
+harmony_macros = { path = "../../harmony_macros" }
+tokio = { workspace = true }
+log = { workspace = true }
+env_logger = { workspace = true }
+url = { workspace = true }
+base64.workspace = true

examples/rhob_application_monitoring/src/main.rs

@@ -0,0 +1,50 @@
+use std::{path::PathBuf, sync::Arc};
+
+use harmony::{
+    inventory::Inventory,
+    modules::{
+        application::{
+            ApplicationScore, RustWebFramework, RustWebapp,
+            features::rhob_monitoring::RHOBMonitoring,
+        },
+        monitoring::alert_channel::discord_alert_channel::DiscordWebhook,
+    },
+    topology::K8sAnywhereTopology,
+};
+use harmony_types::net::Url;
+
+#[tokio::main]
+async fn main() {
+    let application = Arc::new(RustWebapp {
+        name: "test-rhob-monitoring".to_string(),
+        domain: Url::Url(url::Url::parse("htps://some-fake-url").unwrap()),
+        project_root: PathBuf::from("./webapp"), // Relative from 'harmony-path' param
+        framework: Some(RustWebFramework::Leptos),
+        service_port: 3000,
+    });
+
+    let discord_receiver = DiscordWebhook {
+        name: "test-discord".to_string(),
+        url: Url::Url(url::Url::parse("https://discord.doesnt.exist.com").unwrap()),
+    };
+
+    let app = ApplicationScore {
+        features: vec![
+            Box::new(RHOBMonitoring {
+                application: application.clone(),
+                alert_receiver: vec![Box::new(discord_receiver)],
+            }),
+            // TODO add backups, multisite ha, etc
+        ],
+        application,
+    };
+
+    harmony_cli::run(
+        Inventory::autoload(),
+        K8sAnywhereTopology::from_env(),
+        vec![Box::new(app)],
+        None,
+    )
+    .await
+    .unwrap();
+}

examples/rust/src/main.rs

@@ -11,26 +11,28 @@ use harmony::{
             discord_alert_channel::DiscordWebhook, webhook_receiver::WebhookReceiver,
         },
     },
-    topology::{K8sAnywhereTopology, Url},
+    topology::K8sAnywhereTopology,
 };
+use harmony_macros::hurl;
 
 #[tokio::main]
 async fn main() {
     let application = Arc::new(RustWebapp {
         name: "harmony-example-rust-webapp".to_string(),
-        domain: Url::Url(url::Url::parse("https://rustapp.harmony.example.com").unwrap()),
-        project_root: PathBuf::from("./webapp"), // Relative from 'harmony-path' param
+        domain: hurl!("https://rustapp.harmony.example.com"),
+        project_root: PathBuf::from("./webapp"),
         framework: Some(RustWebFramework::Leptos),
+        service_port: 3000,
     });
 
     let discord_receiver = DiscordWebhook {
         name: "test-discord".to_string(),
-        url: Url::Url(url::Url::parse("https://discord.doesnt.exist.com").unwrap()),
+        url: hurl!("https://discord.doesnt.exist.com"),
     };
 
     let webhook_receiver = WebhookReceiver {
         name: "sample-webhook-receiver".to_string(),
-        url: Url::Url(url::Url::parse("https://webhook-doesnt-exist.com").unwrap()),
+        url: hurl!("https://webhook-doesnt-exist.com"),
     };
 
     let app = ApplicationScore {

examples/tenant/src/main.rs

@@ -1,11 +1,11 @@
 use std::str::FromStr;
 
 use harmony::{
-    data::Id,
     inventory::Inventory,
     modules::tenant::TenantScore,
     topology::{K8sAnywhereTopology, tenant::TenantConfig},
 };
+use harmony_types::id::Id;
 
 #[tokio::main]
 async fn main() {

examples/try_rust_webapp/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "example-try-rust-webapp"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
+harmony_macros = { path = "../../harmony_macros" }
+tokio = { workspace = true }
+log = { workspace = true }
+env_logger = { workspace = true }
+url = { workspace = true }
+base64.workspace = true

examples/try_rust_webapp/src/main.rs

@@ -0,0 +1,52 @@
+use std::{path::PathBuf, sync::Arc};
+
+use harmony::{
+    inventory::Inventory,
+    modules::{
+        application::{
+            ApplicationScore, RustWebFramework, RustWebapp,
+            features::{ContinuousDelivery, Monitoring},
+        },
+        monitoring::alert_channel::discord_alert_channel::DiscordWebhook,
+    },
+    topology::K8sAnywhereTopology,
+};
+use harmony_types::net::Url;
+
+#[tokio::main]
+async fn main() {
+    let application = Arc::new(RustWebapp {
+        name: "harmony-example-tryrust".to_string(),
+        domain: Url::Url(url::Url::parse("https://tryrust.harmony.example.com").unwrap()),
+        project_root: PathBuf::from("./tryrust.org"),
+        framework: Some(RustWebFramework::Leptos),
+        service_port: 8080,
+    });
+
+    let discord_receiver = DiscordWebhook {
+        name: "test-discord".to_string(),
+        url: Url::Url(url::Url::parse("https://discord.doesnt.exist.com").unwrap()),
+    };
+
+    let app = ApplicationScore {
+        features: vec![
+            Box::new(ContinuousDelivery {
+                application: application.clone(),
+            }),
+            Box::new(Monitoring {
+                application: application.clone(),
+                alert_receiver: vec![Box::new(discord_receiver)],
+            }),
+        ],
+        application,
+    };
+
+    harmony_cli::run(
+        Inventory::autoload(),
+        K8sAnywhereTopology::from_env(),
+        vec![Box::new(app)],
+        None,
+    )
+    .await
+    .unwrap();
+}

examples/tui/src/main.rs

@@ -9,6 +9,7 @@ use harmony::{
     },
     topology::{
         BackendServer, DummyInfra, HealthCheck, HttpMethod, HttpStatusCode, LoadBalancerService,
+        SSL,
     },
 };
 use harmony_macros::ipv4;
@@ -47,6 +48,7 @@ fn build_large_score() -> LoadBalancerScore {
                 .to_string(),
             HttpMethod::GET,
             HttpStatusCode::Success2xx,
+            SSL::Disabled,
         )),
     };
     LoadBalancerScore {

examples/validate_ceph_cluster_health/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "example_validate_ceph_cluster_health"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+
+[dependencies]
+harmony = { version = "0.1.0", path = "../../harmony" }
+harmony_cli = { version = "0.1.0", path = "../../harmony_cli" }
+tokio.workspace = true

examples/validate_ceph_cluster_health/src/main.rs

@@ -0,0 +1,18 @@
+use harmony::{
+    inventory::Inventory,
+    modules::storage::ceph::ceph_validate_health_score::CephVerifyClusterHealth,
+    topology::K8sAnywhereTopology,
+};
+
+#[tokio::main]
+async fn main() {
+    let ceph_health_score = CephVerifyClusterHealth {
+        rook_ceph_namespace: "rook-ceph".to_string(),
+    };
+
+    let topology = K8sAnywhereTopology::from_env();
+    let inventory = Inventory::autoload();
+    harmony_cli::run(inventory, topology, vec![Box::new(ceph_health_score)], None)
+        .await
+        .unwrap();
+}

harmony/Cargo.toml

@@ -9,10 +9,8 @@ license.workspace = true
 testing = []
 
 [dependencies]
-rand = "0.9"
 hex = "0.4"
-libredfish = "0.1.1"
-reqwest = { version = "0.11", features = ["blocking", "json"] }
+reqwest = { version = "0.11", features = ["blocking", "json", "rustls-tls"], default-features = false }
 russh = "0.45.0"
 rust-ipmi = "0.1.1"
 semver = "1.0.23"
@@ -66,10 +64,15 @@ kube-derive = "1.1.0"
 bollard.workspace = true
 tar.workspace = true
 base64.workspace = true
+thiserror.workspace = true
 once_cell = "1.21.3"
+walkdir = "2.5.0"
 harmony_inventory_agent = { path = "../harmony_inventory_agent" }
-harmony_secret_derive = { version = "0.1.0", path = "../harmony_secret_derive" }
-askama = "0.14.0"
+harmony_secret_derive = { path = "../harmony_secret_derive" }
+harmony_secret = { path = "../harmony_secret" }
+askama.workspace = true
+sqlx.workspace = true
+inquire.workspace = true
 
 [dev-dependencies]
 pretty_assertions.workspace = true

harmony/src/domain/config/mod.rs

@@ -1,3 +1,5 @@
+pub mod secret;
+
 use lazy_static::lazy_static;
 use std::path::PathBuf;
 
@@ -12,4 +14,12 @@ lazy_static! {
         std::env::var("HARMONY_REGISTRY_PROJECT").unwrap_or_else(|_| "harmony".to_string());
     pub static ref DRY_RUN: bool =
         std::env::var("HARMONY_DRY_RUN").is_ok_and(|value| value.parse().unwrap_or(false));
+    pub static ref DEFAULT_DATABASE_URL: String = "sqlite://harmony.sqlite".to_string();
+    pub static ref DATABASE_URL: String = std::env::var("HARMONY_DATABASE_URL")
+        .map(|value| if value.is_empty() {
+            (*DEFAULT_DATABASE_URL).clone()
+        } else {
+            value
+        })
+        .unwrap_or((*DEFAULT_DATABASE_URL).clone());
 }

harmony/src/domain/config/secret.rs

@@ -0,0 +1,20 @@
+use harmony_secret_derive::Secret;
+use serde::{Deserialize, Serialize};
+
+#[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
+pub struct OPNSenseFirewallCredentials {
+    pub username: String,
+    pub password: String,
+}
+
+// TODO we need a better way to handle multiple "instances" of the same secret structure.
+#[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
+pub struct SshKeyPair {
+    pub private: String,
+    pub public: String,
+}
+
+#[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
+pub struct RedhatSecret {
+    pub pull_secret: String,
+}

harmony/src/domain/data/id.rs

@@ -24,6 +24,14 @@ pub struct Id {
     value: String,
 }
 
+impl Id {
+    pub fn empty() -> Self {
+        Id {
+            value: String::new(),
+        }
+    }
+}
+
 impl FromStr for Id {
     type Err = ();
 
@@ -34,6 +42,12 @@ impl FromStr for Id {
     }
 }
 
+impl From<String> for Id {
+    fn from(value: String) -> Self {
+        Self { value }
+    }
+}
+
 impl std::fmt::Display for Id {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(&self.value)

harmony/src/domain/data/mod.rs

@@ -1,6 +1,4 @@
 mod file;
-mod id;
 mod version;
 pub use file::*;
-pub use id::*;
 pub use version::*;

harmony/src/domain/executors/mod.rs

@@ -1,8 +1,7 @@
 use std::fmt;
 
 use async_trait::async_trait;
-
-use super::topology::IpAddress;
+use harmony_types::net::IpAddress;
 
 #[derive(Debug)]
 pub enum ExecutorError {

harmony/src/domain/hardware/mod.rs

@@ -1,38 +1,246 @@
-use std::sync::Arc;
-
 use derive_new::new;
+use harmony_inventory_agent::hwinfo::{CPU, MemoryModule, NetworkInterface, StorageDrive};
 use harmony_types::net::MacAddress;
-use serde::{Serialize, Serializer, ser::SerializeStruct};
+use serde::{Deserialize, Serialize};
 use serde_value::Value;
 
 pub type HostGroup = Vec<PhysicalHost>;
 pub type SwitchGroup = Vec<Switch>;
 pub type FirewallGroup = Vec<PhysicalHost>;
 
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PhysicalHost {
+    pub id: Id,
     pub category: HostCategory,
     pub network: Vec<NetworkInterface>,
-    pub management: Arc<dyn ManagementInterface>,
-    pub storage: Vec<Storage>,
+    pub storage: Vec<StorageDrive>,
     pub labels: Vec<Label>,
-    pub memory_size: Option<u64>,
-    pub cpu_count: Option<u64>,
+    pub memory_modules: Vec<MemoryModule>,
+    pub cpus: Vec<CPU>,
 }
 
 impl PhysicalHost {
     pub fn empty(category: HostCategory) -> Self {
         Self {
+            id: Id::empty(),
             category,
             network: vec![],
             storage: vec![],
             labels: vec![],
-            management: Arc::new(ManualManagementInterface {}),
-            memory_size: None,
-            cpu_count: None,
+            memory_modules: vec![],
+            cpus: vec![],
         }
     }
 
+    pub fn summary(&self) -> String {
+        let mut parts = Vec::new();
+
+        // Part 1: System Model (from labels) or Category as a fallback
+        let model = self
+            .labels
+            .iter()
+            .find(|l| l.name == "system-product-name" || l.name == "model")
+            .map(|l| l.value.clone())
+            .unwrap_or_else(|| self.category.to_string());
+        parts.push(model);
+
+        // Part 2: CPU Information
+        if !self.cpus.is_empty() {
+            let cpu_count = self.cpus.len();
+            let total_cores = self.cpus.iter().map(|c| c.cores).sum::<u32>();
+            let total_threads = self.cpus.iter().map(|c| c.threads).sum::<u32>();
+            let model_name = &self.cpus[0].model;
+
+            let cpu_summary = if cpu_count > 1 {
+                format!(
+                    "{}x {} ({}c/{}t)",
+                    cpu_count, model_name, total_cores, total_threads
+                )
+            } else {
+                format!("{} ({}c/{}t)", model_name, total_cores, total_threads)
+            };
+            parts.push(cpu_summary);
+        }
+
+        // Part 3: Memory Information
+        if !self.memory_modules.is_empty() {
+            let total_mem_bytes = self
+                .memory_modules
+                .iter()
+                .map(|m| m.size_bytes)
+                .sum::<u64>();
+            let total_mem_gb = (total_mem_bytes as f64 / (1024.0 * 1024.0 * 1024.0)).round() as u64;
+
+            // Find the most common speed among modules
+            let mut speeds = std::collections::HashMap::new();
+            for module in &self.memory_modules {
+                if let Some(speed) = module.speed_mhz {
+                    *speeds.entry(speed).or_insert(0) += 1;
+                }
+            }
+            let common_speed = speeds
+                .into_iter()
+                .max_by_key(|&(_, count)| count)
+                .map(|(speed, _)| speed);
+
+            if let Some(speed) = common_speed {
+                parts.push(format!("{} GB RAM @ {}MHz", total_mem_gb, speed));
+            } else {
+                parts.push(format!("{} GB RAM", total_mem_gb));
+            }
+        }
+
+        // Part 4: Storage Information
+        if !self.storage.is_empty() {
+            let total_storage_bytes = self.storage.iter().map(|d| d.size_bytes).sum::<u64>();
+            let drive_count = self.storage.len();
+            let first_drive_model = &self.storage[0].model;
+
+            // Helper to format bytes into TB or GB
+            let format_storage = |bytes: u64| {
+                let tb = bytes as f64 / (1024.0 * 1024.0 * 1024.0 * 1024.0);
+                if tb >= 1.0 {
+                    format!("{:.2} TB", tb)
+                } else {
+                    let gb = bytes as f64 / (1024.0 * 1024.0 * 1024.0);
+                    format!("{:.0} GB", gb)
+                }
+            };
+
+            let storage_summary = if drive_count > 1 {
+                format!(
+                    "{} Storage ({}x {})",
+                    format_storage(total_storage_bytes),
+                    drive_count,
+                    first_drive_model
+                )
+            } else {
+                format!(
+                    "{} Storage ({})",
+                    format_storage(total_storage_bytes),
+                    first_drive_model
+                )
+            };
+            parts.push(storage_summary);
+        }
+
+        // Part 5: Network Information
+        // Prioritize an "up" interface with an IPv4 address
+        let best_nic = self
+            .network
+            .iter()
+            .find(|n| n.is_up && !n.ipv4_addresses.is_empty())
+            .or_else(|| self.network.first());
+
+        if let Some(nic) = best_nic {
+            let speed = nic
+                .speed_mbps
+                .map(|s| format!("{}Gbps", s / 1000))
+                .unwrap_or_else(|| "N/A".to_string());
+            let mac = nic.mac_address.to_string();
+            let nic_summary = if let Some(ip) = nic.ipv4_addresses.first() {
+                format!("NIC: {} ({}, {})", speed, ip, mac)
+            } else {
+                format!("NIC: {} ({})", speed, mac)
+            };
+            parts.push(nic_summary);
+        }
+
+        parts.join(" | ")
+    }
+
+    pub fn parts_list(&self) -> String {
+        let PhysicalHost {
+            id,
+            category,
+            network,
+            storage,
+            labels,
+            memory_modules,
+            cpus,
+        } = self;
+
+        let mut parts_list = String::new();
+        parts_list.push_str("\n\n=====================");
+        parts_list.push_str(&format!("\nHost ID {id}"));
+        parts_list.push_str("\n=====================");
+        parts_list.push_str("\n\n=====================");
+        parts_list.push_str(&format!("\nCPU count {}", cpus.len()));
+        parts_list.push_str("\n=====================");
+        cpus.iter().for_each(|c| {
+            let CPU {
+                model,
+                vendor,
+                cores,
+                threads,
+                frequency_mhz,
+            } = c;
+            parts_list.push_str(&format!(
+                "\n{vendor} {model}, {cores}/{threads} {}Ghz",
+                *frequency_mhz as f64 / 1000.0
+            ));
+        });
+
+        parts_list.push_str("\n\n=====================");
+        parts_list.push_str(&format!("\nNetwork Interfaces count {}", network.len()));
+        parts_list.push_str("\n=====================");
+        network.iter().for_each(|nic| {
+            parts_list.push_str(&format!(
+                "\nNic({} {}Gbps mac({}) ipv4({}), ipv6({})",
+                nic.name,
+                nic.speed_mbps.unwrap_or(0) / 1000,
+                nic.mac_address,
+                nic.ipv4_addresses.join(","),
+                nic.ipv6_addresses.join(",")
+            ));
+        });
+
+        parts_list.push_str("\n\n=====================");
+        parts_list.push_str(&format!("\nStorage drives count {}", storage.len()));
+        parts_list.push_str("\n=====================");
+        storage.iter().for_each(|drive| {
+            let StorageDrive {
+                name,
+                model,
+                serial,
+                size_bytes,
+                logical_block_size: _,
+                physical_block_size: _,
+                rotational: _,
+                wwn: _,
+                interface_type,
+                smart_status,
+            } = drive;
+            parts_list.push_str(&format!(
+                "\n{name} {}Gb {model} {interface_type} smart({smart_status:?}) {serial}",
+                size_bytes / 1000 / 1000 / 1000
+            ));
+        });
+
+        parts_list.push_str("\n\n=====================");
+        parts_list.push_str(&format!("\nMemory modules count {}", memory_modules.len()));
+        parts_list.push_str("\n=====================");
+        memory_modules.iter().for_each(|mem| {
+            let MemoryModule {
+                size_bytes,
+                speed_mhz,
+                manufacturer,
+                part_number,
+                serial_number,
+                rank,
+            } = mem;
+            parts_list.push_str(&format!(
+                "\n{}Gb, {}Mhz, Manufacturer ({}), Part Number ({})",
+                size_bytes / 1000 / 1000 / 1000,
+                speed_mhz.unwrap_or(0),
+                manufacturer.as_ref().unwrap_or(&String::new()),
+                part_number.as_ref().unwrap_or(&String::new()),
+            ));
+        });
+
+        parts_list
+    }
+
     pub fn cluster_mac(&self) -> MacAddress {
         self.network
             .first()
@@ -40,93 +248,72 @@ impl PhysicalHost {
             .mac_address
     }
 
-    pub fn cpu(mut self, cpu_count: Option<u64>) -> Self {
-        self.cpu_count = cpu_count;
-        self
-    }
-
-    pub fn memory_size(mut self, memory_size: Option<u64>) -> Self {
-        self.memory_size = memory_size;
-        self
-    }
-
-    pub fn storage(
-        mut self,
-        connection: StorageConnectionType,
-        kind: StorageKind,
-        size: u64,
-        serial: String,
-    ) -> Self {
-        self.storage.push(Storage {
-            connection,
-            kind,
-            size,
-            serial,
-        });
-        self
-    }
-
     pub fn mac_address(mut self, mac_address: MacAddress) -> Self {
         self.network.push(NetworkInterface {
-            name: None,
+            name: String::new(),
             mac_address,
-            speed: None,
+            speed_mbps: None,
+            is_up: false,
+            mtu: 0,
+            ipv4_addresses: vec![],
+            ipv6_addresses: vec![],
+            driver: String::new(),
+            firmware_version: None,
         });
         self
     }
 
+    pub fn get_mac_address(&self) -> Vec<MacAddress> {
+        self.network.iter().map(|nic| nic.mac_address).collect()
+    }
+
     pub fn label(mut self, name: String, value: String) -> Self {
         self.labels.push(Label { name, value });
         self
     }
-
-    pub fn management(mut self, management: Arc<dyn ManagementInterface>) -> Self {
-        self.management = management;
-        self
-    }
 }
 
 // Custom Serialize implementation for PhysicalHost
-impl Serialize for PhysicalHost {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: Serializer,
-    {
-        // Determine the number of fields
-        let mut num_fields = 5; // category, network, storage, labels, management
-        if self.memory_size.is_some() {
-            num_fields += 1;
-        }
-        if self.cpu_count.is_some() {
-            num_fields += 1;
-        }
-
-        // Create a serialization structure
-        let mut state = serializer.serialize_struct("PhysicalHost", num_fields)?;
-
-        // Serialize the standard fields
-        state.serialize_field("category", &self.category)?;
-        state.serialize_field("network", &self.network)?;
-        state.serialize_field("storage", &self.storage)?;
-        state.serialize_field("labels", &self.labels)?;
-
-        // Serialize optional fields
-        if let Some(memory) = self.memory_size {
-            state.serialize_field("memory_size", &memory)?;
-        }
-        if let Some(cpu) = self.cpu_count {
-            state.serialize_field("cpu_count", &cpu)?;
-        }
-
-        let mgmt_data = self.management.serialize_management();
-        // pub management: Arc<dyn ManagementInterface>,
-
-        // Handle management interface - either as a field or flattened
-        state.serialize_field("management", &mgmt_data)?;
-
-        state.end()
-    }
-}
+// impl Serialize for PhysicalHost {
+//     fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+//     where
+//         S: Serializer,
+//     {
+//         // Determine the number of fields
+//         let mut num_fields = 5; // category, network, storage, labels, management
+//         if self.memory_modules.is_some() {
+//             num_fields += 1;
+//         }
+//         if self.cpus.is_some() {
+//             num_fields += 1;
+//         }
+//
+//         // Create a serialization structure
+//         let mut state = serializer.serialize_struct("PhysicalHost", num_fields)?;
+//
+//         // Serialize the standard fields
+//         state.serialize_field("category", &self.category)?;
+//         state.serialize_field("network", &self.network)?;
+//         state.serialize_field("storage", &self.storage)?;
+//         state.serialize_field("labels", &self.labels)?;
+//
+//         // Serialize optional fields
+//         if let Some(memory) = self.memory_modules {
+//             state.serialize_field("memory_size", &memory)?;
+//         }
+//         if let Some(cpu) = self.cpus {
+//             state.serialize_field("cpu_count", &cpu)?;
+//         }
+//
+//         let mgmt_data = self.management.serialize_management();
+//         // pub management: Arc<dyn ManagementInterface>,
+//
+//         // Handle management interface - either as a field or flattened
+//         state.serialize_field("management", &mgmt_data)?;
+//
+//         state.end()
+//     }
+// }
 
 #[derive(new, Serialize)]
 pub struct ManualManagementInterface;
@@ -171,66 +358,14 @@ where
     }
 }
 
-#[derive(Debug, Clone, Serialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub enum HostCategory {
     Server,
     Firewall,
     Switch,
 }
 
-#[derive(Debug, new, Clone, Serialize)]
-pub struct NetworkInterface {
-    pub name: Option<String>,
-    pub mac_address: MacAddress,
-    pub speed: Option<u64>,
-}
-
-#[cfg(test)]
-use harmony_macros::mac_address;
-#[cfg(test)]
-impl NetworkInterface {
-    pub fn dummy() -> Self {
-        Self {
-            name: Some(String::new()),
-            mac_address: mac_address!("00:00:00:00:00:00"),
-            speed: Some(0),
-        }
-    }
-}
-
-#[derive(Debug, new, Clone, Serialize)]
-pub enum StorageConnectionType {
-    Sata3g,
-    Sata6g,
-    Sas6g,
-    Sas12g,
-    PCIE,
-}
-#[derive(Debug, Clone, Serialize)]
-pub enum StorageKind {
-    SSD,
-    NVME,
-    HDD,
-}
-#[derive(Debug, new, Clone, Serialize)]
-pub struct Storage {
-    pub connection: StorageConnectionType,
-    pub kind: StorageKind,
-    pub size: u64,
-    pub serial: String,
-}
-
-#[cfg(test)]
-impl Storage {
-    pub fn dummy() -> Self {
-        Self {
-            connection: StorageConnectionType::Sata3g,
-            kind: StorageKind::SSD,
-            size: 0,
-            serial: String::new(),
-        }
-    }
-}
+use harmony_types::id::Id;
 
 #[derive(Debug, Clone, Serialize)]
 pub struct Switch {
@@ -238,7 +373,7 @@ pub struct Switch {
     _management_interface: NetworkInterface,
 }
 
-#[derive(Debug, new, Clone, Serialize)]
+#[derive(Debug, new, Clone, Serialize, Deserialize)]
 pub struct Label {
     pub name: String,
     pub value: String,
@@ -261,146 +396,65 @@ impl Location {
     }
 }
 
+impl std::fmt::Display for HostCategory {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            HostCategory::Server => write!(f, "Server"),
+            HostCategory::Firewall => write!(f, "Firewall"),
+            HostCategory::Switch => write!(f, "Switch"),
+        }
+    }
+}
+
+impl std::fmt::Display for Label {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}: {}", self.name, self.value)
+    }
+}
+
+impl std::fmt::Display for Location {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "Address: {}, Name: {}", self.address, self.name)
+    }
+}
+
+impl std::fmt::Display for PhysicalHost {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.summary())
+    }
+}
+
+impl std::fmt::Display for Switch {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "Switch with {} interfaces", self._interface.len())
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
-    use serde::{Deserialize, Serialize};
-    use std::sync::Arc;
-
-    // Mock implementation of ManagementInterface
-    #[derive(Debug, Clone, Serialize, Deserialize)]
-    struct MockHPIlo {
-        ip: String,
-        username: String,
-        password: String,
-        firmware_version: String,
-    }
-
-    impl ManagementInterface for MockHPIlo {
-        fn boot_to_pxe(&self) {}
-
-        fn get_supported_protocol_names(&self) -> String {
-            String::new()
-        }
-    }
-
-    // Another mock implementation
-    #[derive(Debug, Clone, Serialize, Deserialize)]
-    struct MockDellIdrac {
-        hostname: String,
-        port: u16,
-        api_token: String,
-    }
-
-    impl ManagementInterface for MockDellIdrac {
-        fn boot_to_pxe(&self) {}
-
-        fn get_supported_protocol_names(&self) -> String {
-            String::new()
-        }
-    }
-
-    #[test]
-    fn test_serialize_physical_host_with_hp_ilo() {
-        // Create a PhysicalHost with HP iLO management
-        let host = PhysicalHost {
-            category: HostCategory::Server,
-            network: vec![NetworkInterface::dummy()],
-            management: Arc::new(MockHPIlo {
-                ip: "192.168.1.100".to_string(),
-                username: "admin".to_string(),
-                password: "password123".to_string(),
-                firmware_version: "2.5.0".to_string(),
-            }),
-            storage: vec![Storage::dummy()],
-            labels: vec![Label::new("datacenter".to_string(), "us-east".to_string())],
-            memory_size: Some(64_000_000),
-            cpu_count: Some(16),
-        };
-
-        // Serialize to JSON
-        let json = serde_json::to_string(&host).expect("Failed to serialize host");
-
-        // Check that the serialized JSON contains the HP iLO details
-        assert!(json.contains("192.168.1.100"));
-        assert!(json.contains("admin"));
-        assert!(json.contains("password123"));
-        assert!(json.contains("firmware_version"));
-        assert!(json.contains("2.5.0"));
-
-        // Parse back to verify structure (not the exact management interface)
-        let parsed: serde_json::Value = serde_json::from_str(&json).expect("Failed to parse JSON");
-
-        // Verify basic structure
-        assert_eq!(parsed["cpu_count"], 16);
-        assert_eq!(parsed["memory_size"], 64_000_000);
-        assert_eq!(parsed["network"][0]["name"], "");
-    }
-
-    #[test]
-    fn test_serialize_physical_host_with_dell_idrac() {
-        // Create a PhysicalHost with Dell iDRAC management
-        let host = PhysicalHost {
-            category: HostCategory::Server,
-            network: vec![NetworkInterface::dummy()],
-            management: Arc::new(MockDellIdrac {
-                hostname: "idrac-server01".to_string(),
-                port: 443,
-                api_token: "abcdef123456".to_string(),
-            }),
-            storage: vec![Storage::dummy()],
-            labels: vec![Label::new("env".to_string(), "production".to_string())],
-            memory_size: Some(128_000_000),
-            cpu_count: Some(32),
-        };
-
-        // Serialize to JSON
-        let json = serde_json::to_string(&host).expect("Failed to serialize host");
-
-        // Check that the serialized JSON contains the Dell iDRAC details
-        assert!(json.contains("idrac-server01"));
-        assert!(json.contains("443"));
-        assert!(json.contains("abcdef123456"));
-
-        // Parse back to verify structure
-        let parsed: serde_json::Value = serde_json::from_str(&json).expect("Failed to parse JSON");
-
-        // Verify basic structure
-        assert_eq!(parsed["cpu_count"], 32);
-        assert_eq!(parsed["memory_size"], 128_000_000);
-        assert_eq!(parsed["storage"][0]["path"], serde_json::Value::Null);
-    }
 
     #[test]
     fn test_different_management_implementations_produce_valid_json() {
         // Create hosts with different management implementations
         let host1 = PhysicalHost {
+            id: Id::empty(),
             category: HostCategory::Server,
             network: vec![],
-            management: Arc::new(MockHPIlo {
-                ip: "10.0.0.1".to_string(),
-                username: "root".to_string(),
-                password: "secret".to_string(),
-                firmware_version: "3.0.0".to_string(),
-            }),
             storage: vec![],
             labels: vec![],
-            memory_size: None,
-            cpu_count: None,
+            memory_modules: vec![],
+            cpus: vec![],
         };
 
         let host2 = PhysicalHost {
+            id: Id::empty(),
             category: HostCategory::Server,
             network: vec![],
-            management: Arc::new(MockDellIdrac {
-                hostname: "server02-idrac".to_string(),
-                port: 8443,
-                api_token: "token123".to_string(),
-            }),
             storage: vec![],
             labels: vec![],
-            memory_size: None,
-            cpu_count: None,
+            memory_modules: vec![],
+            cpus: vec![],
         };
 
         // Both should serialize successfully
@@ -410,8 +464,5 @@ mod tests {
         // Both JSONs should be valid and parseable
         let _: serde_json::Value = serde_json::from_str(&json1).expect("Invalid JSON for host1");
         let _: serde_json::Value = serde_json::from_str(&json2).expect("Invalid JSON for host2");
-
-        // The JSONs should be different because they contain different management interfaces
-        assert_ne!(json1, json2);
     }
 }

harmony/src/domain/instrumentation.rs

@@ -50,6 +50,7 @@ static SUBSCRIBERS: Lazy<Mutex<HashMap<String, Subscriber>>> =
 ///
 /// # Example
 /// ```
+/// use harmony::instrumentation;
 /// instrumentation::subscribe("my_logger", |event| {
 ///   println!("Event occurred: {:?}", event);
 /// });
@@ -68,6 +69,8 @@ where
 ///
 /// # Example
 /// ```
+/// use harmony::instrumentation;
+/// use harmony::instrumentation::HarmonyEvent;
 /// instrumentation::instrument(HarmonyEvent::HarmonyStarted);
 /// ```
 pub fn instrument(event: HarmonyEvent) -> Result<(), &'static str> {

harmony/src/domain/interpret/mod.rs

@@ -1,13 +1,11 @@
+use harmony_types::id::Id;
 use std::error::Error;
 
 use async_trait::async_trait;
 use derive_new::new;
 
 use super::{
-    data::{Id, Version},
-    executors::ExecutorError,
-    inventory::Inventory,
-    topology::PreparationError,
+    data::Version, executors::ExecutorError, inventory::Inventory, topology::PreparationError,
 };
 
 pub enum InterpretName {
@@ -33,6 +31,9 @@ pub enum InterpretName {
     ApplicationMonitoring,
     K8sPrometheusCrdAlerting,
     DiscoverInventoryAgent,
+    CephClusterHealth,
+    Custom(&'static str),
+    RHOBAlerting,
 }
 
 impl std::fmt::Display for InterpretName {
@@ -60,6 +61,9 @@ impl std::fmt::Display for InterpretName {
             InterpretName::ApplicationMonitoring => f.write_str("ApplicationMonitoring"),
             InterpretName::K8sPrometheusCrdAlerting => f.write_str("K8sPrometheusCrdAlerting"),
             InterpretName::DiscoverInventoryAgent => f.write_str("DiscoverInventoryAgent"),
+            InterpretName::CephClusterHealth => f.write_str("CephClusterHealth"),
+            InterpretName::Custom(name) => f.write_str(name),
+            InterpretName::RHOBAlerting => f.write_str("RHOBAlerting"),
         }
     }
 }
@@ -140,6 +144,12 @@ impl From<PreparationError> for InterpretError {
     }
 }
 
+impl From<harmony_secret::SecretStoreError> for InterpretError {
+    fn from(value: harmony_secret::SecretStoreError) -> Self {
+        InterpretError::new(format!("Interpret error : {value}"))
+    }
+}
+
 impl From<ExecutorError> for InterpretError {
     fn from(value: ExecutorError) -> Self {
         Self {

harmony/src/domain/inventory/mod.rs

@@ -1,3 +1,6 @@
+mod repository;
+pub use repository::*;
+
 #[derive(Debug, new, Clone)]
 pub struct InventoryFilter {
     target: Vec<Filter>,
@@ -14,10 +17,14 @@ impl InventoryFilter {
 
 use derive_new::new;
 use log::info;
+use serde::{Deserialize, Serialize};
+use strum::EnumIter;
+
+use crate::hardware::{ManagementInterface, ManualManagementInterface};
 
 use super::{
     filter::Filter,
-    hardware::{FirewallGroup, HostGroup, Location, SwitchGroup},
+    hardware::{HostGroup, Location, SwitchGroup},
 };
 
 #[derive(Debug)]
@@ -27,7 +34,7 @@ pub struct Inventory {
     // Firewall is really just a host but with somewhat specialized hardware
     // I'm not entirely sure it belongs to its own category but it helps make things easier and
     // clearer for now so let's try it this way.
-    pub firewall: FirewallGroup,
+    pub firewall_mgmt: Box<dyn ManagementInterface>,
     pub worker_host: HostGroup,
     pub storage_host: HostGroup,
     pub control_plane_host: HostGroup,
@@ -38,7 +45,7 @@ impl Inventory {
         Self {
             location: Location::new("Empty".to_string(), "location".to_string()),
             switch: vec![],
-            firewall: vec![],
+            firewall_mgmt: Box::new(ManualManagementInterface {}),
             worker_host: vec![],
             storage_host: vec![],
             control_plane_host: vec![],
@@ -49,10 +56,18 @@ impl Inventory {
         Self {
             location: Location::test_building(),
             switch: SwitchGroup::new(),
-            firewall: FirewallGroup::new(),
+            firewall_mgmt: Box::new(ManualManagementInterface {}),
             worker_host: HostGroup::new(),
             storage_host: HostGroup::new(),
             control_plane_host: HostGroup::new(),
         }
     }
 }
+
+#[derive(Debug, Serialize, Deserialize, sqlx::Type, Clone, EnumIter)]
+pub enum HostRole {
+    Bootstrap,
+    ControlPlane,
+    Worker,
+    Storage,
+}

harmony/src/domain/inventory/repository.rs

@@ -0,0 +1,38 @@
+use async_trait::async_trait;
+
+use crate::{hardware::PhysicalHost, interpret::InterpretError, inventory::HostRole};
+
+/// Errors that can occur within the repository layer.
+#[derive(thiserror::Error, Debug)]
+pub enum RepoError {
+    #[error("Database query failed: {0}")]
+    QueryFailed(String),
+    #[error("Data serialization failed: {0}")]
+    Serialization(String),
+    #[error("Data deserialization failed: {0}")]
+    Deserialization(String),
+    #[error("Could not connect to the database: {0}")]
+    ConnectionFailed(String),
+}
+
+impl From<RepoError> for InterpretError {
+    fn from(value: RepoError) -> Self {
+        InterpretError::new(format!("Interpret error : {value}"))
+    }
+}
+
+// --- Trait and Implementation ---
+
+/// Defines the contract for inventory persistence.
+#[async_trait]
+pub trait InventoryRepository: Send + Sync + 'static {
+    async fn save(&self, host: &PhysicalHost) -> Result<(), RepoError>;
+    async fn get_latest_by_id(&self, host_id: &str) -> Result<Option<PhysicalHost>, RepoError>;
+    async fn get_all_hosts(&self) -> Result<Vec<PhysicalHost>, RepoError>;
+    async fn get_host_for_role(&self, role: &HostRole) -> Result<Vec<PhysicalHost>, RepoError>;
+    async fn save_role_mapping(
+        &self,
+        role: &HostRole,
+        host: &PhysicalHost,
+    ) -> Result<(), RepoError>;
+}

harmony/src/domain/score.rs

@@ -1,3 +1,4 @@
+use harmony_types::id::Id;
 use std::collections::BTreeMap;
 
 use async_trait::async_trait;
@@ -5,7 +6,6 @@ use serde::Serialize;
 use serde_value::Value;
 
 use super::{
-    data::Id,
     instrumentation::{self, HarmonyEvent},
     interpret::{Interpret, InterpretError, Outcome},
     inventory::Inventory,

harmony/src/domain/topology/ha_cluster.rs

@@ -1,6 +1,7 @@
 use async_trait::async_trait;
 use harmony_macros::ip;
 use harmony_types::net::MacAddress;
+use harmony_types::net::Url;
 use log::debug;
 use log::info;
 
@@ -26,7 +27,6 @@ use super::Router;
 use super::TftpServer;
 
 use super::Topology;
-use super::Url;
 use super::k8s::K8sClient;
 use std::sync::Arc;
 
@@ -69,6 +69,26 @@ impl K8sclient for HAClusterTopology {
 }
 
 impl HAClusterTopology {
+    // TODO this is a hack to avoid refactoring
+    pub fn get_cluster_name(&self) -> String {
+        self.domain_name
+            .split(".")
+            .next()
+            .expect("Cluster domain name must not be empty")
+            .to_string()
+    }
+
+    pub fn get_cluster_base_domain(&self) -> String {
+        let base_domain = self
+            .domain_name
+            .strip_prefix(&self.get_cluster_name())
+            .expect("cluster domain must start with cluster name");
+        base_domain
+            .strip_prefix(".")
+            .unwrap_or(base_domain)
+            .to_string()
+    }
+
     pub fn autoload() -> Self {
         let dummy_infra = Arc::new(DummyInfra {});
         let dummy_host = LogicalHost {
@@ -161,6 +181,14 @@ impl DhcpServer for HAClusterTopology {
         self.dhcp_server.set_pxe_options(options).await
     }
 
+    async fn set_dhcp_range(
+        &self,
+        start: &IpAddress,
+        end: &IpAddress,
+    ) -> Result<(), ExecutorError> {
+        self.dhcp_server.set_dhcp_range(start, end).await
+    }
+
     fn get_ip(&self) -> IpAddress {
         self.dhcp_server.get_ip()
     }
@@ -209,8 +237,12 @@ impl Router for HAClusterTopology {
 
 #[async_trait]
 impl HttpServer for HAClusterTopology {
-    async fn serve_files(&self, url: &Url) -> Result<(), ExecutorError> {
-        self.http_server.serve_files(url).await
+    async fn serve_files(
+        &self,
+        url: &Url,
+        remote_path: &Option<String>,
+    ) -> Result<(), ExecutorError> {
+        self.http_server.serve_files(url, remote_path).await
     }
 
     async fn serve_file_content(&self, file: &FileContent) -> Result<(), ExecutorError> {
@@ -298,6 +330,13 @@ impl DhcpServer for DummyInfra {
     async fn set_pxe_options(&self, _options: PxeOptions) -> Result<(), ExecutorError> {
         unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
     }
+    async fn set_dhcp_range(
+        &self,
+        start: &IpAddress,
+        end: &IpAddress,
+    ) -> Result<(), ExecutorError> {
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+    }
     fn get_ip(&self) -> IpAddress {
         unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
     }
@@ -362,7 +401,11 @@ impl TftpServer for DummyInfra {
 
 #[async_trait]
 impl HttpServer for DummyInfra {
-    async fn serve_files(&self, _url: &Url) -> Result<(), ExecutorError> {
+    async fn serve_files(
+        &self,
+        _url: &Url,
+        _remote_path: &Option<String>,
+    ) -> Result<(), ExecutorError> {
         unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
     }
     async fn serve_file_content(&self, _file: &FileContent) -> Result<(), ExecutorError> {

harmony/src/domain/topology/http.rs

@@ -1,11 +1,15 @@
 use crate::{data::FileContent, executors::ExecutorError};
 use async_trait::async_trait;
 
-use super::{IpAddress, Url};
-
+use harmony_types::net::IpAddress;
+use harmony_types::net::Url;
 #[async_trait]
 pub trait HttpServer: Send + Sync {
-    async fn serve_files(&self, url: &Url) -> Result<(), ExecutorError>;
+    async fn serve_files(
+        &self,
+        url: &Url,
+        remote_path: &Option<String>,
+    ) -> Result<(), ExecutorError>;
     async fn serve_file_content(&self, file: &FileContent) -> Result<(), ExecutorError>;
     fn get_ip(&self) -> IpAddress;
 

harmony/src/domain/topology/k8s.rs

@@ -17,7 +17,7 @@ use kube::{
 };
 use log::{debug, error, trace};
 use serde::{Serialize, de::DeserializeOwned};
-use serde_json::json;
+use serde_json::{Value, json};
 use similar::TextDiff;
 use tokio::io::AsyncReadExt;
 
@@ -53,6 +53,21 @@ impl K8sClient {
         })
     }
 
+    pub async fn get_resource_json_value(
+        &self,
+        name: &str,
+        namespace: Option<&str>,
+        gvk: &GroupVersionKind,
+    ) -> Result<DynamicObject, Error> {
+        let gvk = ApiResource::from_gvk(gvk);
+        let resource: Api<DynamicObject> = if let Some(ns) = namespace {
+            Api::namespaced_with(self.client.clone(), ns, &gvk)
+        } else {
+            Api::default_namespaced_with(self.client.clone(), &gvk)
+        };
+        Ok(resource.get(name).await?)
+    }
+
     pub async fn get_deployment(
         &self,
         name: &str,

harmony/src/domain/topology/k8s_anywhere.rs

@@ -14,10 +14,11 @@ use crate::{
         monitoring::kube_prometheus::crd::{
             crd_alertmanager_config::CRDPrometheus,
             prometheus_operator::prometheus_operator_helm_chart_score,
+            rhob_alertmanager_config::RHOBObservability,
         },
         prometheus::{
             k8s_prometheus_alerting_score::K8sPrometheusCRDAlertingScore,
-            prometheus::PrometheusApplicationMonitoring,
+            prometheus::PrometheusApplicationMonitoring, rhob_alerting_score::RHOBAlertingScore,
         },
     },
     score::Score,
@@ -108,6 +109,43 @@ impl PrometheusApplicationMonitoring<CRDPrometheus> for K8sAnywhereTopology {
     }
 }
 
+#[async_trait]
+impl PrometheusApplicationMonitoring<RHOBObservability> for K8sAnywhereTopology {
+    async fn install_prometheus(
+        &self,
+        sender: &RHOBObservability,
+        inventory: &Inventory,
+        receivers: Option<Vec<Box<dyn AlertReceiver<RHOBObservability>>>>,
+    ) -> Result<PreparationOutcome, PreparationError> {
+        let po_result = self.ensure_cluster_observability_operator(sender).await?;
+
+        if po_result == PreparationOutcome::Noop {
+            debug!("Skipping Prometheus CR installation due to missing operator.");
+            return Ok(po_result);
+        }
+
+        let result = self
+            .get_cluster_observability_operator_prometheus_application_score(
+                sender.clone(),
+                receivers,
+            )
+            .await
+            .interpret(inventory, self)
+            .await;
+
+        match result {
+            Ok(outcome) => match outcome.status {
+                InterpretStatus::SUCCESS => Ok(PreparationOutcome::Success {
+                    details: outcome.message,
+                }),
+                InterpretStatus::NOOP => Ok(PreparationOutcome::Noop),
+                _ => Err(PreparationError::new(outcome.message)),
+            },
+            Err(err) => Err(PreparationError::new(err.to_string())),
+        }
+    }
+}
+
 impl Serialize for K8sAnywhereTopology {
     fn serialize<S>(&self, _serializer: S) -> Result<S::Ok, S::Error>
     where
@@ -134,6 +172,19 @@ impl K8sAnywhereTopology {
         }
     }
 
+    async fn get_cluster_observability_operator_prometheus_application_score(
+        &self,
+        sender: RHOBObservability,
+        receivers: Option<Vec<Box<dyn AlertReceiver<RHOBObservability>>>>,
+    ) -> RHOBAlertingScore {
+        RHOBAlertingScore {
+            sender,
+            receivers: receivers.unwrap_or_default(),
+            service_monitors: vec![],
+            prometheus_rules: vec![],
+        }
+    }
+
     async fn get_k8s_prometheus_application_score(
         &self,
         sender: CRDPrometheus,
@@ -286,6 +337,60 @@ impl K8sAnywhereTopology {
         }
     }
 
+    async fn ensure_cluster_observability_operator(
+        &self,
+        sender: &RHOBObservability,
+    ) -> Result<PreparationOutcome, PreparationError> {
+        let status = Command::new("sh")
+            .args(["-c", "kubectl get crd -A | grep -i rhobs"])
+            .status()
+            .map_err(|e| PreparationError::new(format!("could not connect to cluster: {}", e)))?;
+
+        if !status.success() {
+            if let Some(Some(k8s_state)) = self.k8s_state.get() {
+                match k8s_state.source {
+                    K8sSource::LocalK3d => {
+                        debug!("installing cluster observability operator");
+                        todo!();
+                        let op_score =
+                            prometheus_operator_helm_chart_score(sender.namespace.clone());
+                        let result = op_score.interpret(&Inventory::empty(), self).await;
+
+                        return match result {
+                            Ok(outcome) => match outcome.status {
+                                InterpretStatus::SUCCESS => Ok(PreparationOutcome::Success {
+                                    details: "installed cluster observability operator".into(),
+                                }),
+                                InterpretStatus::NOOP => Ok(PreparationOutcome::Noop),
+                                _ => Err(PreparationError::new(
+                                    "failed to install cluster observability operator (unknown error)".into(),
+                                )),
+                            },
+                            Err(err) => Err(PreparationError::new(err.to_string())),
+                        };
+                    }
+                    K8sSource::Kubeconfig => {
+                        debug!(
+                            "unable to install cluster observability operator, contact cluster admin"
+                        );
+                        return Ok(PreparationOutcome::Noop);
+                    }
+                }
+            } else {
+                warn!(
+                    "Unable to detect k8s_state. Skipping Cluster Observability Operator install."
+                );
+                return Ok(PreparationOutcome::Noop);
+            }
+        }
+
+        debug!("Cluster Observability Operator is already present, skipping install");
+
+        Ok(PreparationOutcome::Success {
+            details: "cluster observability operator present in cluster".into(),
+        })
+    }
+
     async fn ensure_prometheus_operator(
         &self,
         sender: &CRDPrometheus,

harmony/src/domain/topology/load_balancer.rs

@@ -4,8 +4,9 @@ use async_trait::async_trait;
 use log::debug;
 use serde::Serialize;
 
-use super::{IpAddress, LogicalHost};
+use super::LogicalHost;
 use crate::executors::ExecutorError;
+use harmony_types::net::IpAddress;
 
 impl std::fmt::Debug for dyn LoadBalancer {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
@@ -101,8 +102,17 @@ pub enum HttpStatusCode {
     ServerError5xx,
 }
 
+#[derive(Debug, Clone, PartialEq, Serialize)]
+pub enum SSL {
+    SSL,
+    Disabled,
+    Default,
+    SNI,
+    Other(String),
+}
+
 #[derive(Debug, Clone, PartialEq, Serialize)]
 pub enum HealthCheck {
-    HTTP(String, HttpMethod, HttpStatusCode),
+    HTTP(String, HttpMethod, HttpStatusCode, SSL),
     TCP(Option<u16>),
 }

harmony/src/domain/topology/mod.rs

@@ -1,4 +1,5 @@
 mod ha_cluster;
+use harmony_types::net::IpAddress;
 mod host_binding;
 mod http;
 pub mod installable;
@@ -32,7 +33,6 @@ use super::{
     instrumentation::{self, HarmonyEvent},
 };
 use std::error::Error;
-use std::net::IpAddr;
 
 /// Represents a logical view of an infrastructure environment providing specific capabilities.
 ///
@@ -196,35 +196,6 @@ pub trait MultiTargetTopology: Topology {
     fn current_target(&self) -> DeploymentTarget;
 }
 
-pub type IpAddress = IpAddr;
-
-#[derive(Debug, Clone)]
-pub enum Url {
-    LocalFolder(String),
-    Url(url::Url),
-}
-
-impl Serialize for Url {
-    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
-    where
-        S: serde::Serializer,
-    {
-        match self {
-            Url::LocalFolder(path) => serializer.serialize_str(path),
-            Url::Url(url) => serializer.serialize_str(url.as_str()),
-        }
-    }
-}
-
-impl std::fmt::Display for Url {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Url::LocalFolder(path) => write!(f, "{}", path),
-            Url::Url(url) => write!(f, "{}", url),
-        }
-    }
-}
-
 /// Represents a logical member of a cluster that provides one or more services.
 ///
 /// A LogicalHost can represent various roles within the infrastructure, such as:
@@ -263,7 +234,8 @@ impl LogicalHost {
     ///
     /// ```
     /// use std::str::FromStr;
-    /// use harmony::topology::{IpAddress, LogicalHost};
+    /// use harmony::topology::{LogicalHost};
+    /// use harmony_types::net::IpAddress;
     ///
     /// let start_ip = IpAddress::from_str("192.168.0.20").unwrap();
     /// let hosts = LogicalHost::create_hosts(3, start_ip, "worker");
@@ -319,7 +291,7 @@ fn increment_ip(ip: IpAddress, increment: u32) -> Option<IpAddress> {
 
 #[cfg(test)]
 mod tests {
-    use super::*;
+    use harmony_types::net::Url;
     use serde_json;
 
     #[test]

harmony/src/domain/topology/network.rs

@@ -1,25 +1,31 @@
 use std::{net::Ipv4Addr, str::FromStr, sync::Arc};
 
 use async_trait::async_trait;
-use harmony_types::net::MacAddress;
+use harmony_types::net::{IpAddress, MacAddress};
 use serde::Serialize;
 
 use crate::executors::ExecutorError;
 
-use super::{IpAddress, LogicalHost, k8s::K8sClient};
+use super::{LogicalHost, k8s::K8sClient};
 
 #[derive(Debug)]
 pub struct DHCPStaticEntry {
     pub name: String,
-    pub mac: MacAddress,
+    pub mac: Vec<MacAddress>,
     pub ip: Ipv4Addr,
 }
 
 impl std::fmt::Display for DHCPStaticEntry {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let mac = self
+            .mac
+            .iter()
+            .map(|m| m.to_string())
+            .collect::<Vec<String>>()
+            .join(",");
         f.write_fmt(format_args!(
             "DHCPStaticEntry : name {}, mac {}, ip {}",
-            self.name, self.mac, self.ip
+            self.name, mac, self.ip
         ))
     }
 }
@@ -41,6 +47,7 @@ impl std::fmt::Debug for dyn Firewall {
 pub struct NetworkDomain {
     pub name: String,
 }
+
 #[async_trait]
 pub trait K8sclient: Send + Sync {
     async fn k8s_client(&self) -> Result<Arc<K8sClient>, String>;
@@ -59,6 +66,8 @@ pub trait DhcpServer: Send + Sync + std::fmt::Debug {
     async fn remove_static_mapping(&self, mac: &MacAddress) -> Result<(), ExecutorError>;
     async fn list_static_mappings(&self) -> Vec<(MacAddress, IpAddress)>;
     async fn set_pxe_options(&self, pxe_options: PxeOptions) -> Result<(), ExecutorError>;
+    async fn set_dhcp_range(&self, start: &IpAddress, end: &IpAddress)
+    -> Result<(), ExecutorError>;
     fn get_ip(&self) -> IpAddress;
     fn get_host(&self) -> LogicalHost;
     async fn commit_config(&self) -> Result<(), ExecutorError>;

harmony/src/domain/topology/oberservability/monitoring.rs

@@ -4,11 +4,12 @@ use async_trait::async_trait;
 use log::debug;
 
 use crate::{
-    data::{Id, Version},
+    data::Version,
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
     topology::{Topology, installable::Installable},
 };
+use harmony_types::id::Id;
 
 #[async_trait]
 pub trait AlertSender: Send + Sync + std::fmt::Debug {

harmony/src/domain/topology/tenant/mod.rs

@@ -2,7 +2,7 @@ pub mod k8s;
 mod manager;
 pub mod network_policy;
 
-use crate::data::Id;
+use harmony_types::id::Id;
 pub use manager::*;
 use serde::{Deserialize, Serialize};
 use std::str::FromStr;

harmony/src/domain/topology/tftp.rs

@@ -1,7 +1,7 @@
 use crate::executors::ExecutorError;
 use async_trait::async_trait;
 
-use super::{IpAddress, Url};
+use harmony_types::net::{IpAddress, Url};
 
 #[async_trait]
 pub trait TftpServer: Send + Sync {

harmony/src/infra/executors/russh/mod.rs

@@ -3,11 +3,9 @@ use std::sync::Arc;
 
 use russh::{client, keys::key};
 
-use crate::{
-    domain::executors::{ExecutorError, SshClient},
-    topology::IpAddress,
-};
+use crate::domain::executors::{ExecutorError, SshClient};
 
+use harmony_types::net::IpAddress;
 pub struct RusshClient;
 
 #[async_trait]

harmony/src/infra/hp_ilo/mod.rs

@@ -1,6 +1,6 @@
 use crate::hardware::ManagementInterface;
-use crate::topology::IpAddress;
 use derive_new::new;
+use harmony_types::net::IpAddress;
 use harmony_types::net::MacAddress;
 use log::info;
 use serde::Serialize;

harmony/src/infra/inventory/mod.rs

@@ -0,0 +1,17 @@
+use crate::{
+    config::DATABASE_URL,
+    infra::inventory::sqlite::SqliteInventoryRepository,
+    inventory::{InventoryRepository, RepoError},
+};
+
+pub mod sqlite;
+
+pub struct InventoryRepositoryFactory;
+
+impl InventoryRepositoryFactory {
+    pub async fn build() -> Result<Box<dyn InventoryRepository>, RepoError> {
+        Ok(Box::new(
+            SqliteInventoryRepository::new(&(*DATABASE_URL)).await?,
+        ))
+    }
+}

harmony/src/infra/inventory/sqlite.rs

@@ -0,0 +1,149 @@
+use crate::{
+    hardware::PhysicalHost,
+    inventory::{HostRole, InventoryRepository, RepoError},
+};
+use async_trait::async_trait;
+use harmony_types::id::Id;
+use log::info;
+use sqlx::{Pool, Sqlite, SqlitePool};
+
+/// A thread-safe, connection-pooled repository using SQLite.
+#[derive(Debug)]
+pub struct SqliteInventoryRepository {
+    pool: Pool<Sqlite>,
+}
+
+impl SqliteInventoryRepository {
+    pub async fn new(database_url: &str) -> Result<Self, RepoError> {
+        let pool = SqlitePool::connect(database_url)
+            .await
+            .map_err(|e| RepoError::ConnectionFailed(e.to_string()))?;
+
+        info!("SQLite inventory repository initialized at '{database_url}'");
+        Ok(Self { pool })
+    }
+}
+
+#[async_trait]
+impl InventoryRepository for SqliteInventoryRepository {
+    async fn save(&self, host: &PhysicalHost) -> Result<(), RepoError> {
+        let data = serde_json::to_vec(host).map_err(|e| RepoError::Serialization(e.to_string()))?;
+
+        let id = Id::default().to_string();
+        let host_id = host.id.to_string();
+
+        sqlx::query!(
+            "INSERT INTO physical_hosts (id, version_id, data) VALUES (?, ?, ?)",
+            host_id,
+            id,
+            data,
+        )
+        .execute(&self.pool)
+        .await?;
+
+        info!("Saved new inventory version for host '{}'", host.id);
+        Ok(())
+    }
+
+    async fn get_latest_by_id(&self, host_id: &str) -> Result<Option<PhysicalHost>, RepoError> {
+        let row = sqlx::query_as!(
+            DbHost,
+            r#"SELECT id, version_id, data as "data: Json<PhysicalHost>" FROM physical_hosts WHERE id = ? ORDER BY version_id DESC LIMIT 1"#,
+            host_id
+        )
+        .fetch_optional(&self.pool)
+        .await?;
+
+        Ok(row.map(|r| r.data.0))
+    }
+
+    async fn get_all_hosts(&self) -> Result<Vec<PhysicalHost>, RepoError> {
+        let db_hosts = sqlx::query_as!(
+            DbHost,
+            r#"
+        SELECT
+            p1.id,
+            p1.version_id,
+            p1.data as "data: Json<PhysicalHost>"
+        FROM
+            physical_hosts p1
+        INNER JOIN (
+            SELECT
+                id,
+                MAX(version_id) AS max_version
+            FROM
+                physical_hosts
+            GROUP BY
+                id
+        ) p2 ON p1.id = p2.id AND p1.version_id = p2.max_version
+        "#
+        )
+        .fetch_all(&self.pool)
+        .await?;
+
+        let hosts = db_hosts.into_iter().map(|row| row.data.0).collect();
+
+        Ok(hosts)
+    }
+
+    async fn save_role_mapping(
+        &self,
+        role: &HostRole,
+        host: &PhysicalHost,
+    ) -> Result<(), RepoError> {
+        let host_id = host.id.to_string();
+
+        sqlx::query!(
+            r#"
+        INSERT INTO host_role_mapping (host_id, role)
+        VALUES (?, ?)
+        "#,
+            host_id,
+            role
+        )
+        .execute(&self.pool)
+        .await?;
+
+        info!("Saved role mapping for host '{}' as '{:?}'", host.id, role);
+
+        Ok(())
+    }
+
+    async fn get_host_for_role(&self, role: &HostRole) -> Result<Vec<PhysicalHost>, RepoError> {
+        struct HostIdRow {
+            host_id: String,
+        }
+
+        let role_str = format!("{:?}", role);
+
+        let host_id_rows = sqlx::query_as!(
+            HostIdRow,
+            "SELECT host_id FROM host_role_mapping WHERE role = ?",
+            role_str
+        )
+        .fetch_all(&self.pool)
+        .await?;
+
+        let mut hosts = Vec::with_capacity(host_id_rows.len());
+        for row in host_id_rows {
+            match self.get_latest_by_id(&row.host_id).await? {
+                Some(host) => hosts.push(host),
+                None => {
+                    log::warn!(
+                        "Found a role mapping for host_id '{}', but the host does not exist in the physical_hosts table. This may indicate a data integrity issue.",
+                        row.host_id
+                    );
+                }
+            }
+        }
+
+        Ok(hosts)
+    }
+}
+
+use sqlx::types::Json;
+struct DbHost {
+    data: Json<PhysicalHost>,
+    id: String,
+    version_id: String,
+}

harmony/src/infra/mod.rs

@@ -1,4 +1,6 @@
 pub mod executors;
 pub mod hp_ilo;
 pub mod intel_amt;
+pub mod inventory;
 pub mod opnsense;
+mod sqlx;

harmony/src/infra/opnsense/dhcp.rs

@@ -4,10 +4,11 @@ use log::info;
 
 use crate::{
     executors::ExecutorError,
-    topology::{DHCPStaticEntry, DhcpServer, IpAddress, LogicalHost, PxeOptions},
+    topology::{DHCPStaticEntry, DhcpServer, LogicalHost, PxeOptions},
 };
 
 use super::OPNSenseFirewall;
+use harmony_types::net::IpAddress;
 
 #[async_trait]
 impl DhcpServer for OPNSenseFirewall {
@@ -16,13 +17,13 @@ impl DhcpServer for OPNSenseFirewall {
     }
 
     async fn add_static_mapping(&self, entry: &DHCPStaticEntry) -> Result<(), ExecutorError> {
-        let mac: String = String::from(&entry.mac);
+        let mac: Vec<String> = entry.mac.iter().map(MacAddress::to_string).collect();
 
         {
             let mut writable_opnsense = self.opnsense_config.write().await;
             writable_opnsense
                 .dhcp()
-                .add_static_mapping(&mac, entry.ip, &entry.name)
+                .add_static_mapping(&mac, &entry.ip, &entry.name)
                 .unwrap();
         }
 
@@ -67,4 +68,19 @@ impl DhcpServer for OPNSenseFirewall {
                 ExecutorError::UnexpectedError(format!("Failed to set_pxe_options : {dhcp_error}"))
             })
     }
+
+    async fn set_dhcp_range(
+        &self,
+        start: &IpAddress,
+        end: &IpAddress,
+    ) -> Result<(), ExecutorError> {
+        let mut writable_opnsense = self.opnsense_config.write().await;
+        writable_opnsense
+            .dhcp()
+            .set_dhcp_range(&start.to_string(), &end.to_string())
+            .await
+            .map_err(|dhcp_error| {
+                ExecutorError::UnexpectedError(format!("Failed to set_dhcp_range : {dhcp_error}"))
+            })
+    }
 }

harmony/src/infra/opnsense/dns.rs

@@ -1,32 +1,32 @@
-use crate::infra::opnsense::Host;
-use crate::infra::opnsense::IpAddress;
 use crate::infra::opnsense::LogicalHost;
 use crate::{
     executors::ExecutorError,
     topology::{DnsRecord, DnsServer},
 };
 use async_trait::async_trait;
+use harmony_types::net::IpAddress;
 
 use super::OPNSenseFirewall;
 
 #[async_trait]
 impl DnsServer for OPNSenseFirewall {
     async fn register_hosts(&self, hosts: Vec<DnsRecord>) -> Result<(), ExecutorError> {
-        let mut writable_opnsense = self.opnsense_config.write().await;
-        let mut dns = writable_opnsense.dns();
-        let hosts = hosts
-            .iter()
-            .map(|h| {
-                Host::new(
-                    h.host.clone(),
-                    h.domain.clone(),
-                    h.record_type.to_string(),
-                    h.value.to_string(),
-                )
-            })
-            .collect();
-        dns.register_hosts(hosts);
-        Ok(())
+        todo!("Refactor this to use dnsmasq")
+        // let mut writable_opnsense = self.opnsense_config.write().await;
+        // let mut dns = writable_opnsense.dns();
+        // let hosts = hosts
+        //     .iter()
+        //     .map(|h| {
+        //         Host::new(
+        //             h.host.clone(),
+        //             h.domain.clone(),
+        //             h.record_type.to_string(),
+        //             h.value.to_string(),
+        //         )
+        //     })
+        //     .collect();
+        // dns.add_static_mapping(hosts);
+        // Ok(())
     }
 
     fn remove_record(
@@ -38,25 +38,26 @@ impl DnsServer for OPNSenseFirewall {
     }
 
     async fn list_records(&self) -> Vec<crate::topology::DnsRecord> {
-        self.opnsense_config
-            .write()
-            .await
-            .dns()
-            .get_hosts()
-            .iter()
-            .map(|h| DnsRecord {
-                host: h.hostname.clone(),
-                domain: h.domain.clone(),
-                record_type: h
-                    .rr
-                    .parse()
-                    .expect("received invalid record type {h.rr} from opnsense"),
-                value: h
-                    .server
-                    .parse()
-                    .expect("received invalid ipv4 record from opnsense {h.server}"),
-            })
-            .collect()
+        todo!("Refactor this to use dnsmasq")
+        // self.opnsense_config
+        //     .write()
+        //     .await
+        //     .dns()
+        //     .get_hosts()
+        //     .iter()
+        //     .map(|h| DnsRecord {
+        //         host: h.hostname.clone(),
+        //         domain: h.domain.clone(),
+        //         record_type: h
+        //             .rr
+        //             .parse()
+        //             .expect("received invalid record type {h.rr} from opnsense"),
+        //         value: h
+        //             .server
+        //             .parse()
+        //             .expect("received invalid ipv4 record from opnsense {h.server}"),
+        //     })
+        //     .collect()
     }
 
     fn get_ip(&self) -> IpAddress {
@@ -68,11 +69,12 @@ impl DnsServer for OPNSenseFirewall {
     }
 
     async fn register_dhcp_leases(&self, register: bool) -> Result<(), ExecutorError> {
-        let mut writable_opnsense = self.opnsense_config.write().await;
-        let mut dns = writable_opnsense.dns();
-        dns.register_dhcp_leases(register);
-
-        Ok(())
+        todo!("Refactor this to use dnsmasq")
+        // let mut writable_opnsense = self.opnsense_config.write().await;
+        // let mut dns = writable_opnsense.dns();
+        // dns.register_dhcp_leases(register);
+        //
+        // Ok(())
     }
 
     async fn commit_config(&self) -> Result<(), ExecutorError> {

harmony/src/infra/opnsense/firewall.rs

@@ -1,9 +1,10 @@
 use crate::{
     executors::ExecutorError,
-    topology::{Firewall, FirewallRule, IpAddress, LogicalHost},
+    topology::{Firewall, FirewallRule, LogicalHost},
 };
 
 use super::OPNSenseFirewall;
+use harmony_types::net::IpAddress;
 
 impl Firewall for OPNSenseFirewall {
     fn add_rule(&mut self, _rule: FirewallRule) -> Result<(), ExecutorError> {

harmony/src/infra/opnsense/http.rs

@@ -1,24 +1,30 @@
 use async_trait::async_trait;
 use log::info;
 
-use crate::{
-    data::FileContent,
-    executors::ExecutorError,
-    topology::{HttpServer, IpAddress, Url},
-};
+use crate::{data::FileContent, executors::ExecutorError, topology::HttpServer};
 
 use super::OPNSenseFirewall;
+use harmony_types::net::IpAddress;
+use harmony_types::net::Url;
 const OPNSENSE_HTTP_ROOT_PATH: &str = "/usr/local/http";
 
 #[async_trait]
 impl HttpServer for OPNSenseFirewall {
-    async fn serve_files(&self, url: &Url) -> Result<(), ExecutorError> {
+    async fn serve_files(
+        &self,
+        url: &Url,
+        remote_path: &Option<String>,
+    ) -> Result<(), ExecutorError> {
         let config = self.opnsense_config.read().await;
         info!("Uploading files from url {url} to {OPNSENSE_HTTP_ROOT_PATH}");
+        let remote_upload_path = remote_path
+            .clone()
+            .map(|r| format!("{OPNSENSE_HTTP_ROOT_PATH}/{r}"))
+            .unwrap_or(OPNSENSE_HTTP_ROOT_PATH.to_string());
         match url {
             Url::LocalFolder(path) => {
                 config
-                    .upload_files(path, OPNSENSE_HTTP_ROOT_PATH)
+                    .upload_files(path, &remote_upload_path)
                     .await
                     .map_err(|e| ExecutorError::UnexpectedError(e.to_string()))?;
             }

harmony/src/infra/opnsense/load_balancer.rs

@@ -1,15 +1,18 @@
 use async_trait::async_trait;
-use log::{debug, info, warn};
-use opnsense_config_xml::{Frontend, HAProxy, HAProxyBackend, HAProxyHealthCheck, HAProxyServer};
+use log::{debug, error, info, warn};
+use opnsense_config_xml::{
+    Frontend, HAProxy, HAProxyBackend, HAProxyHealthCheck, HAProxyServer, MaybeString,
+};
 use uuid::Uuid;
 
 use crate::{
     executors::ExecutorError,
     topology::{
-        BackendServer, HealthCheck, HttpMethod, HttpStatusCode, IpAddress, LoadBalancer,
-        LoadBalancerService, LogicalHost,
+        BackendServer, HealthCheck, HttpMethod, HttpStatusCode, LoadBalancer, LoadBalancerService,
+        LogicalHost, SSL,
     },
 };
+use harmony_types::net::IpAddress;
 
 use super::OPNSenseFirewall;
 
@@ -205,7 +208,22 @@ pub(crate) fn get_health_check_for_backend(
                 .unwrap_or_default()
                 .into();
             let status_code: HttpStatusCode = HttpStatusCode::Success2xx;
-            Some(HealthCheck::HTTP(path, method, status_code))
+            let ssl = match haproxy_health_check
+                .ssl
+                .content_string()
+                .to_uppercase()
+                .as_str()
+            {
+                "SSL" => SSL::SSL,
+                "SSLNI" => SSL::SNI,
+                "NOSSL" => SSL::Disabled,
+                "" => SSL::Default,
+                other => {
+                    error!("Unknown haproxy health check ssl config {other}");
+                    SSL::Other(other.to_string())
+                }
+            };
+            Some(HealthCheck::HTTP(path, method, status_code, ssl))
         }
         _ => panic!("Received unsupported health check type {}", uppercase),
     }
@@ -240,7 +258,14 @@ pub(crate) fn harmony_load_balancer_service_to_haproxy_xml(
     // frontend points to backend
     let healthcheck = if let Some(health_check) = &service.health_check {
         match health_check {
-            HealthCheck::HTTP(path, http_method, _http_status_code) => {
+            HealthCheck::HTTP(path, http_method, _http_status_code, ssl) => {
+                let ssl: MaybeString = match ssl {
+                    SSL::SSL => "ssl".into(),
+                    SSL::SNI => "sslni".into(),
+                    SSL::Disabled => "nossl".into(),
+                    SSL::Default => "".into(),
+                    SSL::Other(other) => other.as_str().into(),
+                };
                 let haproxy_check = HAProxyHealthCheck {
                     name: format!("HTTP_{http_method}_{path}"),
                     uuid: Uuid::new_v4().to_string(),
@@ -248,6 +273,7 @@ pub(crate) fn harmony_load_balancer_service_to_haproxy_xml(
                     health_check_type: "http".to_string(),
                     http_uri: path.clone().into(),
                     interval: "2s".to_string(),
+                    ssl,
                     ..Default::default()
                 };
 

harmony/src/infra/opnsense/mod.rs

@@ -11,10 +11,8 @@ pub use management::*;
 use opnsense_config_xml::Host;
 use tokio::sync::RwLock;
 
-use crate::{
-    executors::ExecutorError,
-    topology::{IpAddress, LogicalHost},
-};
+use crate::{executors::ExecutorError, topology::LogicalHost};
+use harmony_types::net::IpAddress;
 
 #[derive(Debug, Clone)]
 pub struct OPNSenseFirewall {

harmony/src/infra/opnsense/tftp.rs

@@ -1,10 +1,9 @@
 use async_trait::async_trait;
 use log::info;
 
-use crate::{
-    executors::ExecutorError,
-    topology::{IpAddress, TftpServer, Url},
-};
+use crate::{executors::ExecutorError, topology::TftpServer};
+use harmony_types::net::IpAddress;
+use harmony_types::net::Url;
 
 use super::OPNSenseFirewall;
 

harmony/src/infra/sqlx.rs

@@ -0,0 +1,36 @@
+use crate::inventory::RepoError;
+
+impl From<sqlx::Error> for RepoError {
+    fn from(value: sqlx::Error) -> Self {
+        match value {
+            sqlx::Error::Configuration(_)
+            | sqlx::Error::Io(_)
+            | sqlx::Error::Tls(_)
+            | sqlx::Error::Protocol(_)
+            | sqlx::Error::PoolTimedOut
+            | sqlx::Error::PoolClosed
+            | sqlx::Error::WorkerCrashed => RepoError::ConnectionFailed(value.to_string()),
+            sqlx::Error::InvalidArgument(_)
+            | sqlx::Error::Database(_)
+            | sqlx::Error::RowNotFound
+            | sqlx::Error::TypeNotFound { .. }
+            | sqlx::Error::ColumnIndexOutOfBounds { .. }
+            | sqlx::Error::ColumnNotFound(_)
+            | sqlx::Error::AnyDriverError(_)
+            | sqlx::Error::Migrate(_)
+            | sqlx::Error::InvalidSavePointStatement
+            | sqlx::Error::BeginFailed => RepoError::QueryFailed(value.to_string()),
+            sqlx::Error::Encode(_) => RepoError::Serialization(value.to_string()),
+            sqlx::Error::Decode(_) | sqlx::Error::ColumnDecode { .. } => {
+                RepoError::Deserialization(value.to_string())
+            }
+            _ => RepoError::QueryFailed(value.to_string()),
+        }
+    }
+}
+
+impl From<serde_json::Error> for RepoError {
+    fn from(value: serde_json::Error) -> Self {
+        RepoError::Serialization(value.to_string())
+    }
+}

harmony/src/modules/application/features/continuous_delivery.rs

@@ -50,6 +50,55 @@ pub struct ContinuousDelivery<A: OCICompliant + HelmPackage> {
 }
 
 impl<A: OCICompliant + HelmPackage> ContinuousDelivery<A> {
+    pub async fn deploy<T>(&self, topology: &T, helm_chart: String, image: String) -> Result<(), String>
+    where
+        T: Topology + HelmCommand + MultiTargetTopology + K8sclient + 'static,
+    {
+        // TODO: this is a temporary hack for demo purposes, the deployment target should be driven
+        // by the topology only and we should not have to know how to perform tasks like this for
+        // which the topology should be responsible.
+        //
+        // That said, this will require some careful architectural decisions, since the concept of
+        // deployment targets / profiles is probably a layer of complexity that we won't be
+        // completely able to avoid
+        //
+        // I'll try something for now that must be thought through after : att a deployment_profile
+        // function to the topology trait that returns a profile, then anybody who needs it can
+        // access it. This forces every Topology to understand the concept of targets though... So
+        // instead I'll create a new Capability which is MultiTargetTopology and we'll see how it
+        // goes. It still does not feel right though.
+        //
+        // https://git.nationtech.io/NationTech/harmony/issues/106
+        match topology.current_target() {
+            DeploymentTarget::LocalDev => {
+                info!("Deploying {} locally...", self.application.name());
+                self.deploy_to_local_k3d(self.application.name(), helm_chart, image)
+                    .await?;
+            }
+            target => {
+                info!("Deploying {} to target {target:?}", self.application.name());
+
+                let score = ArgoHelmScore {
+                    namespace: format!("{}", self.application.name()),
+                    openshift: true,
+                    argo_apps: vec![ArgoApplication::from(CDApplicationConfig {
+                        // helm pull oci://hub.nationtech.io/harmony/harmony-example-rust-webapp-chart --version 0.1.0
+                        version: Version::from("0.1.0").unwrap(),
+                        helm_chart_repo_url: "hub.nationtech.io/harmony".to_string(),
+                        helm_chart_name: format!("{}-chart", self.application.name()),
+                        values_overrides: None,
+                        name: format!("{}", self.application.name()),
+                        namespace: format!("{}", self.application.name()),
+                    })],
+                };
+                score
+                    .interpret(&Inventory::empty(), topology)
+                    .await
+                    .unwrap();
+            }
+        };
+        Ok(())
+    }
     async fn deploy_to_local_k3d(
         &self,
         app_name: String,
@@ -153,50 +202,7 @@ impl<
         // https://git.nationtech.io/NationTech/harmony/issues/104
         let image = self.application.build_push_oci_image().await?;
 
-        // TODO: this is a temporary hack for demo purposes, the deployment target should be driven
-        // by the topology only and we should not have to know how to perform tasks like this for
-        // which the topology should be responsible.
-        //
-        // That said, this will require some careful architectural decisions, since the concept of
-        // deployment targets / profiles is probably a layer of complexity that we won't be
-        // completely able to avoid
-        //
-        // I'll try something for now that must be thought through after : att a deployment_profile
-        // function to the topology trait that returns a profile, then anybody who needs it can
-        // access it. This forces every Topology to understand the concept of targets though... So
-        // instead I'll create a new Capability which is MultiTargetTopology and we'll see how it
-        // goes. It still does not feel right though.
-        //
-        // https://git.nationtech.io/NationTech/harmony/issues/106
-        match topology.current_target() {
-            DeploymentTarget::LocalDev => {
-                info!("Deploying {} locally...", self.application.name());
-                self.deploy_to_local_k3d(self.application.name(), helm_chart, image)
-                    .await?;
-            }
-            target => {
-                info!("Deploying {} to target {target:?}", self.application.name());
-                let score = ArgoHelmScore {
-                    namespace: "harmony-example-rust-webapp".to_string(),
-                    openshift: true,
-                    domain: "argo.harmonydemo.apps.ncd0.harmony.mcd".to_string(),
-                    argo_apps: vec![ArgoApplication::from(CDApplicationConfig {
-                        // helm pull oci://hub.nationtech.io/harmony/harmony-example-rust-webapp-chart --version 0.1.0
-                        version: Version::from("0.1.0").unwrap(),
-                        helm_chart_repo_url: "hub.nationtech.io/harmony".to_string(),
-                        helm_chart_name: "harmony-example-rust-webapp-chart".to_string(),
-                        values_overrides: None,
-                        name: "harmony-demo-rust-webapp".to_string(),
-                        namespace: "harmony-example-rust-webapp".to_string(),
-                    })],
-                };
-                score
-                    .interpret(&Inventory::empty(), topology)
-                    .await
-                    .unwrap();
-            }
-        };
-        Ok(())
+        self.deploy(topology, helm_chart, image).await
     }
     fn name(&self) -> String {
         "ContinuousDelivery".to_string()

harmony/src/modules/application/features/helm_argocd_score.rs

@@ -1,16 +1,22 @@
 use async_trait::async_trait;
+use kube::{Api, api::GroupVersionKind};
+use log::{debug, warn};
 use non_blank_string_rs::NonBlankString;
 use serde::Serialize;
-use std::str::FromStr;
+use serde::de::DeserializeOwned;
+use std::{process::Command, str::FromStr, sync::Arc};
 
 use crate::{
-    data::{Id, Version},
+    data::Version,
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
     modules::helm::chart::{HelmChartScore, HelmRepository},
     score::Score,
-    topology::{HelmCommand, K8sclient, Topology},
+    topology::{
+        HelmCommand, K8sclient, PreparationError, PreparationOutcome, Topology, k8s::K8sClient,
+    },
 };
+use harmony_types::id::Id;
 
 use super::ArgoApplication;
 
@@ -18,15 +24,13 @@ use super::ArgoApplication;
 pub struct ArgoHelmScore {
     pub namespace: String,
     pub openshift: bool,
-    pub domain: String,
     pub argo_apps: Vec<ArgoApplication>,
 }
 
 impl<T: Topology + HelmCommand + K8sclient> Score<T> for ArgoHelmScore {
     fn create_interpret(&self) -> Box<dyn crate::interpret::Interpret<T>> {
-        let helm_score = argo_helm_chart_score(&self.namespace, self.openshift, &self.domain);
         Box::new(ArgoInterpret {
-            score: helm_score,
+            score: self.clone(),
             argo_apps: self.argo_apps.clone(),
         })
     }
@@ -38,7 +42,7 @@ impl<T: Topology + HelmCommand + K8sclient> Score<T> for ArgoHelmScore {
 
 #[derive(Debug)]
 pub struct ArgoInterpret {
-    score: HelmChartScore,
+    score: ArgoHelmScore,
     argo_apps: Vec<ArgoApplication>,
 }
 
@@ -49,9 +53,16 @@ impl<T: Topology + K8sclient + HelmCommand> Interpret<T> for ArgoInterpret {
         inventory: &Inventory,
         topology: &T,
     ) -> Result<Outcome, InterpretError> {
-        self.score.interpret(inventory, topology).await?;
-
         let k8s_client = topology.k8s_client().await?;
+        let domain = self
+            .get_host_domain(k8s_client.clone(), self.score.openshift)
+            .await?;
+        let domain = format!("argo.{domain}");
+        let helm_score =
+            argo_helm_chart_score(&self.score.namespace, self.score.openshift, &domain);
+
+        helm_score.interpret(inventory, topology).await?;
+
         k8s_client
             .apply_yaml_many(&self.argo_apps.iter().map(|a| a.to_yaml()).collect(), None)
             .await
@@ -84,6 +95,38 @@ impl<T: Topology + K8sclient + HelmCommand> Interpret<T> for ArgoInterpret {
     }
 }
 
+impl ArgoInterpret {
+    pub async fn get_host_domain(
+        &self,
+        client: Arc<K8sClient>,
+        openshift: bool,
+    ) -> Result<String, InterpretError> {
+        //This should be the job of the topology to determine if we are in
+        //openshift, potentially we need on openshift topology the same way we create a
+        //localhosttopology
+        match openshift {
+            true => {
+                let gvk = GroupVersionKind {
+                    group: "operator.openshift.io".into(),
+                    version: "v1".into(),
+                    kind: "IngressController".into(),
+                };
+                let ic = client
+                    .get_resource_json_value("default", Some("openshift-ingress-operator"), &gvk)
+                    .await?;
+
+                match ic.data["status"]["domain"].as_str() {
+                    Some(domain) => return Ok(domain.to_string()),
+                    None => return Err(InterpretError::new("Could not find domain".to_string())),
+                }
+            }
+            false => {
+                todo!()
+            }
+        };
+    }
+}
+
 pub fn argo_helm_chart_score(namespace: &str, openshift: bool, domain: &str) -> HelmChartScore {
     let values = format!(
         r#"
@@ -659,7 +702,7 @@ server:
       # nginx.ingress.kubernetes.io/ssl-passthrough: "true"
 
     # -- Defines which ingress controller will implement the resource
-    ingressClassName: ""
+    ingressClassName: "openshift-default"
 
     # -- Argo CD server hostname
     # @default -- `""` (defaults to global.domain)

harmony/src/modules/application/features/mod.rs

@@ -1,4 +1,6 @@
 mod endpoint;
+pub mod rhob_monitoring;
+mod multisite;
 pub use endpoint::*;
 
 mod monitoring;

harmony/src/modules/application/features/monitoring.rs

@@ -11,7 +11,7 @@ use crate::{
         alert_channel::webhook_receiver::WebhookReceiver, ntfy::ntfy::NtfyScore,
     },
     score::Score,
-    topology::{HelmCommand, K8sclient, Topology, Url, tenant::TenantManager},
+    topology::{HelmCommand, K8sclient, Topology, tenant::TenantManager},
 };
 use crate::{
     modules::prometheus::prometheus::PrometheusApplicationMonitoring,
@@ -19,6 +19,7 @@ use crate::{
 };
 use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose};
+use harmony_types::net::Url;
 use log::{debug, info};
 
 #[derive(Debug, Clone)]

harmony/src/modules/application/features/multisite.rs

@@ -0,0 +1,49 @@
+use std::sync::Arc;
+
+use crate::modules::application::{Application, ApplicationFeature, StatelessApplication};
+use crate::modules::monitoring::application_monitoring::application_monitoring_score::ApplicationMonitoringScore;
+use crate::modules::monitoring::kube_prometheus::crd::crd_alertmanager_config::CRDPrometheus;
+
+use crate::topology::{K8sAnywhereTopology, MultiTargetTopology};
+use crate::{
+    inventory::Inventory,
+    modules::monitoring::{
+        alert_channel::webhook_receiver::WebhookReceiver, ntfy::ntfy::NtfyScore,
+    },
+    score::Score,
+    topology::{HelmCommand, K8sclient, Topology, tenant::TenantManager},
+};
+use crate::{
+    modules::prometheus::prometheus::PrometheusApplicationMonitoring,
+    topology::oberservability::monitoring::AlertReceiver,
+};
+use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose};
+use harmony_types::net::Url;
+use log::{debug, info};
+
+trait DebugTopology: Topology + std::fmt::Debug {}
+
+#[derive(Debug, Clone)]
+pub struct Multisite {
+    app: Arc<dyn StatelessApplication>,
+    secondary_site: Arc<K8sAnywhereTopology>,
+}
+
+#[async_trait]
+impl<T: Topology> ApplicationFeature<T> for Multisite {
+    async fn ensure_installed(&self, topology: &T) -> Result<(), String> {
+
+        todo!(
+            "
+        - Find a way to get pvs for this application
+        - find the pv csi volumes uuid
+        - run rbd mirror image enable --pool mirrored-pool csi-vol-<UUID_PV> snapshot
+        - enjoy
+        "
+        )
+    }
+    fn name(&self) -> String {
+        "Multisite".to_string()
+    }
+}

harmony/src/modules/application/features/rhob_monitoring.rs

@@ -0,0 +1,109 @@
+use std::sync::Arc;
+
+use crate::modules::application::{Application, ApplicationFeature};
+use crate::modules::monitoring::application_monitoring::application_monitoring_score::ApplicationMonitoringScore;
+use crate::modules::monitoring::application_monitoring::rhobs_application_monitoring_score::ApplicationRHOBMonitoringScore;
+
+use crate::modules::monitoring::kube_prometheus::crd::rhob_alertmanager_config::RHOBObservability;
+use crate::topology::MultiTargetTopology;
+use crate::{
+    inventory::Inventory,
+    modules::monitoring::{
+        alert_channel::webhook_receiver::WebhookReceiver, ntfy::ntfy::NtfyScore,
+    },
+    score::Score,
+    topology::{HelmCommand, K8sclient, Topology, tenant::TenantManager},
+};
+use crate::{
+    modules::prometheus::prometheus::PrometheusApplicationMonitoring,
+    topology::oberservability::monitoring::AlertReceiver,
+};
+use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose};
+use harmony_types::net::Url;
+use log::{debug, info};
+
+#[derive(Debug, Clone)]
+pub struct RHOBMonitoring {
+    pub application: Arc<dyn Application>,
+    pub alert_receiver: Vec<Box<dyn AlertReceiver<RHOBObservability>>>,
+}
+
+#[async_trait]
+impl<
+    T: Topology
+        + HelmCommand
+        + 'static
+        + TenantManager
+        + K8sclient
+        + MultiTargetTopology
+        + std::fmt::Debug
+        + PrometheusApplicationMonitoring<RHOBObservability>,
+> ApplicationFeature<T> for RHOBMonitoring
+{
+    async fn ensure_installed(&self, topology: &T) -> Result<(), String> {
+        info!("Ensuring monitoring is available for application");
+        let namespace = topology
+            .get_tenant_config()
+            .await
+            .map(|ns| ns.name.clone())
+            .unwrap_or_else(|| self.application.name());
+
+        let mut alerting_score = ApplicationRHOBMonitoringScore {
+            sender: RHOBObservability {
+                namespace: namespace.clone(),
+                client: topology.k8s_client().await.unwrap(),
+            },
+            application: self.application.clone(),
+            receivers: self.alert_receiver.clone(),
+        };
+        let ntfy = NtfyScore {
+            namespace: namespace.clone(),
+            host: "ntfy.harmonydemo.apps.ncd0.harmony.mcd".to_string(),
+        };
+        ntfy.interpret(&Inventory::empty(), topology)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        let ntfy_default_auth_username = "harmony";
+        let ntfy_default_auth_password = "harmony";
+        let ntfy_default_auth_header = format!(
+            "Basic {}",
+            general_purpose::STANDARD.encode(format!(
+                "{ntfy_default_auth_username}:{ntfy_default_auth_password}"
+            ))
+        );
+
+        debug!("ntfy_default_auth_header: {ntfy_default_auth_header}");
+
+        let ntfy_default_auth_param = general_purpose::STANDARD
+            .encode(ntfy_default_auth_header)
+            .replace("=", "");
+
+        debug!("ntfy_default_auth_param: {ntfy_default_auth_param}");
+
+        let ntfy_receiver = WebhookReceiver {
+            name: "ntfy-webhook".to_string(),
+            url: Url::Url(
+                url::Url::parse(
+                    format!(
+                        "http://ntfy.{}.svc.cluster.local/rust-web-app?auth={ntfy_default_auth_param}",
+                        namespace.clone()
+                    )
+                    .as_str(),
+                )
+                .unwrap(),
+            ),
+        };
+
+        alerting_score.receivers.push(Box::new(ntfy_receiver));
+        alerting_score
+            .interpret(&Inventory::empty(), topology)
+            .await
+            .map_err(|e| e.to_string())?;
+        Ok(())
+    }
+    fn name(&self) -> String {
+        "Monitoring".to_string()
+    }
+}

harmony/src/modules/application/mod.rs

@@ -2,6 +2,10 @@ mod feature;
 pub mod features;
 pub mod oci;
 mod rust;
+mod stateless;
+mod stateful;
+pub use stateless::*;
+pub use stateful::*;
 use std::sync::Arc;
 
 pub use feature::*;
@@ -13,12 +17,13 @@ use async_trait::async_trait;
 use serde::Serialize;
 
 use crate::{
-    data::{Id, Version},
+    data::Version,
     instrumentation::{self, HarmonyEvent},
     interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
     inventory::Inventory,
     topology::Topology,
 };
+use harmony_types::id::Id;
 
 #[derive(Clone, Debug)]
 pub enum ApplicationFeatureStatus {

harmony/src/modules/application/rust.rs

@@ -1,4 +1,5 @@
-use std::fs;
+use std::fs::{self, File};
+use std::io::Read;
 use std::path::{Path, PathBuf};
 use std::process;
 use std::sync::Arc;
@@ -12,13 +13,12 @@ use dockerfile_builder::instruction_builder::CopyBuilder;
 use futures_util::StreamExt;
 use log::{debug, info, log_enabled};
 use serde::Serialize;
-use tar::Archive;
+use tar::{Archive, Builder, Header};
+use walkdir::WalkDir;
 
 use crate::config::{REGISTRY_PROJECT, REGISTRY_URL};
-use crate::{
-    score::Score,
-    topology::{Topology, Url},
-};
+use crate::{score::Score, topology::Topology};
+use harmony_types::net::Url;
 
 use super::{Application, ApplicationFeature, ApplicationInterpret, HelmPackage, OCICompliant};
 
@@ -61,6 +61,7 @@ pub struct RustWebapp {
     pub domain: Url,
     /// The path to the root of the Rust project to be containerized.
     pub project_root: PathBuf,
+    pub service_port: u32,
     pub framework: Option<RustWebFramework>,
 }
 
@@ -160,38 +161,35 @@ impl RustWebapp {
         image_name: &str,
     ) -> Result<String, Box<dyn std::error::Error>> {
         debug!("Generating Dockerfile for '{}'", self.name);
-        let _dockerfile_path = self.build_dockerfile()?;
+        let dockerfile = self.get_or_build_dockerfile();
+        let quiet = !log_enabled!(log::Level::Debug);
+        match dockerfile
+            .unwrap()
+            .file_name()
+            .and_then(|os_str| os_str.to_str())
+        {
+            Some(path_str) => {
+                debug!("Building from dockerfile {}", path_str);
+
+                let tar_data = self
+                    .create_deterministic_tar(&self.project_root.clone())
+                    .await
+                    .unwrap();
 
                 let docker = Docker::connect_with_socket_defaults().unwrap();
 
-        let quiet = !log_enabled!(log::Level::Debug);
-
-        let build_image_options = bollard::query_parameters::BuildImageOptionsBuilder::default()
-            .dockerfile("Dockerfile.harmony")
+                let build_image_options =
+                    bollard::query_parameters::BuildImageOptionsBuilder::default()
+                        .dockerfile(path_str)
                         .t(image_name)
                         .q(quiet)
                         .version(bollard::query_parameters::BuilderVersion::BuilderV1)
                         .platform("linux/x86_64");
 
-        let mut temp_tar_builder = tar::Builder::new(Vec::new());
-        temp_tar_builder
-            .append_dir_all("", self.project_root.clone())
-            .unwrap();
-        let archive = temp_tar_builder
-            .into_inner()
-            .expect("couldn't finish creating tar");
-        let archived_files = Archive::new(archive.as_slice())
-            .entries()
-            .unwrap()
-            .map(|entry| entry.unwrap().path().unwrap().into_owned())
-            .collect::<Vec<_>>();
-
-        debug!("files in docker tar: {:#?}", archived_files);
-
                 let mut image_build_stream = docker.build_image(
                     build_image_options.build(),
                     None,
-            Some(body_full(archive.into())),
+                    Some(body_full(tar_data.into())),
                 );
 
                 while let Some(msg) = image_build_stream.next().await {
@@ -201,6 +199,63 @@ impl RustWebapp {
                 Ok(image_name.to_string())
             }
 
+            None => Err(Box::new(std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                "Path is not valid UTF-8",
+            ))),
+        }
+    }
+
+    ///normalizes timestamp and ignores files that will bust the docker cache
+    async fn create_deterministic_tar(
+        &self,
+        project_root: &std::path::Path,
+    ) -> Result<Vec<u8>, Box<dyn std::error::Error>> {
+        debug!("building tar file from project root {:#?}", project_root);
+        let mut tar_data = Vec::new();
+        {
+            let mut builder = Builder::new(&mut tar_data);
+            let ignore_prefixes = [
+                "target",
+                ".git",
+                ".github",
+                ".harmony_generated",
+                "node_modules",
+            ];
+            let mut entries: Vec<_> = WalkDir::new(project_root)
+                .into_iter()
+                .filter_map(Result::ok)
+                .filter(|e| e.file_type().is_file())
+                .filter(|e| {
+                    let rel_path = e.path().strip_prefix(project_root).unwrap();
+                    !ignore_prefixes
+                        .iter()
+                        .any(|prefix| rel_path.starts_with(prefix))
+                })
+                .collect();
+            entries.sort_by_key(|e| e.path().to_owned());
+
+            for entry in entries {
+                let path = entry.path();
+                let rel_path = path.strip_prefix(project_root).unwrap();
+
+                let mut file = fs::File::open(path)?;
+                let mut header = Header::new_gnu();
+
+                header.set_size(entry.metadata()?.len());
+                header.set_mode(0o644);
+                header.set_mtime(0);
+                header.set_uid(0);
+                header.set_gid(0);
+
+                builder.append_data(&mut header, rel_path, &mut file)?;
+            }
+
+            builder.finish()?;
+        }
+        Ok(tar_data)
+    }
+
     /// Tags and pushes a Docker image to the configured remote registry.
     async fn push_docker_image(
         &self,
@@ -274,8 +329,11 @@ impl RustWebapp {
                     "groupadd -r appgroup && useradd -r -s /bin/false -g appgroup appuser",
                 ));
 
-                dockerfile.push(ENV::from("LEPTOS_SITE_ADDR=0.0.0.0:3000"));
-                dockerfile.push(EXPOSE::from("3000/tcp"));
+                dockerfile.push(ENV::from(format!(
+                    "LEPTOS_SITE_ADDR=0.0.0.0:{}",
+                    self.service_port
+                )));
+                dockerfile.push(EXPOSE::from(format!("{}/tcp", self.service_port)));
                 dockerfile.push(WORKDIR::from("/home/appuser"));
 
                 // Copy static files
@@ -396,7 +454,7 @@ image:
 
 service:
   type: ClusterIP
-  port: 3000
+  port: {}
 
 ingress:
   enabled: true
@@ -416,112 +474,123 @@ ingress:
        - chart-example.local
 
 "#,
-            chart_name, image_repo, image_tag, self.name
+            chart_name, image_repo, image_tag, self.service_port, self.name
         );
         fs::write(chart_dir.join("values.yaml"), values_yaml)?;
 
         // Create templates/_helpers.tpl
-        let helpers_tpl = r#"
-{{/*
+        let helpers_tpl = format!(
+            r#"
+{{{{/*
 Expand the name of the chart.
-*/}}
-{{- define "chart.name" -}}
-{{- default .Chart.Name $.Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
+*/}}}}
+{{{{- define "chart.name" -}}}}
+{{{{- default .Chart.Name $.Values.nameOverride | trunc 63 | trimSuffix "-" }}}}
+{{{{- end }}}}
 
-{{/*
+{{{{/*
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-*/}}
-{{- define "chart.fullname" -}}
-{{- $name := default .Chart.Name $.Values.nameOverride }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-"#;
+*/}}}}
+{{{{- define "chart.fullname" -}}}}
+{{{{- $name := default .Chart.Name $.Values.nameOverride }}}}
+{{{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}}}
+{{{{- end }}}}
+"#
+        );
         fs::write(templates_dir.join("_helpers.tpl"), helpers_tpl)?;
 
         // Create templates/service.yaml
-        let service_yaml = r#"
+        let service_yaml = format!(
+            r#"
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "chart.fullname" . }}
+  name: {{{{ include "chart.fullname" . }}}}
 spec:
-  type: {{ $.Values.service.type }}
+  type: {{{{ $.Values.service.type }}}}
   ports:
     - name: main
-      port: {{ $.Values.service.port | default 3000 }}
-      targetPort: {{ $.Values.service.port | default 3000 }}
+      port: {{{{ $.Values.service.port | default {} }}}}
+      targetPort: {{{{ $.Values.service.port | default {} }}}}
       protocol: TCP
   selector:
-    app: {{ include "chart.name" . }}
-"#;
+    app: {{{{ include "chart.name" . }}}}
+"#,
+            self.service_port, self.service_port
+        );
         fs::write(templates_dir.join("service.yaml"), service_yaml)?;
 
         // Create templates/deployment.yaml
-        let deployment_yaml = r#"
+        let deployment_yaml = format!(
+            r#"
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "chart.fullname" . }}
+  name: {{{{ include "chart.fullname" . }}}}
 spec:
-  replicas: {{ $.Values.replicaCount }}
+  replicas: {{{{ $.Values.replicaCount }}}}
   selector:
     matchLabels:
-      app: {{ include "chart.name" . }}
+      app: {{{{ include "chart.name" . }}}}
   template:
     metadata:
       labels:
-        app: {{ include "chart.name" . }}
+        app: {{{{ include "chart.name" . }}}}
     spec:
       containers:
-        - name: {{ .Chart.Name }}
-          image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ $.Values.image.pullPolicy }}
+        - name: {{{{ .Chart.Name }}}}
+          image: "{{{{ $.Values.image.repository }}}}:{{{{ $.Values.image.tag | default .Chart.AppVersion }}}}"
+          imagePullPolicy: {{{{ $.Values.image.pullPolicy }}}}
           ports:
             - name: main
-              containerPort: {{ $.Values.service.port | default 3000 }}
+              containerPort: {{{{ $.Values.service.port | default {} }}}}
               protocol: TCP
-"#;
+"#,
+            self.service_port
+        );
         fs::write(templates_dir.join("deployment.yaml"), deployment_yaml)?;
 
         // Create templates/ingress.yaml
-        let ingress_yaml = r#"
-{{- if $.Values.ingress.enabled -}}
+        let ingress_yaml = format!(
+            r#"
+{{{{- if $.Values.ingress.enabled -}}}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ include "chart.fullname" . }}
+  name: {{{{ include "chart.fullname" . }}}}
   annotations:
-    {{- toYaml $.Values.ingress.annotations | nindent 4 }}
+    {{{{- toYaml $.Values.ingress.annotations | nindent 4 }}}}
 spec:
-  {{- if $.Values.ingress.tls }}
+  {{{{- if $.Values.ingress.tls }}}}
   tls:
-    {{- range $.Values.ingress.tls }}
+    {{{{- range $.Values.ingress.tls }}}}
     - hosts:
-        {{- range .hosts }}
-        - {{ . | quote }}
-        {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
+        {{{{- range .hosts }}}}
+        - {{{{ . | quote }}}}
+        {{{{- end }}}}
+      secretName: {{{{ .secretName }}}}
+    {{{{- end }}}}
+  {{{{- end }}}}
   rules:
-    {{- range $.Values.ingress.hosts }}
-    - host: {{ .host | quote }}
+    {{{{- range $.Values.ingress.hosts }}}}
+    - host: {{{{ .host | quote }}}}
       http:
         paths:
-          {{- range .paths }}
-          - path: {{ .path }}
-            pathType: {{ .pathType }}
+          {{{{- range .paths }}}}
+          - path: {{{{ .path }}}}
+            pathType: {{{{ .pathType }}}}
             backend:
               service:
-                name: {{ include "chart.fullname" $ }}
+                name: {{{{ include "chart.fullname" $ }}}}
                 port:
-                  number: {{ $.Values.service.port | default 3000 }}
-          {{- end }}
-    {{- end }}
-{{- end }}
-"#;
+                  number: {{{{ $.Values.service.port | default {} }}}}
+          {{{{- end }}}}
+    {{{{- end }}}}
+{{{{- end }}}}
+"#,
+            self.service_port
+        );
         fs::write(templates_dir.join("ingress.yaml"), ingress_yaml)?;
 
         Ok(chart_dir)
@@ -573,7 +642,6 @@ spec:
         let chart_file_name = packaged_chart_path.file_stem().unwrap().to_str().unwrap();
         let oci_push_url = format!("oci://{}/{}", *REGISTRY_URL, *REGISTRY_PROJECT);
         let oci_pull_url = format!("{oci_push_url}/{}-chart", self.name);
-
         debug!(
             "Pushing Helm chart {} to {}",
             packaged_chart_path.to_string_lossy(),
@@ -592,4 +660,20 @@ spec:
         debug!("push url {oci_push_url}");
         Ok(format!("{}:{}", oci_pull_url, version))
     }
+
+    fn get_or_build_dockerfile(&self) -> Result<PathBuf, Box<dyn std::error::Error>> {
+        let existing_dockerfile = self.project_root.join("Dockerfile");
+
+        debug!("project_root = {:?}", self.project_root);
+
+        debug!("checking = {:?}", existing_dockerfile);
+        if existing_dockerfile.exists() {
+            debug!(
+                "Checking path {:#?} for existing Dockerfile",
+                self.project_root.clone()
+            );
+            return Ok(existing_dockerfile);
+        }
+        self.build_dockerfile()
+    }
 }