New Customer Checklist

An ordered, end-to-end checklist for onboarding a new customer — from infrastructure through a verified playbook run. Each step links to the detailed doc for that piece; treat this page as the map, not the manual.

1. Confirm infrastructure requirements

Network reachability confirmed: port 22 to Linux hosts, 5985/5986 to Windows hosts → Requirements → Network
Cloud-specific requirements provisioned (EFS, subnets, IAM roles for AWS; storage, NSG rule, managed identity for Azure) → Requirements → AWS Container / Azure Container

2. Deploy the Ansible container

Image variant and access mode chosen (SSH, VS Code tunnel, or Coder workspace) → Containers → Access Modes
Image built and published to this customer's registry, if not already available → Containers → Publishing Images
GitHub Actions runner wired up, if this customer needs CI-driven playbook runs (optional) → Containers → GitHub Actions Runner

3. Create the customer's repository

Create a copy of this repo in the customer's own SCM (GitHub, GitLab, etc.) — either a fork or a fresh repo seeded from this one, depending on how much of Sapphire's upstream role and playbook updates should keep flowing in.
Everything below happens inside that copy: inventory files, group_vars/host_vars, extra_vars/, and ansible.cfg are all customer-specific and should never point back at Sapphire's own accounts, vaults, or secrets.

4. Set up inventory

inventory.aws_ec2.yml / inventory.azure_rm.yml configured for the customer's account or subscription → Inventory → AWS / Azure
Discovery identity granted read access (IAM ec2:DescribeInstances / Azure Reader role) → Inventory → AWS Authentication / Azure Authentication

Verified:

ansible-inventory --list --yaml
ansible-inventory --graph

5. Set up secret management

Vault(s) created with the role secrets this deployment needs (SQL passwords, Kuiper credentials, etc.) — group_vars/all/vault.yml for a single-environment deployment, environment-scoped group vaults when more than one environment shares the inventory → Secret Management
Per-group vaults set up for connection secrets, e.g. ansible_password for Windows groups → Secret Management → Global Secrets
Vault password supply method decided — cloud-backed script, --ask-vault-pass, or a gitignored file → Secret Management → Automating Vault Password Entry

6. Set up SSH authentication

Production setup checklist completed → SSH Authentication → Overview

7. Verify connectivity

bash ansible -m ping all --limit _Red_Hat_Enterprise_Linux ansible -m win_ping all --limit _Windows

8. Configure the roles this customer actually uses

Only set up what applies — most customers won't need every role.

Component	Doc
Storage provisioning	Storage
Microsoft SQL	Microsoft SQL
Iris	Iris
Kuiper	Kuiper
System Pulse	System Pulse
gMSA	gMSA
Certificate Authority	Certificate Authority
Perimeter Auth	Perimeter Auth
firewalld	firewalld
Linux Exporter	Linux Exporter

9. Run a real playbook — check mode first

bash ansible-playbook --limit=<host> playbooks/<name>.yml --check

Then for real:

ansible-playbook --limit=<host> playbooks/<name>.yml