Evgeni Golov

And maybe more to the "why": https://projects.theforeman.org/issues/35397 speaks about missing parameters, like `keyboard`, cool, but I can't find a `ubuntu_mirror_uri` parameter anywhere. Not saying this change as such is wrong,...

> > Okay, and then the user ends up with a system that has the updates/security repos disabled, and you need a config management tool to re-enable them? > >...

I have a conceptual question. We have CSRF protection on the normal `extlogin` page, so that nobody can build a fake and abuse that (as the fake won't have the...

Yes, but wouldn't hitting `/api/users/extlogin` in the current setup with an existing session "upgrade" said session to a CSRF-less one without further user interaction?

Okay, no, one can't upgrade a session to an API one. I shut up ;)

LGTM and I don't think it *needs* to wait for the Puppet changes. It won't work without them in prod setups, but it also won't break and all we discussed...

Added some minor comments. Would be cool if there would be a few lines in the readme, how to use this role?

I agree that the roles are under-documented, even if most roles are not designed to be used on their own, but are rather abstractions most users shouldn't have to care...

> This does require [theforeman/jenkins-jobs#266](https://github.com/theforeman/jenkins-jobs/pull/266) as well, right? Yes. Well, doesn't *require*, but Jenkins would fail to fetch the bits without it.

I must admit I am not a fan of `fqcn-builtins` and writing out `ansible.builtin.foo`. The only "good" reason for the long notation is that it allows having a local `foo`...