[embtom]

…hi discovery

[Copilot]

🟡 Changes recommended

Missing local credentials and premature hostapd startup can abort deployment, and the Vault helper accepts invalid passphrase lengths.

3 open issues

• Disable routing by default in the localhost inventory · New
• Start hostapd only after the interface rename is available · New
• Validate passphrase length before creating the vault · New

What changed in this PR

This PR adds static network-scanner configuration without automatic discovery. It also extends the router role with a WPA2 Wi-Fi access point and local Ansible Vault support.

Changes:

• Add an optional sane_airscan role and scanner deployment tag.
• Configure hostapd through the router role.
• Add encrypted passphrase creation, deployment prompts, and setup documentation.

File	Description
scripts/​deploy	Add explicit and automatic Vault password prompts.
scripts/​create-router-access-point-vault	Create an encrypted access-point passphrase file.
README.md	Document scanner and Wi-Fi access-point setup.
ansible/​roles/​sane_airscan/​templates/​airscan.conf.j2	Define static scanners and disable discovery.
ansible/​roles/​sane_airscan/​tasks/​main.yml	Install scanner packages and configure backends.
ansible/​roles/​sane_airscan/​defaults/​main.yml	Define optional scanner settings.
ansible/​roles/​router/​templates/​hostapd.conf.j2	Configure the WPA2 access point.
ansible/​roles/​router/​tasks/​main.yml	Validate access-point settings and manage hostapd.
ansible/​roles/​router/​handlers/​main.yml	Add a hostapd restart handler.
ansible/​roles/​router/​defaults/​main.yml	Define optional access-point defaults.
ansible/​playbooks/​workstation.yml	Include the scanner role and tag.
ansible/​inventories/​production/​host_vars/​localhost/​main.yml	Enable local router, access-point, and scanner settings.
ansible/​inventories/​production/​host_vars/​localhost.yml	Remove the previous flat localhost variables file.
.vscode/​tasks.json	Add the scanner deployment option.
.gitignore	Exclude the local encrypted Vault file.

_{Review effort: Balanced}

[Copilot]

Deferred hostapd startup and its notified restart until the configured LAN interface exists, while still enabling the service for after reboot. Commit: fd575fc.