New docs/md/ansipa-administration.md — an operations-focused guide, separate
from the architecture doc (freeipa-ansible.md) and the deployment guide
(ansipa-setup.md). Covers:
- How administration works: group-driven, the policy enforcer vs the software
installer timers, host- vs user-group scope, immediate-apply commands, and
the everyday ipa hostgroup/group commands.
- The full policy catalogue with per-policy apply/revert behaviour, targeting
(name suffix vs group description), and prerequisites:
device (dev_daemon-*, dev_timeshift-backup, dev_no-local-users,
dev_local-sudo-*, dev_ssh_*), monitoring (dev_mon_base/clamscan/timeshift/
power, usr_mon_logins), software installers (dev_pkg_*, dev_mod_*, dev_fp_*),
user (usr_admin, usr_block-binary-*, usr_prt_*, usr_smb_*), and BaseUser sync.
- Common recipes (onboard a workstation, grant/block, live policy editing) and
a troubleshooting table.
Linked from the docs index.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi
