Jenkins LTS, Secured On First Start, Proven By A Job Built
Jenkins LTS (sha256-verified war) on Java 21, secured on its first start without the wizard, on EL 10 from the upstream release, as a hardened systemd service on loopback; the live test sees anonymous and wrong-password requests refused, creates a freestyle job through the API with a CSRF crumb, builds it to SUCCESS, reads the console and deletes it. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-21 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-jenkins?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [Jenkins LTS, Secured On First Start, Proven By A Job Built](https://www.iac-bazaar.com/catalog/ansible-jenkins?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# Jenkins LTS, Secured On First Start, Proven By A Job Built: https://www.iac-bazaar.com/catalog/ansible-jenkins (download from your IaC Bazaar account)
```Preview:
Documentation
jenkins
Jenkins LTS from the upstream war (sha256-verified against the file
published beside it), on Java 21 from AppStream, secured on its first start
without the setup wizard, as a hardened system service on loopback with
its home under /var/lib/jenkins. Original role for EL 10, live-tested
with podman on Rocky Linux 10.
No package, and the war is run in place. EL 10 carries no Jenkins;
the project publishes jenkins.war with a jenkins.war.sha256 beside it.
This role downloads both, has Ansible's get_url refuse the war unless
its SHA-256 is the published one, stores it under /usr/local/src as
jenkins-<version>.war and hands it to java -jar: nothing is copied
into the PATH, and the version is in the unit.
A service account, a hardened unit, a loopback listener. jenkins
is a system user with no shell that owns the data directory and nothing
else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and
ProtectSystem=strict. The listener is 127.0.0.1 by default,
for a proxy that authenticates or a client on the same host; the live test
reads the listening sockets and expects loopback only.
Proven by a job that ran. The live test sees an anonymous API request
refused (403) and a wrong password refused (401), reads the API as the
admin with the version header, takes a CSRF crumb, creates a freestyle job
with one shell step, queues a build, waits for SUCCESS, reads lane-ok
in the console and deletes the job.
Secured on the first start, unattended. The setup wizard is skipped
and an init script (the documented init.groovy.d hook) sets a private
user database with the first admin from a root-owned EnvironmentFile,
full control once logged in and no anonymous read; it runs on every start,
so those three settings are re-applied. Plugins are the operator's:
install them through the UI or the CLI once the service is up. Usage
statistics are off.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-atmos
atmos on EL 10 from the GitHub release, get_url refuses it unless its SHA-256 is the one in the vendor's SHA256SUMS, and the live test re-checks it, then writes an atmos.yaml, a stack and a component, validates the stacks and describes the component with no Terraform installed. Pinned. Original role, live-tested on Rocky Linux 10.
ansible-checkov
Checkov pinned in /opt/checkov, a virtual environment apart from the system Python. The live test runs pip check, scans a one-resource module with the built-in checks and --skip-download and expects a 'Failed checks:' summary with no network, and asserts the system Python cannot import it. Original role, live-tested on Rocky Linux 10.
ansible-conftest
conftest on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in the project's checksums.txt, and re-checked with sha256sum -c by the live test, which then writes a one-rule Rego v1 policy and a one-line document, runs conftest test and expects the denial in the report. Original role, live-tested on Rocky Linux 10.
ansible-consul-cli
consul on EL 10 from releases.hashicorp.com: the client binary, not a server. HashiCorp's key lives in a GnuPG home of its own, pinned by fingerprint; the SHA256SUMS signature is verified before get_url checks the zip against that file, and the live test verifies it again, then runs consul members against nothing and expects the refused connection. Original role, live-tested on Rocky Linux 10.
ansible-gh-cli
gh on EL 10 from the release tarball, refused by Ansible's get_url unless its SHA-256 is the one in GitHub's checksums file, and re-checked with sha256sum -c by the live test; one more file to trust and no more repositories. Tokens are per user; gh auth status with none stops at 'not logged into any GitHub hosts', the live test's proof the client ran. Original role, live-tested on Rocky Linux 10.
ansible-glab
glab on EL 10 from the GitLab-hosted release, get_url refuses it unless its SHA-256 is the one in the vendor's checksums file, and the live test re-checks it, then runs auth status to the 401 gitlab.com returns and round-trips a config value offline. Pinned. Original role, live-tested on Rocky Linux 10.