Include profile::boot_security_upgrade in role::openvpn_server

[akuzminsky]

Next service after role::jumphost (#296). Same one-line shape:

  include 'profile::base'
  include 'profile::openvpn_server'

+ # Patch during provisioning so Inspector's first scan sees an already-patched
+ # host. Takes the default fail_on_error => false: the VPN server is long-lived
+ # and not disposable, so an unpatched-but-reachable server beats an ABANDONed
+ # one.
+ include 'profile::boot_security_upgrade'

role/ lives only in global modules/ — environments carry just profile/ — so this one file covers all three environments.

Why openvpn next

Checked the sandbox account before picking. The jumphost and actions-runner ASGs are currently the only two stamping InspectorEc2Exclusion, and no running instance carries the tag — every launched instance got tagged and Puppet removed it. The mechanism is working, so extending it is low risk.

openvpn is ASG-backed, exists in both sandbox and prod so it can be rehearsed, and runs two instances — which matters for the cohort-relative coverage detector proposed in the reconciliation-lag writeup, since that check needs a same-AMI sibling to compare against.

Works without the Terraform side

No InspectorEc2Exclusion tag is set on the openvpn ASG yet. That is fine and deliberate: delete-tags ignores a key that is not present, and every failure path in the script logs and returns 0. Until the Terraform change lands this simply patches at boot, which is worth having on its own.

Verification

Thinner than #296, by necessity. role::openvpn_server does not compile on a laptop — and does not compile at HEAD either, without this change (exit 1, no output). profile::openvpn_server needs provisioning-time inputs that cannot be stubbed here, so the failure is pre-existing and unrelated. I confirmed that by compiling both with and without the change rather than assuming it.

What was checked:

• puppet-lint --fail-on-warnings modules/role — clean
• puppet parser validate — clean
• Neither cloud-guest-utils nor awscli is declared by profile::openvpn_server or its sub-manifests, which was the only plausible duplicate-declaration collision (profile::boot_security_upgrade declares the first and includes profile::packages for the second, while the role already pulls profile::base)

Worth a real check on the first sandbox apply, since CI does not compile catalogs.

Not in scope

• The InspectorEc2Exclusion tag and ec2:DeleteTags in terraform-aws-openvpn — follows separately, same shape as terraform-aws-jumphost
• Elasticsearch roles — deliberately left alone; they suppress automatic service restarts and deserve their own decision
• BookStack — postponed

🤖 Generated with Claude Code

https://claude.ai/code/session_01KLGAXtoyoakLXUjaJSL4M3