Baseconfig role for org_all_hec_inputs (HEC on chosen roles)

Summary

Add first-class baseconfig support for org_all_hec_inputs: HTTP Event Collector on chosen Splunk roles (not only a generic splunk_app_deployment local app). Follow the same pattern as org_all_indexes: include_role: baseconfig_app with app_name: org_all_hec_inputs, a baseconfig_app task file that templates inputs.conf from splunk_config.yml, and callers on indexer / HF / other roles as configured.

Today HEC is only hinted as a commented generic app in examples/single_node_itsi.yml (org_all_hec_inputs + customizations.local_configs). That path does not install from the Professional Services / Software baseconfig tree or apply the same way other org_* apps do.

The app layout (copy into splunk_baseconfig_dir like other org_* apps; do not vendor secrets): app.conf, metadata/local.meta (export = system), local/inputs.conf with [http] (port 8088, disabled = 0) and [http://<input_name>] stanzas (index, indexes, token). SSL knobs on [http] exist but must not ship a plaintext sslPassword.

Ship

• ansible/roles/baseconfig_app/tasks/org_all_hec_inputs.yml (and defaults as needed): copy/render the app; set port, enable/disable, token stanzas from config. Tokens via lookup('env') / !vault / #52 — never print HEC tokens in CLI, logs, or agent JSON.
• Call baseconfig_app from the Splunk roles that should listen (typical: indexer; also HF / others when config says so). Pickup: config key for target roles (not hardcoded indexer-only). Skip when HEC is unset so lab examples stay valid.
• Schema + catalog: list of inputs (stanza name, default index, allowed indexes, token ref). Optional SSL (enableSSL, cert paths) aligned with #69 — no commented sslPassword = password.
• App files live in the operator’s Software/baseconfig tree (org_all_hec_inputs), same discovery as other org_* apps. SPA does not ship PS trees; document the expected folder name.
• Distinct from deploying the same folder as source: local under splunk_app_deployment. Prefer the baseconfig role so DS/CM/deployer/direct routing matches other org_* apps.
• Tests: schema; role wiring / app-scope if applicable; fixtures use placeholders only.
• Docs + example (uncomment/replace the ITSI HEC comment with the new config shape).

Related

• Existing baseconfig_app / org_all_indexes callers
• #69 certs, #52 auth
• ROADMAP load balancer / HEC on indexers (ingress is separate from enabling HEC inputs)

Notes

Pickup-ready enhancement. Never commit real HEC tokens or sslPassword values.

Compare the existing baseconfig_app and org_all_indexes callers, then inspect ansible/roles/baseconfig_app/tasks and the schema, catalog, and role-wiring tests. Trace how splunk_config.yml reaches chosen roles and how app files are discovered under splunk_baseconfig_dir. Done means HEC is skipped when unset, configured app inputs are wired to selected roles without exposing tokens, tests use placeholders, and the ITSI example and docs describe the folder and config shape.