dreadnode · mkultraWasHere · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 4, 2026
diff --git a/.github/renovate.json5 b/.github/renovate.json5
@@ -74,11 +74,11 @@
       ],
     },
     {
-      description: 'Disable updates for ansible-core (pinned to <2.18 due to SSM pipelining bug)',
+      description: 'Pin ansible-core to 2.20.x (2.19 breaks Windows/SSM, fixed in 2.20)',
       matchPackageNames: [
         'ansible-core',
       ],
-      enabled: false,
+      allowedVersions: '>=2.20.0,<2.21.0',
     },
     {
       description: 'Auto-merge pip dependencies',

diff --git a/.gitignore b/.gitignore
@@ -17,6 +17,15 @@ dreadgoad
 .dreadgoad/
 coverage.out
 
+# Web app build artifacts
+console/frontend/node_modules/
+console/frontend/dist/
+console/frontend/*.tsbuildinfo
+
+# Generated ADCS template archives (main tracks the sources, not the zips)
+ansible/roles/adcs_templates/files/ADCSTemplate.zip
+ansible/roles/vulns_adcs_templates/files/ADCSTemplate.zip
+
 # Root environment inventories are local runtime state.
 /*-inventory
 /*-inventory.bak.*

diff --git a/.hooks/linters/ansible-lint.yaml b/.hooks/linters/ansible-lint.yaml
@@ -57,3 +57,6 @@ skip_list:
   - fqcn[action]
   - fqcn[action-core]
   - jinja[spacing]
+  # ansible-lint's requires_ansible allowlist lags behind actual releases;
+  # 2.20 is GA but the linter only knows up to 2.19.
+  - meta-runtime[unsupported-version]
diff --git a/.hooks/requirements.txt b/.hooks/requirements.txt
@@ -1,3 +1,3 @@
-ansible-core==2.20.4
+ansible-core>=2.20.0,<2.21.0
 docsible==0.8.0
 pre-commit==4.6.2
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -31,15 +31,15 @@ repos:
     hooks:
       - id: codespell
         entry: codespell -q 3 -f -S ".git,.github,README.md" -L "mot,fonction,connexion"
-        exclude: '(go\.sum|\.min\.css\.map|\.css\.map|\.min\.map|\.min\.js|sysmonconfig-export\.xml|jquery\.validate\.(min\.)?js|jquery-3\.4\.1(\.slim)?\.js|modernizr-[\d\.]+\.js)$'
+        exclude: '(go\.sum|package-lock\.json|\.min\.css\.map|\.css\.map|\.min\.map|\.min\.js|sysmonconfig-export\.xml|jquery\.validate\.(min\.)?js|jquery-3\.4\.1(\.slim)?\.js|modernizr-[\d\.]+\.js)$'
 
   - repo: https://github.com/jumanjihouse/pre-commit-hooks
     rev: 3.0.0
     hooks:
       - id: script-must-have-extension
         name: Ensure shell scripts end with .sh
         types: [shell]
-        exclude: '\.sh\.tpl$'
+        exclude: '(^dreadgoad-console$|\.sh\.tpl$)'
       - id: shellcheck
         exclude: '\.sh\.tpl$'
       - id: shfmt

diff --git a/Dockerfile b/Dockerfile
@@ -4,7 +4,7 @@ RUN apt-get update \
     && apt-get install -y python3-pip
 
 RUN pip install --upgrade pip
-RUN pip install ansible-core==2.12.6
+RUN pip install 'ansible-core>=2.20.0,<2.21.0'
 RUN pip install pywinrm
 
 RUN apt-get update -y && \

diff --git a/README.md b/README.md
@@ -13,6 +13,7 @@ environments for penetration testing and security research.
 DreadGOAD extends the upstream GOAD project with:
 
 - **Go CLI (`dreadgoad`)** -- single binary for provisioning, health checks, trust verification, and vulnerability validation
+- **Web console (`dreadgoad-console`)** -- agentic chat UI for building, managing, and validating lab ranges with a live topology view
 - **AWS infrastructure automation** -- Terragrunt/Terraform modules for deploying labs in AWS with SSM-based management (no open ports)
 - **Modular extension system** -- plug-in extensions for ELK, Exchange, Wazuh, Guacamole, and more
 - **Variant generator** -- create graph-isomorphic lab copies with randomized entity names while preserving all attack paths
@@ -46,7 +47,7 @@ for the full catalog, which is scoped to the full GOAD lab.
 
 ### Prerequisites
 
-- ansible-core >= 2.15, < 2.19 (the upper bound matters: 2.19 changed pipelining in ways that break the Windows modules over AWS SSM)
+- ansible-core >= 2.20, < 2.21 (2.19 breaks Windows modules over AWS SSM — [ansible/ansible#86397](https://github.com/ansible/ansible/issues/86397); fixed in 2.20)
 - Go 1.26+ (for building the CLI)
 - A supported infrastructure provider (VirtualBox, VMware, Proxmox, AWS, Azure, or Ludus)
 
@@ -90,6 +91,7 @@ Create a randomized copy of any lab with unique names but identical attack paths
 
 ## Documentation
 
+- [Console guide](console/README.md) -- web UI quick start, commands, and environment variables
 - [CLI reference](docs/cli.md) -- command index plus Viper-based config, environment variables, and per-environment settings
 - [Domains and users](docs/domains-and-users.md) -- full network topology, credentials, and attack paths
 - [Vulnerability catalog](docs/GOAD-vulnerabilities-comprehensive.md) -- 50+ vulnerabilities in the full GOAD lab, with exploitation techniques
@@ -109,6 +111,7 @@ DreadGOAD/
 ├── ad/                    # Lab definitions (GOAD, GOAD-Light, MINILAB, SCCM, NHA, ...)
 ├── ansible/               # Ansible collection with 120+ roles and custom modules
 ├── cli/                   # Go CLI source (dreadgoad), including the variant generator
+├── console/               # Web console -- agentic chat + live range topology (Python/TypeScript)
 ├── docs/                  # Documentation and architecture diagrams
 ├── extensions/            # Pluggable lab extensions (ELK, Exchange, Wazuh, ...)
 ├── infra/                 # Terragrunt configurations for AWS deployments

diff --git a/ad/GOAD-Light/scripts/constrained_delegation_kerb_only.ps1 b/ad/GOAD-Light/scripts/constrained_delegation_kerb_only.ps1
@@ -14,5 +14,5 @@ if ($computer.ServicePrincipalNames -notcontains $spn) {
 
 $missing = @($delegateTo | Where-Object { $computer.'msDS-AllowedToDelegateTo' -notcontains $_ })
 if ($missing.Count -gt 0) {
-    Set-ADComputer -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = $missing }
+    Set-ADComputer -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = [string[]]$missing }
 }
diff --git a/ad/GOAD-Light/scripts/constrained_delegation_use_any.ps1 b/ad/GOAD-Light/scripts/constrained_delegation_use_any.ps1
@@ -16,5 +16,5 @@ Set-ADAccountControl -Identity $identity -TrustedToAuthForDelegation $true
 
 $missing = @($delegateTo | Where-Object { $user.'msDS-AllowedToDelegateTo' -notcontains $_ })
 if ($missing.Count -gt 0) {
-    Set-ADUser -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = $missing }
+    Set-ADUser -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = [string[]]$missing }
 }
diff --git a/ad/GOAD/scripts/constrained_delegation_kerb_only.ps1 b/ad/GOAD/scripts/constrained_delegation_kerb_only.ps1
@@ -14,5 +14,5 @@ if ($computer.ServicePrincipalNames -notcontains $spn) {
 
 $missing = @($delegateTo | Where-Object { $computer.'msDS-AllowedToDelegateTo' -notcontains $_ })
 if ($missing.Count -gt 0) {
-    Set-ADComputer -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = $missing }
+    Set-ADComputer -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = [string[]]$missing }
 }
diff --git a/ad/GOAD/scripts/constrained_delegation_use_any.ps1 b/ad/GOAD/scripts/constrained_delegation_use_any.ps1
@@ -15,5 +15,5 @@ Set-ADAccountControl -Identity $identity -TrustedToAuthForDelegation $true
 
 $missing = @($delegateTo | Where-Object { $user.'msDS-AllowedToDelegateTo' -notcontains $_ })
 if ($missing.Count -gt 0) {
-    Set-ADUser -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = $missing }
+    Set-ADUser -Identity $identity -Add @{'msDS-AllowedToDelegateTo' = [string[]]$missing }
 }
diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
@@ -1,7 +1,4 @@
 [defaults]
-# IMPORTANT: This project requires ansible-core <2.19 for AWS SSM Windows support.
-# ansible-core >=2.19 changed pipelining behavior which breaks the SSM connection
-# plugin for Windows hosts. See requirements.txt for details.
 
 # Core settings
 host_key_checking = False

diff --git a/ansible/meta/runtime.yml b/ansible/meta/runtime.yml
@@ -1,4 +1,3 @@
 ---
-# ansible-core >=2.19 breaks Windows module execution over AWS SSM due to
-# pipelining changes. See requirements.txt for full explanation.
-requires_ansible: ">=2.15.0,<2.19.0"
+# 2.19 breaks Windows/SSM (ansible/ansible#86397); fixed in 2.20 (PR #86619).
+requires_ansible: ">=2.20.0,<2.21.0"