Codify host firewall + Gitea bootstrap as IaC (hands-off rebuild)

Per operator: the firewalld rule (VM->host:3000 for the Flux<-Gitea source) must be IaC, not a manual command (R-ENV-01, R-PLAT-04). - infra/ansible/playbooks/host-prereqs.yml: idempotent firewalld open on the libvirt zone (localhost play, become; no extra collection). - bootstrap/gitea/bootstrap-gitea.sh: now fully automates admin + public repo + push (was manual instructions) — idempotent; creds stay 0600 on host, never committed. Applying host-prereqs still needs host sudo (I lack non-interactive sudo); with passwordless become a destroy/rebuild is fully unattended. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 14:52:08 -05:00
1 parent 4f39bb8d45
commit 3df5071bd1
@@ -0,0 +1,39 @@
+---
+# Host (hypervisor/workstation) prerequisites for the local dev/test cluster — IaC so the cluster
+# can be destroyed & rebuilt with NO remembered manual commands (R-ENV-01, R-PLAT-04).
+#
+# Runs on the HOST itself (localhost), NOT the cluster nodes. Needs host privilege escalation:
+#   ansible-playbook playbooks/host-prereqs.yml --ask-become-pass
+# (or configure passwordless sudo / a become password for fully unattended rebuilds).
+#
+# Idempotent: safe to re-run; only changes what isn't already in the desired state. Uses
+# firewall-cmd directly (no extra Ansible collection dependency).
+- name: Configure host prerequisites for the local dev cluster
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  vars:
+    # The bootstrap Gitea (bootstrap/gitea/) runs on the host; the in-cluster Flux must reach it
+    # over the k3s-dev NAT gateway. firewalld's `libvirt` zone (which owns virbrN) drops
+    # VM->host:<port> by default, so this must be opened or Flux cannot fetch the GitOps source.
+    gitea_bootstrap_port: 3000
+    libvirt_firewalld_zone: libvirt
+
+  tasks:
+    - name: Check whether the Gitea port is already allowed on the libvirt zone
+      ansible.builtin.command: "firewall-cmd --zone={{ libvirt_firewalld_zone }} --query-port={{ gitea_bootstrap_port }}/tcp"
+      register: gitea_port_check
+      changed_when: false
+      failed_when: false
+
+    - name: Allow the bootstrap-Gitea port from the cluster VMs (permanent + runtime)
+      ansible.builtin.command: "{{ item }}"
+      loop:
+        - "firewall-cmd --zone={{ libvirt_firewalld_zone }} --add-port={{ gitea_bootstrap_port }}/tcp --permanent"
+        - "firewall-cmd --zone={{ libvirt_firewalld_zone }} --add-port={{ gitea_bootstrap_port }}/tcp"
+      when: "'yes' not in gitea_port_check.stdout"
+      changed_when: true
+
+    # Tighter alternative (documented, not default): scope to the cluster subnet with a rich rule
+    #   firewall-cmd --zone=libvirt --add-rich-rule='rule family=ipv4 source address=10.73.0.0/24 port port=3000 protocol=tcp accept' [--permanent]