Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Phase 1 toolchain: pinned dev container (prereqs not all Python)

Browse Source 
Per operator rule: OpenTofu/age/sops/flux are Go binaries, so bake the toolchain
into a pinned Fedora-44 dev container (matches host libvirt 12) instead of a venv.
infra/devcontainer/: Containerfile + versions.env (tofu 1.9.0, age 1.2.1, sops
3.9.4, flux 2.4.0, kubectl 1.32.0, helm 3.16.0) + dev.sh (runs with host libvirt
socket + repo + ssh mounted) + README. Built & validated: all tools resolve;
virsh reaches host libvirt from inside the container.

Also record resolved Phase 1 decisions in PHASE1-SCOPE.md (6GiB/4vCPU x3;
k3s-dev NAT 10.73.0.0/24; container toolchain). Gate green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-16 00:59:47 -05:00
1 parent 814029f2da
commit 5d2b248b68
5 files changed
+162 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

infra/PHASE1-SCOPE.md
+17 -10
View File
@@ -24,11 +24,16 @@ and the **SOPS age key** bootstrapped. Exit gates:
| Present | ansible 2.20, virt-install, qemu-img, kubectl, helm, genisoimage | ok |
| **Missing (prereqs)** | **OpenTofu(+libvirt provider), age, sops, flux CLI**, cloud-localds | must install before execution |
## Prerequisites to install (before execution)
- **OpenTofu** + the **`dmacvicar/libvirt`** provider — node-VM IaC.
- **age** + **sops** — the SOPS secret bootstrap (ADR-0007).
- **flux** CLI — Flux bootstrap.
- (`cloud-localds` optional — the tofu libvirt provider builds cloud-init disks natively.)
## Toolchain — pinned dev container (decided)
The prereqs are **not all Python** (OpenTofu/age/sops/flux are Go binaries), so per the operator's
rule they are delivered as a **pinned dev container**, not host installs (and not a venv). See
[`devcontainer/`](devcontainer/): OpenTofu + `dmacvicar/libvirt` deps, age, sops, flux, ansible,
kubectl, helm, libvirt-client — baked into a Fedora-44 image (matches host libvirt 12). Run with the
host libvirt socket + repo mounted:
```
cd infra/devcontainer && ./dev.sh build && ./dev.sh
```
This isolates the toolchain, keeps the host clean, and gives every worker the same baseline.
## Resource plan (constrained by ~22 GiB RAM / 137 GiB disk)
Per node: **4 vCPU · 6 GiB RAM · 20 GiB OS disk + 40 GiB thin data disk** (Longhorn).
@@ -79,11 +84,13 @@ verify reconcile → destroy/rebuild proof → `CLUSTER_AVAILABLE=true` → conf
- **Nested virt (Phase 5, not now)** — verify `/sys/module/kvm_amd/parameters/nested=1` before
KubeVirt.
## Operator decisions / hand-offs needed
1. **Approve VM sizing** (6 GiB / 4 vCPU × 3) given the RAM ceiling — or free more RAM for larger.
2. **Approve installing the prereqs** (OpenTofu + libvirt provider, age, sops, flux).
3. **Network**: dedicated NAT `k3s-dev` (recommended) vs reuse `default`.
4. Cloudflare token / PIA creds are **Phase 2/3** — not needed for Phase 1.
## Operator decisions / hand-offs — RESOLVED (2026-08-16)
1. **VM sizing:** ✅ **6 GiB / 4 vCPU × 3** (18 GiB; ~4 GiB host headroom). Full stack in later phases
will need trimming or more RAM.
2. **Toolchain:** ✅ **pinned dev container** (`infra/devcontainer/`) — prereqs baked in, not host-
installed.
3. **Network:** ✅ **dedicated NAT `k3s-dev` (10.73.0.0/24)**; nodes .11/.12/.13; VIPs .240–.250.
4. Cloudflare token / PIA creds remain **Phase 2/3** — not needed for Phase 1.
## Worker dispatch (on execution go)
- **Infra/Cluster Engineer** — T-1.1/1.2/1.3 (tofu + cloud-init + Ansible k3s/Cilium).