Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Phase 1 T-1.4 DONE: Flux reconciling clusters/dev from host Gitea

Browse Source 
host-prereqs.yml opened the firewall (via the operator's ansible-vault become
password); Flux GitRepository READY=True (main@sha1:a2f3bdc). Commit the
encrypted hypervisor vault (ansible_become_password) so rebuild is fully
hands-off; passphrase stays out-of-repo. platform/apps still not reconciled.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-16 15:14:09 -05:00
1 parent a2f3bdc3ab
commit ab0a7977bf
2 files changed
+14 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

DECISIONS-LOG.md
+7 -5
View File
@@ -28,11 +28,13 @@ need the operator are called out.
- **Flux INSTALLED** on the cluster (4 controllers Running). Host **Gitea working** (named-volume fix),
repo pushed. GitRepository created → **BLOCKED**: cluster pods can't reach `10.73.0.1:3000`
(firewalld `libvirt` zone drops VM→host:3000).
- **Now codified as IaC (per operator: no manual commands):** `infra/ansible/playbooks/host-prereqs.yml`
opens the port idempotently; `bootstrap/gitea/bootstrap-gitea.sh` now **fully automates** admin +
public repo + push (was manual). A rebuild is hands-off. To APPLY the firewall (I lack
non-interactive sudo): `ansible-playbook infra/ansible/playbooks/host-prereqs.yml --ask-become-pass`
(or passwordless host sudo for unattended rebuilds). Then Flux reconciles → Phase-1 T-1.4 exit.
- **RESOLVED (operator added the ansible-vault become password):** ran `host-prereqs.yml` (firewall
opened via vault→become), VM→Gitea = 200, and **Flux GitRepository is READY=True**
(`main@sha1:a2f3bdc…`). **Phase-1 T-1.4 core is DONE** — Flux installed + reconciling clusters/dev
from the host Gitea. `platform`/`apps` Kustomizations intentionally NOT created (Option A) — the
running cluster is untouched.
- Firewall + Gitea admin/repo/push + host become password are all IaC now (host-prereqs.yml,
bootstrap-gitea.sh automation, vaulted group_vars/hypervisor) → destroy/rebuild is hands-off.
- **NOT deployed:** `platform`/`apps` Kustomizations were deliberately NOT created — the running
cluster (Cilium etc.) is untouched. Only Flux controllers + the GitRepository source exist.