jakman85andClaude Opus 4.8
4e2ca88bd4
Where the sudo password goes, codified: - inventory: new [hypervisor] group (localhost, connection=local). - host-prereqs.yml targets 'hypervisor'; become password from vaulted group_vars/hypervisor/vault.yml (ansible_become_password) — user creates it encrypted (safe to commit); README documents the exact commands. - ansible.cfg vault_password_file = ~/.config/home-k3s/ansible-vault-pass (passphrase kept OUTSIDE the repo, never committed). - ci/yamllint.yaml ignores **/vault.yml (vault blob isn't parseable YAML). Nodes keep NOPASSWD sudo (group_vars/all) — vault scoped to the host only. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
39 lines
2.1 KiB
YAML
39 lines
2.1 KiB
YAML
---
|
|
# Host (hypervisor/workstation) prerequisites for the local dev/test cluster — IaC so the cluster
|
|
# can be destroyed & rebuilt with NO remembered manual commands (R-ENV-01, R-PLAT-04).
|
|
#
|
|
# Runs on the HOST itself (localhost), NOT the cluster nodes. Needs host privilege escalation:
|
|
# ansible-playbook playbooks/host-prereqs.yml --ask-become-pass
|
|
# (or configure passwordless sudo / a become password for fully unattended rebuilds).
|
|
#
|
|
# Idempotent: safe to re-run; only changes what isn't already in the desired state. Uses
|
|
# firewall-cmd directly (no extra Ansible collection dependency).
|
|
- name: Configure host prerequisites for the local dev cluster
|
|
hosts: hypervisor # localhost (connection=local set in inventory)
|
|
become: true # ansible_become_password from vaulted group_vars/hypervisor/vault.yml
|
|
gather_facts: false
|
|
vars:
|
|
# The bootstrap Gitea (bootstrap/gitea/) runs on the host; the in-cluster Flux must reach it
|
|
# over the k3s-dev NAT gateway. firewalld's `libvirt` zone (which owns virbrN) drops
|
|
# VM->host:<port> by default, so this must be opened or Flux cannot fetch the GitOps source.
|
|
gitea_bootstrap_port: 3000
|
|
libvirt_firewalld_zone: libvirt
|
|
|
|
tasks:
|
|
- name: Check whether the Gitea port is already allowed on the libvirt zone
|
|
ansible.builtin.command: "firewall-cmd --zone={{ libvirt_firewalld_zone }} --query-port={{ gitea_bootstrap_port }}/tcp"
|
|
register: gitea_port_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Allow the bootstrap-Gitea port from the cluster VMs (permanent + runtime)
|
|
ansible.builtin.command: "{{ item }}"
|
|
loop:
|
|
- "firewall-cmd --zone={{ libvirt_firewalld_zone }} --add-port={{ gitea_bootstrap_port }}/tcp --permanent"
|
|
- "firewall-cmd --zone={{ libvirt_firewalld_zone }} --add-port={{ gitea_bootstrap_port }}/tcp"
|
|
when: "'yes' not in gitea_port_check.stdout"
|
|
changed_when: true
|
|
|
|
# Tighter alternative (documented, not default): scope to the cluster subnet with a rich rule
|
|
# firewall-cmd --zone=libvirt --add-rich-rule='rule family=ipv4 source address=10.73.0.0/24 port port=3000 protocol=tcp accept' [--permanent]
|