0 Fork 0

Files

T

History

jakman85andClaude Opus 4.8 3df5071bd1 Codify host firewall + Gitea bootstrap as IaC (hands-off rebuild)

Per operator: the firewalld rule (VM->host:3000 for the Flux<-Gitea source) must be
IaC, not a manual command (R-ENV-01, R-PLAT-04).
- infra/ansible/playbooks/host-prereqs.yml: idempotent firewalld open on the libvirt
  zone (localhost play, become; no extra collection).
- bootstrap/gitea/bootstrap-gitea.sh: now fully automates admin + public repo + push
  (was manual instructions) — idempotent; creds stay 0600 on host, never committed.
Applying host-prereqs still needs host sudo (I lack non-interactive sudo); with
passwordless become a destroy/rebuild is fully unattended.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-08-16 14:52:08 -05:00

bootstrap-gitea.sh

Codify host firewall + Gitea bootstrap as IaC (hands-off rebuild)

2026-08-16 14:52:08 -05:00

README.md

Phase 1: host Gitea as the bootstrap GitOps source (resolves source-URL)

2026-08-16 01:26:47 -05:00

README.md

bootstrap/gitea — Phase-1 host Gitea (GitOps bootstrap source)

Solves the self-hosted-git chicken-and-egg for Phase 1: the platform's Gitea will eventually run in the cluster (Phase 6), but the cluster needs a git source to bootstrap from. So during bring-up we run a single Gitea container on the host, outside the cluster, and Flux pulls this repo from it.

How it fits

bootstrap-gitea.sh starts gitea/gitea on the host with a persistent data dir, HTTP on :3000, reachable from the cluster VMs on the k3s-dev NAT gateway 10.73.0.1.
The repo is pushed to it as a public repo (Home-Network/home-network-k3s-impl) — public so Flux needs no credentials; safe because this Gitea is NAT-only, not internet-exposed.
Flux's flux-system GitRepository is wired to http://10.73.0.1:3000/Home-Network/home-network-k3s-impl.git (inlined in clusters/dev/kustomization.yaml). bootstrap/flux/bootstrap.sh then apply -k clusters/dev and Flux reconciles from here.

Bring-up order (operator, at execution time — not now)

./bootstrap/gitea/bootstrap-gitea.sh → create admin + public repo → git push bootstrap main.
tofu apply (infra/tofu) — VMs + k3s-dev net.
Ansible site.yml — k3s HA + Cilium.
bootstrap/sops/age-keygen.sh → install-age-key.sh → bootstrap/flux/bootstrap.sh.
Flux reconciles clusters/dev from the host Gitea.

Phase 6 cutover

Once the in-cluster Gitea is onboarded (gitea.home.keithjackson.dev), push the repo there, repoint the flux-system GitRepository URL, and keep an off-cluster mirror (docs/05 "Circularity & DR"). The host Gitea can then be retired.

Notes

Pinned gitea/gitea:1.22 (override GITEA_IMAGE); data at ~/.local/share/home-k3s-bootstrap-gitea (override GITEA_DATA_DIR).
No secrets here: admin credentials are created interactively at bring-up, never committed.