jakman85andClaude Opus 4.8
3df5071bd1
Per operator: the firewalld rule (VM->host:3000 for the Flux<-Gitea source) must be IaC, not a manual command (R-ENV-01, R-PLAT-04). - infra/ansible/playbooks/host-prereqs.yml: idempotent firewalld open on the libvirt zone (localhost play, become; no extra collection). - bootstrap/gitea/bootstrap-gitea.sh: now fully automates admin + public repo + push (was manual instructions) — idempotent; creds stay 0600 on host, never committed. Applying host-prereqs still needs host sudo (I lack non-interactive sudo); with passwordless become a destroy/rebuild is fully unattended. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
40 lines
2.0 KiB
YAML
40 lines
2.0 KiB
YAML
---
|
|
# Host (hypervisor/workstation) prerequisites for the local dev/test cluster — IaC so the cluster
|
|
# can be destroyed & rebuilt with NO remembered manual commands (R-ENV-01, R-PLAT-04).
|
|
#
|
|
# Runs on the HOST itself (localhost), NOT the cluster nodes. Needs host privilege escalation:
|
|
# ansible-playbook playbooks/host-prereqs.yml --ask-become-pass
|
|
# (or configure passwordless sudo / a become password for fully unattended rebuilds).
|
|
#
|
|
# Idempotent: safe to re-run; only changes what isn't already in the desired state. Uses
|
|
# firewall-cmd directly (no extra Ansible collection dependency).
|
|
- name: Configure host prerequisites for the local dev cluster
|
|
hosts: localhost
|
|
connection: local
|
|
become: true
|
|
gather_facts: false
|
|
vars:
|
|
# The bootstrap Gitea (bootstrap/gitea/) runs on the host; the in-cluster Flux must reach it
|
|
# over the k3s-dev NAT gateway. firewalld's `libvirt` zone (which owns virbrN) drops
|
|
# VM->host:<port> by default, so this must be opened or Flux cannot fetch the GitOps source.
|
|
gitea_bootstrap_port: 3000
|
|
libvirt_firewalld_zone: libvirt
|
|
|
|
tasks:
|
|
- name: Check whether the Gitea port is already allowed on the libvirt zone
|
|
ansible.builtin.command: "firewall-cmd --zone={{ libvirt_firewalld_zone }} --query-port={{ gitea_bootstrap_port }}/tcp"
|
|
register: gitea_port_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Allow the bootstrap-Gitea port from the cluster VMs (permanent + runtime)
|
|
ansible.builtin.command: "{{ item }}"
|
|
loop:
|
|
- "firewall-cmd --zone={{ libvirt_firewalld_zone }} --add-port={{ gitea_bootstrap_port }}/tcp --permanent"
|
|
- "firewall-cmd --zone={{ libvirt_firewalld_zone }} --add-port={{ gitea_bootstrap_port }}/tcp"
|
|
when: "'yes' not in gitea_port_check.stdout"
|
|
changed_when: true
|
|
|
|
# Tighter alternative (documented, not default): scope to the cluster subnet with a rich rule
|
|
# firewall-cmd --zone=libvirt --add-rich-rule='rule family=ipv4 source address=10.73.0.0/24 port port=3000 protocol=tcp accept' [--permanent]
|