0 Fork 0

Files

T

jakman85andClaude Opus 4.8 4e2ca88bd4 Wire ansible-vault for host become password (unattended host-prereqs)

Where the sudo password goes, codified:
- inventory: new [hypervisor] group (localhost, connection=local).
- host-prereqs.yml targets 'hypervisor'; become password from vaulted
  group_vars/hypervisor/vault.yml (ansible_become_password) — user creates it
  encrypted (safe to commit); README documents the exact commands.
- ansible.cfg vault_password_file = ~/.config/home-k3s/ansible-vault-pass
  (passphrase kept OUTSIDE the repo, never committed).
- ci/yamllint.yaml ignores **/vault.yml (vault blob isn't parseable YAML).
Nodes keep NOPASSWD sudo (group_vars/all) — vault scoped to the host only.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-08-16 15:04:44 -05:00

ansible

Wire ansible-vault for host become password (unattended host-prereqs)

2026-08-16 15:04:44 -05:00

cloud-init

Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)

2026-08-16 01:21:00 -05:00

devcontainer

Phase 1 checkpoint: status/resume doc + cluster helper + toolchain note

2026-08-16 02:18:39 -05:00

tofu

Phase 1 (author-only): node provisioning IaC — tofu + cloud-init + Ansible (T-1.1/1.2/1.3)

2026-08-16 01:21:00 -05:00

cluster.sh

Phase 1 checkpoint: status/resume doc + cluster helper + toolchain note

2026-08-16 02:18:39 -05:00

PHASE1-SCOPE.md

Phase 1: host Gitea as the bootstrap GitOps source (resolves source-URL)

2026-08-16 01:26:47 -05:00

PHASE1-STATUS.md

Phase 1 checkpoint: status/resume doc + cluster helper + toolchain note

2026-08-16 02:18:39 -05:00

README.md

Scope Phase 1: dev/test cluster bring-up on local KVM

2026-08-16 00:48:48 -05:00

README.md

infra/ — Phase 1 node provisioning (local KVM)

OpenTofu (libvirt) + cloud-init + Ansible bring up the 3-node k3s/Cilium cluster. See PHASE1-SCOPE.md. Spec: ../home-network-k3s/docs/02-environments-and-provisioning.md.