jakman85andClaude Opus 4.8
ba72725a4e
All 3 k3s nodes re-provisioned to Debian 13 (kernel 6.12) via immutable tofu -replace, one at a time, primary/leader last (secondary-join to avoid cluster-init split-brain). - variables.tf image defaults -> debian-13-generic (generic, not genericcloud) - k3s_server: ensure /etc/rancher/k3s exists (fresh-node re-provision fix) - gitignore vendored ansible collections (installed for re-provision) Co-Authored-By: Claude Opus 4.8 <[email protected]>
47 lines
1.2 KiB
Plaintext
47 lines
1.2 KiB
Plaintext
# OS / editor
|
|
.DS_Store
|
|
*.swp
|
|
*~
|
|
.idea/
|
|
.vscode/
|
|
|
|
# Secrets — SOPS-encrypted only; never commit plaintext (spec docs/07)
|
|
*.dec.yaml
|
|
*.decrypted.*
|
|
*.key
|
|
age.key
|
|
*.kubeconfig
|
|
kubeconfig
|
|
|
|
# IaC state / local runtime
|
|
.terraform/
|
|
*.tfstate
|
|
*.tfstate.*
|
|
.terraform.lock.hcl
|
|
*.tfvars
|
|
!*.example.tfvars
|
|
# tofu apply/plan run logs (tee'd locally; never commit)
|
|
apply.log
|
|
plan.log
|
|
|
|
# Test / build artifacts
|
|
/results/
|
|
/reports/
|
|
*.junit.xml
|
|
coverage/
|
|
|
|
# RETIRED plaintext Tofu secret files. Superseded by the COMMITTED, SOPS/age-encrypted
|
|
# infra/tofu/secrets.sops.env + the wrapper infra/tofu/tf.sh (see REMOTE-STATE.md). These
|
|
# lines are KEPT as a safety net so any leftover plaintext copy on an operator's machine can
|
|
# NEVER be committed; delete the local files once you've migrated to the encrypted flow.
|
|
infra/tofu/backend.hcl
|
|
infra/tofu/.r2.env
|
|
|
|
# Claude Code local scratch: agent worktrees + session state. Nothing here is tracked;
|
|
# ignoring it keeps `git add -A` from staging embedded worktree repos and keeps the lint
|
|
# stage (which scans untracked files) from tripping on .claude/worktrees/.
|
|
.claude/
|
|
|
|
# Vendored ansible collections (installed by ansible-galaxy for node re-provision; not tracked or linted)
|
|
infra/ansible/collections/
|