railiance-cluster/ansible/bootstrap.yml

---
# Pre-condition: the target host must already be converged by railiance-infra
# (`make converge` in that repo) before running this playbook.
# OS hardening (SSH, UFW, fail2ban) is owned by railiance-infra — see ADR-003.

# Install base packages and k3s.
- name: Railiance host bootstrap
  hosts: all
  become: true
  tasks:
    - name: Ensure base packages
      apt:
        name:
          - curl
          - git
          - jq
        update_cache: yes
        state: present

    - name: Install k3s (server)
      shell: |
        curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server --write-kubeconfig-mode=644" sh -
      args: { creates: /usr/local/bin/k3s }

    - name: Verify k3s node
      shell: k3s kubectl get nodes
      register: nodes
      changed_when: false

    - debug: var=nodes.stdout_lines