coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-infra/ansible/playbooks/bootstrap.yaml

17 lines
580 B
YAML
Raw Normal View History

feat: initial import of RailianceHosts starter
2025-09-13 20:26:11 +02:00
- hosts: all
become: true
vars_files:
- ../inventory/group_vars/all.yaml
roles:
- role: base
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
tags: [base]
feat: initial import of RailianceHosts starter
2025-09-13 20:26:11 +02:00
- role: sops_agent
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
tags: [sops]
feat(custodian-agent): Ansible role + Makefile for Custodian SSH identity Establishes a dedicated SSH keypair for the Custodian automation agent: - ansible/roles/custodian_agent/: authorized_key task (tagged custodian_agent) - ansible/inventory/group_vars/all.yaml: custodian_agent_user/pubkey vars - ansible/playbooks/bootstrap.yaml: custodian_agent role added - Makefile: provision-custodian-agent / provision-custodian-agent-host targets Keypair generation: cd ~/the-custodian && make custodian-keygen Then deploy: cd ~/railiance-infra && make provision-custodian-agent The private key lives at ~/.ssh/id_custodian_agent — never committed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-27 01:21:57 +01:00
- role: custodian_agent # injects ~/.ssh/id_custodian_agent.pub into authorized_keys
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
tags: [custodian_agent]
feat(ansible): add swapfile + resource_limits roles; add CoulombCore to inventory T01: roles/swapfile — idempotent 4GB swapfile, vm.swappiness=10, fstab entry T02: roles/resource_limits — PAM nproc caps (512/1024), systemd user-1000.slice memory limits (1500M/512M); templated per-host via host_vars - inventory/host_vars/CoulombCore.yml — host-specific vars for both roles - inventory/servers.yaml — add CoulombCore with id_ops SSH key - inventory_from_yaml.py — load host_vars files into Ansible hostvars - playbooks/bootstrap.yaml — include swapfile + resource_limits roles - workplans/WP-0004 — flag T04/T09/T10 needs_human, add CoulombCore-local convergence note Codifies manual INC-002 hardening. See RAIL-HO-WP-0004-T01/T02. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-27 01:49:35 +01:00
- role: swapfile # provisions swap file (size + swappiness from host_vars)
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
tags: [swap]
feat(ansible): add swapfile + resource_limits roles; add CoulombCore to inventory T01: roles/swapfile — idempotent 4GB swapfile, vm.swappiness=10, fstab entry T02: roles/resource_limits — PAM nproc caps (512/1024), systemd user-1000.slice memory limits (1500M/512M); templated per-host via host_vars - inventory/host_vars/CoulombCore.yml — host-specific vars for both roles - inventory/servers.yaml — add CoulombCore with id_ops SSH key - inventory_from_yaml.py — load host_vars files into Ansible hostvars - playbooks/bootstrap.yaml — include swapfile + resource_limits roles - workplans/WP-0004 — flag T04/T09/T10 needs_human, add CoulombCore-local convergence note Codifies manual INC-002 hardening. See RAIL-HO-WP-0004-T01/T02. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-27 01:49:35 +01:00
- role: resource_limits # nproc PAM caps + systemd user slice memory limits
Close RAIL-HO-WP-0009 declared-state gaps; leave live 6443 prune gated Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
2026-08-15 15:41:59 +02:00
tags: [resource_limits]
feat: initial import of RailianceHosts starter
2025-09-13 20:26:11 +02:00
# - role: wireguard # enable if you configure WireGuard variables
Reference in a new issue Copy permalink