4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
17 lines
628 B
YAML
17 lines
628 B
YAML
- hosts: all
|
|
become: true
|
|
vars_files:
|
|
- ../inventory/group_vars/all.yaml
|
|
- ../inventory/group_vars/secrets.sops.yaml
|
|
roles:
|
|
- role: base
|
|
tags: [base]
|
|
- role: sops_agent
|
|
tags: [sops]
|
|
- role: custodian_agent # injects ~/.ssh/id_custodian_agent.pub into authorized_keys
|
|
tags: [custodian_agent]
|
|
- role: swapfile # provisions swap file (size + swappiness from host_vars)
|
|
tags: [swap]
|
|
- role: resource_limits # nproc PAM caps + systemd user slice memory limits
|
|
tags: [resource_limits]
|
|
# - role: wireguard # enable if you configure WireGuard variables
|