diff --git a/ansible/.ansible-lint b/ansible/.ansible-lint
new file mode 100644
index 0000000..1cc7b2b
--- /dev/null
+++ b/ansible/.ansible-lint
@@ -0,0 +1,4 @@
+---
+profile: basic
+exclude_paths:
+  - collections/
diff --git a/ansible/.gitignore b/ansible/.gitignore
new file mode 100644
index 0000000..0e1e92c
--- /dev/null
+++ b/ansible/.gitignore
@@ -0,0 +1,13 @@
+# Encrypted secrets
+group_vars/all/vault.yml
+
+# Installed collections
+collections/
+
+# Ansible retry files
+*.retry
+
+# Local controller environment and test caches
+.venv/
+__pycache__/
+.pytest_cache/
diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
new file mode 100644
index 0000000..f65e869
--- /dev/null
+++ b/ansible/ansible.cfg
@@ -0,0 +1,9 @@
+[defaults]
+inventory = inventory.yml
+host_key_checking = True
+retry_files_enabled = False
+stdout_callback = default
+result_format = yaml
+collections_path = ./collections
+roles_path = ./roles
+interpreter_python = auto_silent
diff --git a/ansible/inventory.yml b/ansible/inventory.yml
new file mode 100644
index 0000000..ca1726d
--- /dev/null
+++ b/ansible/inventory.yml
@@ -0,0 +1,49 @@
+---
+# Proxmox connection: local API access (the controller reaches the node directly).
+# This is the "proxmox" group — not an SSH target, just connection params.
+all:
+  children:
+    proxmox_nodes:
+      hosts:
+        otherside:
+          ansible_host: otherside.haven
+          ansible_connection: local # we call the Proxmox API, not SSH
+        astrid:
+          ansible_host: astrid.haven
+          ansible_connection: local # we call the Proxmox API, not SSH
+    k3s_cluster:
+      children:
+        grp_k3s_server: # group name == group_vars/grp_k3s_server.yml
+          hosts:
+            iris:
+              ansible_host: iris.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+        grp_k3s_agent: # group name == group_vars/grp_k3s_agent.yml
+          hosts:
+            vega:
+              ansible_host: vega.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+            nebula:
+              ansible_host: nebula.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+            nexus:
+              ansible_host: nexus.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+    lxcs:
+      children:
+        grp_docker_build: # group name == group_vars/grp_docker_build.yml
+          hosts:
+            docker_build:
+              ansible_host: docker-build.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+        grp_redis: # group name == group_vars/grp_redis.yml
+          hosts:
+            redis:
+              ansible_host: redis.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
diff --git a/ansible/playbooks/k3s_update.yml b/ansible/playbooks/k3s_update.yml
new file mode 100644
index 0000000..7e1f781
--- /dev/null
+++ b/ansible/playbooks/k3s_update.yml
@@ -0,0 +1,69 @@
+## Updates k3s in the entire cluster
+- name: Update k3s Control Plane
+  hosts: grp_k3s_server
+  serial: 1
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Update k3s on control plane node
+      ansible.builtin.shell: >
+        sh <(curl -sfL https://get.k3s.io)
+      args:
+        executable: /bin/bash
+      register: k3s_update
+
+    - name: Print update output
+      ansible.builtin.debug:
+        var: k3s_update
+
+- name: Update k3s Agents
+  hosts: grp_k3s_agent
+  serial: 1
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Cordon agent node
+      ansible.builtin.command: kubectl cordon {{ inventory_hostname }}
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      ignore_errors: true
+
+    - name: Drain agent node
+      ansible.builtin.command: >
+        kubectl drain {{ inventory_hostname }}
+        --ignore-daemonsets
+        --delete-emptydir-data
+        --force
+        --timeout=60s
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      ignore_errors: true
+
+    - name: Kill k3s-agent process
+      ansible.builtin.shell: k3s-killall.sh
+      ignore_errors: true
+
+    - name: Update k3s on agent node
+      ansible.builtin.shell: >
+        sh <(curl -sfL https://get.k3s.io)
+      args:
+        executable: /bin/bash
+      register: k3s_update
+
+    - name: Restart k3s-agent service
+      ansible.builtin.systemd:
+        name: k3s-agent
+        state: restarted
+
+    - name: Print update output
+      ansible.builtin.debug:
+        var: k3s_update
+
+    - name: Uncordon agent node
+      ansible.builtin.command: kubectl uncordon {{ inventory_hostname }}
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      ignore_errors: true
diff --git a/ansible/requirements-dev.txt b/ansible/requirements-dev.txt
new file mode 100644
index 0000000..bf2b762
--- /dev/null
+++ b/ansible/requirements-dev.txt
@@ -0,0 +1,2 @@
+-r requirements-python.txt
+ansible-lint==26.6.0
diff --git a/ansible/requirements-python.txt b/ansible/requirements-python.txt
new file mode 100644
index 0000000..5e2d35c
--- /dev/null
+++ b/ansible/requirements-python.txt
@@ -0,0 +1,3 @@
+ansible-core==2.21.2
+proxmoxer==2.3.0
+requests==2.34.2
diff --git a/ansible/requirements.yml b/ansible/requirements.yml
new file mode 100644
index 0000000..de6aa00
--- /dev/null
+++ b/ansible/requirements.yml
@@ -0,0 +1,6 @@
+---
+collections:
+  - name: community.proxmox
+    version: "2.0.0"
+  - name: community.general
+    version: "13.2.0"