small changes

ansible/.ansible-lint

@@ -0,0 +1,4 @@
+---
+profile: basic
+exclude_paths:
+  - collections/

ansible/.gitignore

@@ -0,0 +1,13 @@
+# Encrypted secrets
+group_vars/all/vault.yml
+
+# Installed collections
+collections/
+
+# Ansible retry files
+*.retry
+
+# Local controller environment and test caches
+.venv/
+__pycache__/
+.pytest_cache/

ansible/ansible.cfg

@@ -0,0 +1,9 @@
+[defaults]
+inventory = inventory.yml
+host_key_checking = True
+retry_files_enabled = False
+stdout_callback = default
+result_format = yaml
+collections_path = ./collections
+roles_path = ./roles
+interpreter_python = auto_silent

ansible/inventory.yml

@@ -0,0 +1,49 @@
+---
+# Proxmox connection: local API access (the controller reaches the node directly).
+# This is the "proxmox" group — not an SSH target, just connection params.
+all:
+  children:
+    proxmox_nodes:
+      hosts:
+        otherside:
+          ansible_host: otherside.haven
+          ansible_connection: local # we call the Proxmox API, not SSH
+        astrid:
+          ansible_host: astrid.haven
+          ansible_connection: local # we call the Proxmox API, not SSH
+    k3s_cluster:
+      children:
+        grp_k3s_server: # group name == group_vars/grp_k3s_server.yml
+          hosts:
+            iris:
+              ansible_host: iris.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+        grp_k3s_agent: # group name == group_vars/grp_k3s_agent.yml
+          hosts:
+            vega:
+              ansible_host: vega.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+            nebula:
+              ansible_host: nebula.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+            nexus:
+              ansible_host: nexus.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+    lxcs:
+      children:
+        grp_docker_build: # group name == group_vars/grp_docker_build.yml
+          hosts:
+            docker_build:
+              ansible_host: docker-build.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+        grp_redis: # group name == group_vars/grp_redis.yml
+          hosts:
+            redis:
+              ansible_host: redis.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3

ansible/playbooks/k3s_update.yml

@@ -0,0 +1,69 @@
+## Updates k3s in the entire cluster
+- name: Update k3s Control Plane
+  hosts: grp_k3s_server
+  serial: 1
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Update k3s on control plane node
+      ansible.builtin.shell: >
+        sh <(curl -sfL https://get.k3s.io)
+      args:
+        executable: /bin/bash
+      register: k3s_update
+
+    - name: Print update output
+      ansible.builtin.debug:
+        var: k3s_update
+
+- name: Update k3s Agents
+  hosts: grp_k3s_agent
+  serial: 1
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Cordon agent node
+      ansible.builtin.command: kubectl cordon {{ inventory_hostname }}
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      ignore_errors: true
+
+    - name: Drain agent node
+      ansible.builtin.command: >
+        kubectl drain {{ inventory_hostname }}
+        --ignore-daemonsets
+        --delete-emptydir-data
+        --force
+        --timeout=60s
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      ignore_errors: true
+
+    - name: Kill k3s-agent process
+      ansible.builtin.shell: k3s-killall.sh
+      ignore_errors: true
+
+    - name: Update k3s on agent node
+      ansible.builtin.shell: >
+        sh <(curl -sfL https://get.k3s.io)
+      args:
+        executable: /bin/bash
+      register: k3s_update
+
+    - name: Restart k3s-agent service
+      ansible.builtin.systemd:
+        name: k3s-agent
+        state: restarted
+
+    - name: Print update output
+      ansible.builtin.debug:
+        var: k3s_update
+
+    - name: Uncordon agent node
+      ansible.builtin.command: kubectl uncordon {{ inventory_hostname }}
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      ignore_errors: true

ansible/requirements-dev.txt

@@ -0,0 +1,2 @@
+-r requirements-python.txt
+ansible-lint==26.6.0

ansible/requirements-python.txt

@@ -0,0 +1,3 @@
+ansible-core==2.21.2
+proxmoxer==2.3.0
+requests==2.34.2

ansible/requirements.yml

@@ -0,0 +1,6 @@
+---
+collections:
+  - name: community.proxmox
+    version: "2.0.0"
+  - name: community.general
+    version: "13.2.0"

infra/wg-easy.yaml

@@ -33,56 +33,59 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - nexus
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/hostname
+                    operator: In
+                    values:
+                      - nexus
       containers:
-      - name: wg-easy
-        image: ghcr.io/wg-easy/wg-easy:latest
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 51820
-          protocol: UDP
-          name: wg-port
-        - containerPort: 51821
-          protocol: TCP
-          name: web-port
-        env:
-        - name: LANG
-          value: en
-        - name: WG_HOST
-          value: vpn.ivanch.me
-        - name: WG_MTU
-          value: "1420"
-        - name: UI_TRAFFIC_STATS
-          value: "true"
-        - name: UI_CHART_TYPE
-          value: "0"
-        - name: WG_ENABLE_ONE_TIME_LINKS
-          value: "true"
-        - name: UI_ENABLE_SORT_CLIENTS
-          value: "true"
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-            - SYS_MODULE
-        resources:
-          requests:
-            cpu: 100m
-            memory: 256Mi
-        volumeMounts:
+        - name: wg-easy
+          image: ghcr.io/wg-easy/wg-easy:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 51820
+              protocol: UDP
+              name: wg-port
+            - containerPort: 51821
+              protocol: TCP
+              name: web-port
+          env:
+            - name: LANG
+              value: en
+            - name: WG_HOST
+              value: vpn.ivanch.me
+            - name: WG_MTU
+              value: "1420"
+            - name: UI_TRAFFIC_STATS
+              value: "true"
+            - name: UI_CHART_TYPE
+              value: "0"
+            - name: WG_ENABLE_ONE_TIME_LINKS
+              value: "true"
+            - name: UI_ENABLE_SORT_CLIENTS
+              value: "true"
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+                - SYS_MODULE
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 2000m
+              memory: 1Gi
+      volumeMounts:
         - name: wg-easy-volume
           mountPath: /etc/wireguard
       restartPolicy: Always
       volumes:
-      - name: wg-easy-volume
-        persistentVolumeClaim:
-          claimName: wg-easy-pvc
+        - name: wg-easy-volume
+          persistentVolumeClaim:
+            claimName: wg-easy-pvc
 ---
 apiVersion: v1
 kind: Service
@@ -95,14 +98,14 @@ spec:
     app: wg-easy
   loadBalancerIP: 192.168.20.203
   ports:
-  - name: wg-port
-    port: 51820
-    targetPort: 51820
-    protocol: UDP
-  - name: web-port
-    port: 51821
-    targetPort: 51821
-    protocol: TCP
+    - name: wg-port
+      port: 51820
+      targetPort: 51820
+      protocol: UDP
+    - name: web-port
+      port: 51821
+      targetPort: 51821
+      protocol: TCP
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -112,13 +115,13 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-  - host: vpn.haven
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: wg-easy-svc
-            port:
-              number: 51821
+    - host: vpn.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wg-easy-svc
+                port:
+                  number: 51821

secrets/gitea-runner.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: gitea-runner, namespace: dev }
+spec:
+  refreshInterval: 1h
+  target:
+    name: gitea-runner-token
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        REGISTRATION_TOKEN: "{{ .REGISTRATION_TOKEN }}"
+  data:
+    - secretKey: REGISTRATION_TOKEN
+      remoteRef:
+        {
+          key: 4e286657-b5de-4354-be2e-d1649b0fd527,
+          property: REGISTRATION_TOKEN,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }