deytenit
502ef94bb2
### Summary of Changes This PR incorporates the final infrastructure optimizations following the initial merge of PR #25: 1. **SOPS & Secrets Management**: - Generated dedicated Age keypair (`age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl`) and updated `.sops.yaml`. - Added SOPS-encrypted production secrets for PostgreSQL (`ci/k8s/apps/postgres/secret.sops.yaml`) and Umami Analytics (`ci/k8s/apps/umami/secret.sops.yaml`). - Verified 100% clean round-trip decryption. 2. **Cloud-Init Template & Git Safety**: - Converted `user-data.yaml` into `user-data.template.yaml` with clear stubs for public SSH keys and private Age keys. - Added `ci/cloud-init/user-data.yaml` to `.gitignore` to prevent accidental secret leaks. 3. **Persistent Secondary Storage**: - Added automated detection, ext4 formatting, and mounting of secondary persistent disk (`/dev/vdb`) to `/var/lib/rancher/k3s/storage` with `noatime` in `user-data.template.yaml`. 4. **Golden Image Naming & Workflows**: - Updated image naming convention to include hyphenated UTC timestamps: `com-ermnvldmr-debian-12-k3s-amd64-YYYY-MM-DD-HH-MM-SS-sha-<short_sha>.qcow2`. - Verified successful CI golden image build and S3 upload.
75 lines
1.9 KiB
HCL
75 lines
1.9 KiB
HCL
packer {
|
|
required_plugins {
|
|
qemu = {
|
|
version = ">= 1.1.0"
|
|
source = "github.com/hashicorp/qemu"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "debian_cloud_image_url" {
|
|
type = string
|
|
default = "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-nocloud-amd64.qcow2"
|
|
}
|
|
|
|
variable "debian_cloud_image_checksum" {
|
|
type = string
|
|
default = "file:https://cloud.debian.org/images/cloud/bookworm/latest/SHA512SUMS"
|
|
}
|
|
|
|
variable "vm_name" {
|
|
type = string
|
|
default = "com-ermnvldmr-debian-12-k3s-amd64.qcow2"
|
|
}
|
|
|
|
variable "accelerator" {
|
|
type = string
|
|
default = "kvm"
|
|
}
|
|
|
|
source "qemu" "debian_k3s" {
|
|
iso_url = var.debian_cloud_image_url
|
|
iso_checksum = var.debian_cloud_image_checksum
|
|
disk_image = true
|
|
disk_size = "10G"
|
|
format = "qcow2"
|
|
output_directory = "output-qemu"
|
|
shutdown_command = "echo 'packer' | sudo -S shutdown -P now"
|
|
accelerator = var.accelerator
|
|
cd_files = ["ci/packer/cidata/user-data", "ci/packer/cidata/meta-data"]
|
|
cd_label = "cidata"
|
|
ssh_username = "debian"
|
|
ssh_password = "packer"
|
|
ssh_timeout = "5m"
|
|
vm_name = var.vm_name
|
|
net_device = "virtio-net"
|
|
disk_interface = "virtio"
|
|
headless = true
|
|
|
|
qemuargs = [
|
|
["-m", "2048M"],
|
|
["-smp", "2"]
|
|
]
|
|
}
|
|
|
|
build {
|
|
sources = ["source.qemu.debian_k3s"]
|
|
|
|
provisioner "shell" {
|
|
execute_command = "echo 'packer' | sudo -S sh -c '{{ .Vars }} {{ .Path }}'"
|
|
scripts = [
|
|
"ci/packer/scripts/01-base-system.sh",
|
|
"ci/packer/scripts/02-install-k3s.sh",
|
|
"ci/packer/scripts/03-cleanup.sh"
|
|
]
|
|
}
|
|
|
|
post-processor "shell-local" {
|
|
inline = [
|
|
"echo 'Optimizing qcow2 image with 2M cluster size...'",
|
|
"qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c output-qemu/${var.vm_name} output-qemu/debian-12-k3s-optimized.qcow2",
|
|
"mv output-qemu/debian-12-k3s-optimized.qcow2 output-qemu/${var.vm_name}"
|
|
]
|
|
}
|
|
}
|