deytenit
502ef94bb2
### Summary of Changes This PR incorporates the final infrastructure optimizations following the initial merge of PR #25: 1. **SOPS & Secrets Management**: - Generated dedicated Age keypair (`age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl`) and updated `.sops.yaml`. - Added SOPS-encrypted production secrets for PostgreSQL (`ci/k8s/apps/postgres/secret.sops.yaml`) and Umami Analytics (`ci/k8s/apps/umami/secret.sops.yaml`). - Verified 100% clean round-trip decryption. 2. **Cloud-Init Template & Git Safety**: - Converted `user-data.yaml` into `user-data.template.yaml` with clear stubs for public SSH keys and private Age keys. - Added `ci/cloud-init/user-data.yaml` to `.gitignore` to prevent accidental secret leaks. 3. **Persistent Secondary Storage**: - Added automated detection, ext4 formatting, and mounting of secondary persistent disk (`/dev/vdb`) to `/var/lib/rancher/k3s/storage` with `noatime` in `user-data.template.yaml`. 4. **Golden Image Naming & Workflows**: - Updated image naming convention to include hyphenated UTC timestamps: `com-ermnvldmr-debian-12-k3s-amd64-YYYY-MM-DD-HH-MM-SS-sha-<short_sha>.qcow2`. - Verified successful CI golden image build and S3 upload.
56 lines
1.4 KiB
Bash
Executable File
56 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eu
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
|
|
echo "=== Configuring Base System for Cloud Image ==="
|
|
|
|
# Install essential kernel modules and utilities
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
socat \
|
|
conntrack \
|
|
ipset \
|
|
iptables \
|
|
ufw \
|
|
fail2ban \
|
|
unattended-upgrades \
|
|
curl \
|
|
ca-certificates \
|
|
tar \
|
|
gzip
|
|
|
|
# Ensure virtio kernel modules are loaded on boot
|
|
cat << 'EOF' > /etc/modules-load.d/virtio.conf
|
|
virtio
|
|
virtio_net
|
|
virtio_blk
|
|
virtio_pci
|
|
virtiofs
|
|
EOF
|
|
|
|
# Configure GRUB for Serial Console (ttyS0 / COM1) and predictable network names
|
|
sed -i 's/^GRUB_CMDLINE_LINUX_DEFAULT=.*/GRUB_CMDLINE_LINUX_DEFAULT="console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0"/' /etc/default/grub
|
|
sed -i 's/^#GRUB_TERMINAL=.*/GRUB_TERMINAL="console serial"/' /etc/default/grub
|
|
echo 'GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"' >> /etc/default/grub
|
|
update-grub
|
|
|
|
# Enable serial console getty
|
|
systemctl enable serial-getty@ttyS0.service || true
|
|
|
|
# Configure cloud-init to use NoCloud and ConfigDrive datasources
|
|
cat << 'EOF' > /etc/cloud/cloud.cfg.d/99-cloud-init.cfg
|
|
datasource_list: [ NoCloud, ConfigDrive, None ]
|
|
datasource:
|
|
NoCloud:
|
|
fs_label: cidata
|
|
EOF
|
|
|
|
# Ensure DHCP on eth0
|
|
mkdir -p /etc/network/interfaces.d
|
|
cat << 'EOF' > /etc/network/interfaces.d/eth0
|
|
auto eth0
|
|
iface eth0 inet dhcp
|
|
EOF
|
|
|
|
echo "=== Base System Configuration Complete ==="
|