deytenit
710873e72c
### Summary of Changes This PR introduces a declarative, GitOps-managed cloud infrastructure for the monorepo using K3s, Flux v2, and HashiCorp Packer: 1. **Packer Golden Image Builder (`ci/packer/`)**: - Automated Debian 12 minimal base OS image creation using QEMU builder, UEFI firmware, GPT partition scheme, and 2M cluster size `.qcow2` conversion. - Cloud-init, `virtio` kernel drivers, and serial console (`ttyS0`, 115200 baud). - Pre-installed K3s binary (`v1.31.2+k3s1`) with isolated first-boot token and cert generation. - Full identity sanitization (`machine-id` and SSH host key resets). 2. **First-Boot Cloud-Init Bootstrapping (`ci/cloud-init/user-data.yaml`)**: - Configures K3s with `servicelb` disabled and TLS SANs for custom domains and static IP. - Waits for API readiness, initializes `flux-system` namespace, injects `sops-age` secret, and triggers Flux sync. 3. **SOPS & GitOps Root Orchestration (`.sops.yaml`, `ci/k8s/clusters/production/`)**: - SOPS encryption configuration targeting Kubernetes secrets with `age` key recipient. - Flux v2 `GitRepository` and `Kustomization` manifests tracking `next`. 4. **Infrastructure & Networking (`ci/k8s/base/`, `ci/k8s/infrastructure/`)**: - Dedicated `com-ermnvldmr` namespace. - `cert-manager` HTTP-01 `ClusterIssuer` (`letsencrypt-prod` & `letsencrypt-staging`). - Traefik Ingress routing for `ermnvldmr.com`, `www.ermnvldmr.com`, `docs.ermnvldmr.com`, and `analytics.ermnvldmr.com`. 5. **PostgreSQL & Applications (`ci/k8s/apps/`)**: - PostgreSQL 16 StatefulSet on 5Gi `local-path` persistent storage with low-memory tuning. - Deployments for `www` (pinned `sha-6d33b71`), `docs` (pinned `sha-91f5245`), and `umami` (pinned `postgresql-v2.14.0`) with zero-downtime rolling update strategy. 6. **CI/CD Workflows (`.github/workflows/`)**: - `ci - next/build-golden-image`: Workflow to build and upload `com-ermnvldmr-debian-12-k3s-amd64-<tag>.qcow2` to static S3 `/dev/images/`. - Updated `services-www-releases-dispatch-release.yml` and `services-docs-next-required.yml` with GitOps deployment steps.
55 lines
2.1 KiB
INI
55 lines
2.1 KiB
INI
d-i debian-installer/locale string en_US.UTF-8
|
|
d-i keyboard-configuration/xkb-keymap select us
|
|
|
|
d-i netcfg/choose_interface select auto
|
|
d-i netcfg/get_hostname string debian-k3s
|
|
d-i netcfg/get_domain string local
|
|
|
|
d-i mirror/country string manual
|
|
d-i mirror/http/hostname string deb.debian.org
|
|
d-i mirror/http/directory string /debian
|
|
d-i mirror/http/proxy string
|
|
|
|
d-i passwd/root-login boolean true
|
|
d-i passwd/root-password password packer
|
|
d-i passwd/root-password-again password packer
|
|
d-i passwd/make-user boolean false
|
|
|
|
d-i clock-setup/utc boolean true
|
|
d-i time/zone string UTC
|
|
|
|
d-i partman-auto/method string regular
|
|
d-i partman-auto/disk string /dev/vda
|
|
d-i partman-auto/choose_recipe select gpt-boot-root
|
|
d-i partman-auto/expert_recipe string \
|
|
gpt-boot-root :: \
|
|
512 512 512 fat32 \
|
|
$primary{ } \
|
|
$bootable{ } \
|
|
method{ efi } \
|
|
format{ } \
|
|
. \
|
|
1024 10000 -1 ext4 \
|
|
$primary{ } \
|
|
method{ format } format{ } \
|
|
use_filesystem{ } filesystem{ ext4 } \
|
|
mountpoint{ / } \
|
|
.
|
|
d-i partman-partitioning/confirm_write_new_label boolean true
|
|
d-i partman/choose_partition select finish
|
|
d-i partman/confirm boolean true
|
|
d-i partman/confirm_nooverwrite boolean true
|
|
|
|
d-i apt-setup/non-free-firmware boolean true
|
|
d-i apt-setup/non-free boolean true
|
|
d-i apt-setup/contrib boolean true
|
|
|
|
tasksel tasksel/first multiselect standard, ssh-server
|
|
d-i pkgsel/include string sudo curl ca-certificates qemu-guest-agent cloud-init
|
|
d-i pkgsel/upgrade select full-upgrade
|
|
|
|
d-i grub-installer/only_debian boolean true
|
|
d-i grub-installer/bootdev string default
|
|
|
|
d-i finish-install/reboot_in_progress note
|