deytenit
710873e72c
### Summary of Changes This PR introduces a declarative, GitOps-managed cloud infrastructure for the monorepo using K3s, Flux v2, and HashiCorp Packer: 1. **Packer Golden Image Builder (`ci/packer/`)**: - Automated Debian 12 minimal base OS image creation using QEMU builder, UEFI firmware, GPT partition scheme, and 2M cluster size `.qcow2` conversion. - Cloud-init, `virtio` kernel drivers, and serial console (`ttyS0`, 115200 baud). - Pre-installed K3s binary (`v1.31.2+k3s1`) with isolated first-boot token and cert generation. - Full identity sanitization (`machine-id` and SSH host key resets). 2. **First-Boot Cloud-Init Bootstrapping (`ci/cloud-init/user-data.yaml`)**: - Configures K3s with `servicelb` disabled and TLS SANs for custom domains and static IP. - Waits for API readiness, initializes `flux-system` namespace, injects `sops-age` secret, and triggers Flux sync. 3. **SOPS & GitOps Root Orchestration (`.sops.yaml`, `ci/k8s/clusters/production/`)**: - SOPS encryption configuration targeting Kubernetes secrets with `age` key recipient. - Flux v2 `GitRepository` and `Kustomization` manifests tracking `next`. 4. **Infrastructure & Networking (`ci/k8s/base/`, `ci/k8s/infrastructure/`)**: - Dedicated `com-ermnvldmr` namespace. - `cert-manager` HTTP-01 `ClusterIssuer` (`letsencrypt-prod` & `letsencrypt-staging`). - Traefik Ingress routing for `ermnvldmr.com`, `www.ermnvldmr.com`, `docs.ermnvldmr.com`, and `analytics.ermnvldmr.com`. 5. **PostgreSQL & Applications (`ci/k8s/apps/`)**: - PostgreSQL 16 StatefulSet on 5Gi `local-path` persistent storage with low-memory tuning. - Deployments for `www` (pinned `sha-6d33b71`), `docs` (pinned `sha-91f5245`), and `umami` (pinned `postgresql-v2.14.0`) with zero-downtime rolling update strategy. 6. **CI/CD Workflows (`.github/workflows/`)**: - `ci - next/build-golden-image`: Workflow to build and upload `com-ermnvldmr-debian-12-k3s-amd64-<tag>.qcow2` to static S3 `/dev/images/`. - Updated `services-www-releases-dispatch-release.yml` and `services-docs-next-required.yml` with GitOps deployment steps.
58 lines
1.5 KiB
Bash
Executable File
58 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
echo "=== Configuring Base System for Cloud Image ==="
|
|
|
|
# Install essential kernel modules and utilities
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
cloud-init \
|
|
qemu-guest-agent \
|
|
linux-image-amd64 \
|
|
socat \
|
|
conntrack \
|
|
ipset \
|
|
iptables \
|
|
ufw \
|
|
fail2ban \
|
|
unattended-upgrades \
|
|
curl \
|
|
ca-certificates \
|
|
gnupg \
|
|
tar \
|
|
gzip
|
|
|
|
# Ensure virtio kernel modules are loaded on boot
|
|
cat << 'EOF' > /etc/modules-load.d/virtio.conf
|
|
virtio
|
|
virtio_net
|
|
virtio_blk
|
|
virtio_pci
|
|
virtiofs
|
|
EOF
|
|
|
|
# Configure GRUB for Serial Console (ttyS0 / COM1) and predictable network names
|
|
sed -i 's/^GRUB_CMDLINE_LINUX_DEFAULT=.*/GRUB_CMDLINE_LINUX_DEFAULT="console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0"/' /etc/default/grub
|
|
sed -i 's/^#GRUB_TERMINAL=.*/GRUB_TERMINAL="console serial"/' /etc/default/grub
|
|
echo 'GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"' >> /etc/default/grub
|
|
update-grub
|
|
|
|
# Enable serial console getty
|
|
systemctl enable serial-getty@ttyS0.service || true
|
|
|
|
# Configure cloud-init to use NoCloud and ConfigDrive datasources
|
|
cat << 'EOF' > /etc/cloud/cloud.cfg.d/99-cloud-init.cfg
|
|
datasource_list: [ NoCloud, ConfigDrive, None ]
|
|
datasource:
|
|
NoCloud:
|
|
fs_label: cidata
|
|
EOF
|
|
|
|
# Ensure DHCP on eth0
|
|
cat << 'EOF' > /etc/network/interfaces.d/eth0
|
|
auto eth0
|
|
iface eth0 inet dhcp
|
|
EOF
|
|
|
|
echo "=== Base System Configuration Complete ==="
|