deytenit
502ef94bb2
### Summary of Changes This PR incorporates the final infrastructure optimizations following the initial merge of PR #25: 1. **SOPS & Secrets Management**: - Generated dedicated Age keypair (`age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl`) and updated `.sops.yaml`. - Added SOPS-encrypted production secrets for PostgreSQL (`ci/k8s/apps/postgres/secret.sops.yaml`) and Umami Analytics (`ci/k8s/apps/umami/secret.sops.yaml`). - Verified 100% clean round-trip decryption. 2. **Cloud-Init Template & Git Safety**: - Converted `user-data.yaml` into `user-data.template.yaml` with clear stubs for public SSH keys and private Age keys. - Added `ci/cloud-init/user-data.yaml` to `.gitignore` to prevent accidental secret leaks. 3. **Persistent Secondary Storage**: - Added automated detection, ext4 formatting, and mounting of secondary persistent disk (`/dev/vdb`) to `/var/lib/rancher/k3s/storage` with `noatime` in `user-data.template.yaml`. 4. **Golden Image Naming & Workflows**: - Updated image naming convention to include hyphenated UTC timestamps: `com-ermnvldmr-debian-12-k3s-amd64-YYYY-MM-DD-HH-MM-SS-sha-<short_sha>.qcow2`. - Verified successful CI golden image build and S3 upload.
15 lines
234 B
Plaintext
15 lines
234 B
Plaintext
#cloud-config
|
|
ssh_pwauth: true
|
|
disable_root: false
|
|
chpasswd:
|
|
list: |
|
|
debian:packer
|
|
root:packer
|
|
expire: false
|
|
users:
|
|
- default
|
|
- name: debian
|
|
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
shell: /bin/bash
|
|
lock_passwd: false
|