Ansible on Alwaldend

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

Ansible

Mon, 01 Jan 0001 00:00:00 +0000

flux

Mon, 01 Jan 0001 00:00:00 +0000

Set up port forwarding

ssh -L 6443:127.0.0.1:6443 -N flux.alwaldend.com

Run flux CLI

bazel run //infra/flux/cl:flux

Show flux status

bazel run infra/flux/cl:flux -- get all -A

Run bootstrap

bazel run //infra/flux/cl:flux.bootstrap

Run flux operator

bazel run //infra/flux/cl:op

Show oidc info

bazel run //infra/flux/cl:oidc

Renew certificate

bazel run //infra/flux/cl:cmctl -- renew traefik-gateway-websecure-tls -n traefik

Update secrets

Generate secret id and the token:

SECRET_ID=$(bazel run //infra/flux/cl:vault.secret_id | jq -r .data.secret_id)
TOKEN=$(echo "${SECRET_ID}" | bazel run //infra/flux/cl:vault.ops_token | jq -r .auth.client_token)
echo "Secret id: ${SECRET_ID}, Token: ${TOKEN}"

Patch secret-id in ./cl/cert-manager/issuer-approle.yaml
Patch token in projects/kustomization/flux-repo/flux-sops-secret.yaml

Encrypt:

bazel run //infra/flux/cl:sops.encrypt infra/flux/cl/cert-manager/issuer-approle.yaml
bazel run //infra/flux/cl:sops.encrypt projects/kustomization/flux-repo/flux-sops-secret.yaml
bazel run //infra/flux/cl:sops.encrypt projects/kustomization/flux-repo/flux-git-src-secret.yaml

forgejo

Mon, 01 Jan 0001 00:00:00 +0000

Deployment

bazel run //infra/forgejo/tf_setup # Create hosts
bazel run //infra/forgejo/ansible # Configure hosts
bazel run //infra/forgejo/tf # Configure forgejo

Forgejo runner

Mon, 01 Jan 0001 00:00:00 +0000

Deploy VMs

bazel run //infra/forgejo_runner/tf_setup # Create VMs
bazel run //infra/forgejo_runner/ansible # Configure VMs

harbor

Mon, 01 Jan 0001 00:00:00 +0000

Update secrets

Generate approle secret id:

SECRET_ID=$(bazel run //infra/harbor/cl:vault.secret_id | jq -r .data.secret_id)
echo "Secret id: ${SECRET_ID}"

Patch secret-id in ./cl/cert-manager/issuer-approle.yaml

Encrypt:

bazel run //infra/flux/cl:sops.encrypt infra/harbor/cl/cert-manager/issuer-approle.yaml

Host Bot

Mon, 01 Jan 0001 00:00:00 +0000

Host Bot runs Traefik with mTLS in front of T3 Code. The host firewall blocks direct external access to T3 Code and accepts new connections only on SSH, HTTP, and HTTPS ports.

T3 Code controls permissions per thread. Its Auto mode maps to Codex Auto-review. The managed Codex requirements allow read-only and host-bot permissions with on-request approvals, so threads cannot select Full access or disable approvals. The requirements file only allowlists the host-bot profile; it must not define the profile because T3 Code supplies a per-thread config layer with the same name, and Codex rejects profiles defined by both requirements and config. The normal and isolated provider configs define host-bot with workspace writes, public command-network access, and write access to the Bazel cache and Bazelisk directories while keeping local network binding and loopback connections available for Bazel servers. Other private network targets remain blocked. T3 Code must select that profile for the thread. Hosted web search is not restricted by this role.

Pve

Mon, 01 Jan 0001 00:00:00 +0000

Deployment

bazel run //infra/pve/ansible # host setup
bazel run //infra/pve/tf/tf.apply # tf setup

Recreate the test VM

bazel run //infra/pve/tf:tf.apply -- --replace module.vm_cloudinit_test.proxmox_vm_qemu.vm

Cloud-init snippet update

bazel run //infra/pve/ansible -- --tags pve_snippets

Update ACME account

Create an EAB:

bazel run //infra/dc1/vault -- write -f pki/ica_servers/roles/src_infra_dc1_pve1_pki_server/acme/new-eab

Login as root@pam
Go to Datacenter -> ACME

Create a new account with the EAB and a directory:

https://vault.dc1.alwaldend.com:8200/v1/pki/ica_servers/roles/src_infra_dc1_pve1_pki_server/acme/directory

Pve token

Create a token with Privilege Separation
Grant it required roles

Create json:

{
  "token_id": "",
  "token_secret": ""
}

Write the data:

bazel run //infra/pve:vault.kv_put alwaldend.com/vault1/approles/src_infra_dc1_pve1/pve_token @"${PWD}/data.json"

Vault

Mon, 01 Jan 0001 00:00:00 +0000

Deployment

bazel run //infra/vault/tf_setup:tf.apply # Create VMs (requires an active Vault host)
bazel run //infra/vault/ansible # Set up hosts (BM and VMs)
bazel run //infra/vault/tf:tf.apply # Configure vault

Backup

bazel run //infra/vault:backup

Unseal

With a working Vault:

bazel run //infra/vault:unseal

Without a working Vault:

bazel run //infra/vault:unseal_standalone

Fix quorum

bazel run //infra/vault/ansible:fix_quorum

Set up only VMs

bazel run //infra/vault/ansible:ansible.vm # Set up only VMs

Set up only bare metal

bazel run //infra/vault/ansible:ansible.bm # Set up only bare metal

Tf

Plan:

Ansible on Alwaldend

Ansible

Ansible

Ansible

Ansible

Ansible

Ansible

Ansible

Ansible

Ansible

Ansible

flux

Links

Set up port forwarding

Run flux CLI

Show flux status

Run bootstrap

Run flux operator

Show oidc info

Renew certificate

Update secrets

forgejo

Links

Deployment

Forgejo runner

Deploy VMs

harbor

Links

CE Login

Update secrets

Host Bot

Pve

Links

Deployment

Recreate the test VM

Cloud-init snippet update

Update ACME account

Pve token

Vault

Links

Deployment

Backup

Unseal

Fix quorum

Set up only VMs

Set up only bare metal

Tf