Initial VPS operations handbook

2026-08-03 12:26:42 +08:00
commit b73125e5bc
97 changed files with 3641 additions and 0 deletions
@@ -0,0 +1,13 @@
+---
+cert_manager_enabled: false
+cert_manager_namespace: cert-manager
+cert_manager_release_name: cert-manager
+cert_manager_chart_repository_name: jetstack
+cert_manager_chart_repository_url: https://charts.jetstack.io
+cert_manager_chart_ref: jetstack/cert-manager
+cert_manager_chart_version: v1.19.3
+cert_manager_kubeconfig: /etc/rancher/k3s/k3s.yaml
+cert_manager_cluster_issuer_name: letsencrypt-prod
+cert_manager_acme_server: https://acme-v02.api.letsencrypt.org/directory
+cert_manager_acme_private_key_secret: letsencrypt-prod-private-key
+cert_manager_ingress_class: traefik
@@ -0,0 +1,94 @@
+---
+- name: Require explicit approval before cert-manager reconciliation
+  ansible.builtin.assert:
+    that:
+      - cert_manager_enabled | bool
+    fail_msg: >-
+      Refusing cert-manager changes. Re-run with cert_manager_enabled=true after
+      confirming public TCP 80 and 443 reach Traefik.
+
+- name: Require Helm and the K3s kubeconfig
+  ansible.builtin.stat:
+    path: "{{ item }}"
+  loop:
+    - /usr/local/bin/helm
+    - "{{ cert_manager_kubeconfig }}"
+  register: cert_manager_prerequisites
+
+- name: Assert Helm and kubeconfig are available
+  ansible.builtin.assert:
+    that:
+      - item.stat.exists
+    fail_msg: "Missing cert-manager prerequisite: {{ item.item }}"
+  loop: "{{ cert_manager_prerequisites.results }}"
+
+- name: Add or update the Jetstack Helm repository
+  ansible.builtin.command:
+    argv:
+      - helm
+      - repo
+      - add
+      - "{{ cert_manager_chart_repository_name }}"
+      - "{{ cert_manager_chart_repository_url }}"
+      - --force-update
+  environment:
+    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
+  changed_when: false
+
+- name: Update Helm repositories
+  ansible.builtin.command:
+    argv: [helm, repo, update]
+  environment:
+    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
+  changed_when: false
+
+- name: Install or reconcile cert-manager
+  ansible.builtin.command:
+    argv:
+      - helm
+      - upgrade
+      - --install
+      - "{{ cert_manager_release_name }}"
+      - "{{ cert_manager_chart_ref }}"
+      - --namespace
+      - "{{ cert_manager_namespace }}"
+      - --create-namespace
+      - --version
+      - "{{ cert_manager_chart_version }}"
+      - --set
+      - crds.enabled=true
+      - --wait
+      - --timeout
+      - 10m
+  environment:
+    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
+  changed_when: true
+
+- name: Install ClusterIssuer manifest without secret material
+  ansible.builtin.template:
+    src: clusterissuer.yaml.j2
+    dest: "/etc/rancher/k3s/{{ cert_manager_cluster_issuer_name }}-clusterissuer.yaml"
+    owner: root
+    group: root
+    mode: "0600"
+
+- name: Apply ClusterIssuer manifest
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - apply
+      - -f
+      - "/etc/rancher/k3s/{{ cert_manager_cluster_issuer_name }}-clusterissuer.yaml"
+  changed_when: false
+
+- name: Wait for ClusterIssuer readiness
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - wait
+      - --for=condition=Ready
+      - "clusterissuer/{{ cert_manager_cluster_issuer_name }}"
+      - --timeout=180s
+  changed_when: false
@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ cert_manager_cluster_issuer_name }}
+spec:
+  acme:
+    server: {{ cert_manager_acme_server }}
+    privateKeySecretRef:
+      name: {{ cert_manager_acme_private_key_secret }}
+    solvers:
+      - http01:
+          ingress:
+            class: {{ cert_manager_ingress_class }}