Initial VPS operations handbook

ansible/roles/matrix_cluster_base/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+# These resources are intentionally chart-independent and secret-free.
+matrix_namespace: matrix-system
+matrix_resource_quota:
+  requests.cpu: "4"
+  requests.memory: 6Gi
+  limits.cpu: "6"
+  limits.memory: 7Gi
+  persistentvolumeclaims: "4"
+matrix_limit_range:
+  defaultRequest:
+    cpu: 50m
+    memory: 128Mi
+  default:
+    memory: 1Gi

ansible/roles/matrix_cluster_base/tasks/main.yml

@@ -0,0 +1,24 @@
+---
+- name: Require a working K3s kubeconfig
+  ansible.builtin.stat:
+    path: /etc/rancher/k3s/k3s.yaml
+  register: matrix_cluster_kubeconfig
+
+- name: Assert K3s is ready before creating cluster resources
+  ansible.builtin.assert:
+    that:
+      - matrix_cluster_kubeconfig.stat.exists
+    fail_msg: Run k3s-server.yml successfully before matrix-cluster-base.yml.
+
+- name: Install Matrix cluster base manifest
+  ansible.builtin.template:
+    src: base-resources.yaml.j2
+    dest: /etc/rancher/k3s/matrix-cluster-base.yaml
+    owner: root
+    group: root
+    mode: "0600"
+
+- name: Apply Matrix cluster base manifest
+  ansible.builtin.command:
+    argv: [k3s, kubectl, apply, -f, /etc/rancher/k3s/matrix-cluster-base.yaml]
+  changed_when: false

ansible/roles/matrix_cluster_base/templates/base-resources.yaml.j2

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ matrix_namespace }}
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: matrix-system-quota
+  namespace: {{ matrix_namespace }}
+spec:
+  hard:
+{{ matrix_resource_quota | to_nice_yaml(indent=4) | indent(4, true) }}
+---
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: matrix-system-defaults
+  namespace: {{ matrix_namespace }}
+spec:
+  limits:
+    - type: Container
+      defaultRequest:
+{{ matrix_limit_range.defaultRequest | to_nice_yaml(indent=8) | indent(8, true) }}
+      default:
+{{ matrix_limit_range.default | to_nice_yaml(indent=8) | indent(8, true) }}

ansible/roles/matrix_cluster_base/templates/letsencrypt-prod-clusterissuer.yaml.j2

@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod-private-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik