first commit

2026-08-09 19:52:19 -04:00
commit f12fb4d7a1
25 changed files with 597 additions and 0 deletions
@@ -0,0 +1,17 @@
+# Optional Ansible bootstrap
+
+The playbook applies a small host baseline (AppArmor, unattended security
+updates, swap removal, and SSH hardening) and installs a pinned K3s server. It
+is intentionally separate from the local k3d path so the portfolio can be
+run without cloud credentials.
+
+```bash
+cp inventory.example.yml inventory.yml
+# Replace the Terraform public IP and local SSH key path.
+ansible-playbook -i inventory.yml bootstrap-k3s.yml
+```
+
+Before production use, review the pinned K3s version and extend the playbook
+for your organization’s OS baseline, firewall model, HA topology, and secret
+management. RKE2 can replace K3s here if the target environment requires it.
+