# Optional production-style path

This directory provisions one encrypted Ubuntu EC2 host with a deliberately
small network surface. It is a scaffold for the documented cloud path; the
local k3d path remains the primary, cost-free portfolio demo.

The AWS account, region, AMI, SSH key pair, and administrator CIDR are inputs,
not repository values. Do not commit a real `terraform.tfvars` file or private
keys. The security group intentionally exposes SSH and the Kubernetes API only
to `admin_cidr`; add any public application ports explicitly when needed.

Example workflow:

```bash
cp terraform.tfvars.example terraform.tfvars
# Edit every replace-* value and set admin_cidr to your current IP /32.
terraform init
terraform validate
terraform plan
terraform apply
terraform output -raw public_ip
```

Then run `ansible/bootstrap-k3s.yml` against the output IP. `terraform destroy`
removes the lab resources when finished. This path is not required for the
portfolio demo and is not invoked by CI.