18 lines
685 B
Markdown
18 lines
685 B
Markdown
# Optional Ansible bootstrap
|
||
|
||
The playbook applies a small host baseline (AppArmor, unattended security
|
||
updates, swap removal, and SSH hardening) and installs a pinned K3s server. It
|
||
is intentionally separate from the local k3d path so the portfolio can be
|
||
run without cloud credentials.
|
||
|
||
```bash
|
||
cp inventory.example.yml inventory.yml
|
||
# Replace the Terraform public IP and local SSH key path.
|
||
ansible-playbook -i inventory.yml bootstrap-k3s.yml
|
||
```
|
||
|
||
Before production use, review the pinned K3s version and extend the playbook
|
||
for your organization’s OS baseline, firewall model, HA topology, and secret
|
||
management. RKE2 can replace K3s here if the target environment requires it.
|
||
|