Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
2026-09-09 16:47:20 +00:00
commit 88a02ababa
418 changed files with 50579 additions and 0 deletions
@@ -0,0 +1,31 @@
+---
+# Non-secret variables for the OpenBao deploy. EDIT to your environment.
+# Secrets (transit unseal token) live in group_vars/all/vault.yml — see vault.example.yml.
+
+# --- Release (pinned + checksum-verified) ---
+# Bump both together. Get the checksum from the release's checksums.txt:
+#   curl -sL https://github.com/openbao/openbao/releases/download/v<VER>/checksums.txt \
+#     | grep openbao_<VER>_linux_amd64.tar.gz
+openbao_version: "2.6.1"
+openbao_download_checksum: "sha256:ca8d836eb3a5c80407e45e762300b64e7138c419e78826955f2e4ba4ce6d8a6b"
+
+# --- Identity / addresses ---
+openbao_fqdn: "bao.ad.ddupan.top"       # A record on the Samba DC (ad.ddupan.top zone)
+openbao_lan_ip: "192.168.10.8"          # bao's LAN IP — pods use this; also the VM's static IP
+
+# --- Optional host firewall ---
+# Restrict the API/cluster ports to tailnet + cluster once you're ready (needs ufw).
+openbao_manage_firewall: false
+openbao_allowed_cidrs:
+  - "100.64.0.0/10"       # Tailscale CGNAT range (remote humans + laptop agent)
+  - "192.168.10.0/24"     # LAN / k8s cluster
+
+# --- Auto-unseal (transit) ---
+# Leave OFF for the first init so you do a normal Shamir init (keys handed to you).
+# Turn ON once a second bao/transit source exists, then supply the token from vault
+# and re-run the play (a restart re-reads config; auto-unseal makes restarts hands-off).
+openbao_auto_unseal: false
+openbao_transit_address: "https://bao-seal.ddupan.top:8200"
+openbao_transit_key_name: "autounseal"
+openbao_transit_mount_path: "transit/"
+openbao_transit_token: "{{ vault_openbao_transit_token | default('') }}"
@@ -0,0 +1,19 @@
+---
+# Copy to vault.yml and encrypt:  ansible-vault encrypt group_vars/all/vault.yml
+# NEVER commit the decrypted vault.yml.
+#
+# Only needed once you switch to transit auto-unseal (openbao_auto_unseal: true).
+# This is the token the seal source hands out for the autounseal transit key —
+# scope it to just encrypt/decrypt on that key.
+vault_openbao_transit_token: "CHANGE-ME-transit-unseal-token"
+
+# Plaintext of the Authelia 'openbao' OIDC client secret (Authelia stores the pbkdf2
+# hash; OpenBao holds this plaintext). Used by the bootstrap play's auth/oidc config.
+vault_openbao_oidc_client_secret: "CHANGE-ME-authelia-openbao-client-secret"
+
+# Reviewer SA JWT for Kubernetes auth (only when openbao_enable_k8s_auth: true).
+# kubectl -n agents create token bao-reviewer --duration=87600h
+vault_openbao_k8s_reviewer_jwt: "CHANGE-ME-k8s-reviewer-jwt"
+
+# Cloudflare API token for ACME DNS-01 (acme-openbao.yml). Scope: Zone:DNS:Edit on ddupan.top.
+vault_openbao_cf_dns_token: "CHANGE-ME-cloudflare-dns-edit-token"
@@ -0,0 +1,88 @@
+$ANSIBLE_VAULT;1.1;AES256
+32653035643430653731303165663162316566633364633933376235326265653032313939363632
+3730656332633132643935616238313739643264383866390a306637656430646262646339346661
+31623536346535336336306639333161373134313536396166623334323633613465363834363864
+3434633836356138370a336430316164326538383866646134353565393739303263636532346661
+66623830393366626631666363313639393463626264356530623435636432643961653832386162
+63323864393763396633353365653437646564646534383638323439663664316639633766316330
+63373134613065656561363030616466636262356439656530383661393033386534333661323037
+64333139356330373636316438353733376235623531346437333666383936333937373730333333
+39333733333964383535666235633331373663313438353366333439383765633962386665376337
+35303739343865386562326163306438646238613663373561353132323139373063303337656238
+36383162643762313362336232663266383034386238346639646336643463623763393361356565
+34616464326330373262383736353061366538333739653163636530383566313039623539313134
+38646530663137666238313036333038303964663036643035333062616438323239656565643432
+36656535383563393364626465393635343433646661643037643536373666353562333261333162
+34383635336565366431393663343464656438613138396563386531663862623861353061396166
+31383937653633373734383536323366313364363864626239646465656361346265316364636664
+37666465313336636638613635393261343065333533366638646161333964323634343237646430
+37353030393336376662383961303662386632666262346130646631346166383262393639363433
+33636463323737396466626131323834623064373035396566356563393862373562633564366165
+32643433333431626237326633336564356437653033376362666435363938643033643235333561
+33653636383631663435623064353133393561656539366238396331313336363138353066613530
+38656633303262393336346233313761343036623965633836376336386537636535633837393133
+36366331356437316236326432666362643736373038616163663265383762323837316430323266
+36353432313930636431316638326630633534346635333130393031666361356463383432616664
+63383732306435653134303566366633393437316663353136366662653462666439646339643430
+33653738323764386131623166313030313734313933316561363439386663636261343436653232
+66623465326631663462633466616335623265343034623161326161616138643131646436396535
+34663330666363626631336264656566306237343539353932343535313035346438323838366434
+62663934363737633232353066363231353635626339643862353266656562643235366164636163
+31613432326634633161373038636537626266353365306331383661343538626133343965623764
+38373532646265633964326435663430356536336234376135636332333165613131323566633562
+31636433393466646130346238366462306236383966333739316133376638656462653761316131
+30356265326263633834353362643238353963636665303063316637373230353732363333386636
+63323333303861323830356336346536376561643136363961653535396562666266383162353061
+61396364616331626466356661636433363239383266633935353865336266383636363431386331
+64316634353665653966386536333966663633313865303235366164383434636334366531303337
+34373634306465613435303930336265303731373931316263323164343166336334623465626466
+30643736623435343530666137383132386364623533346132633563616239393433386361623136
+32383531366365633564323835376433376462313664616433303361366238303264633061353262
+61613530393832306265623837356232666131333235663866363830666235383366623330646338
+65656266393237366636383037643131393761666164633163646161616562623965653735653766
+65633731366338346337366332383135323364616666653963383532353362366437656434626433
+32386230653564613035333032666364306537353964346437313561356635336330336465303533
+33366533653265363366633039326434366537396661663235613938386262313637383064393235
+38666265383839633165626334336365666365343639356662303966613236383538373762633131
+32653237633238633565303532653331343131303530313537366138626434336264643532626337
+66326335333937643036383063303561666237386434303935383334326364336463306331663864
+33376263633430383763346631306331353638653063383132313132303332613036353663316234
+64383663323131383831653533376666323666313031663862376266636262373635633932343064
+64623761356537656631316134656136663962343431373136633465333362316263316530313664
+36303062303938623764326131396635633239323961323064333436313564633635383038663838
+37363735393639323464663531376537386431393431303232613335643565303463656235643663
+63323035396164623839623663366430363361313563643462346335623061316361333530393766
+35353864313937633065333533323330626337643733623332303462343435366664623862313363
+30623631386139616664323562333433663862646430333131626134666233653762363936653165
+63623061316330383537396536313263376536316563303766383237636164376465623863356334
+39373863343232323361333939393264303030383430313864616261333238616637343834313264
+36333130376339646461346530343461383265613538376135363565666563633031613332633136
+32666161613766626636653533363131353137653139336265363337373265626365306333613136
+64363663393039363734316139633231613562623466616333653063643531313430643433356231
+32646639393637316530623339316239306265353333363737643232656330623634333533653232
+39373564316433353263653061376334376263343935333831653937393434666430326137613339
+36386634343166646164353066343665333066613538373639393733316438356235323961653132
+33373264363335346633636336316631323064636238333031336333366537366139323636393766
+39376632363935633835356163646235326366623035653730346331333237363063323861633639
+61613566343561376466626133306634643437386364643839343535313661613462316263383031
+33373534396566383039643930393337613233306164356636383333626663643037363232623539
+38353863636535383830343734663337633633626133623230626235646332343166366232633962
+39646333336434643063633765386466653632386431393430356135343165326461373934366133
+33663137306566316361326633616436393962313564346566393563646263616335383830366139
+35666437636238323135306231346436626563386237383134343465666231373331363965316265
+31313838383236396433306430376533383139326466383438383366396537643935653230383963
+62616365306564326661386461303662396565613561653938636161326437333162363935643337
+36633064643035363532363161383264343634383463653563333236666665616566666363623838
+31393036333934303534393965653662343064656339343039383730653461343932363335306231
+36626534363966323431333532353639643533663339616262336134363261393163346236316633
+39313161303166643337366265663162626637323666366363386335343931313837623231303164
+34663633396532346266663032376363373262376238653435646261366633386531613538356632
+30636639653966383637323635653539613039623039623463333535613561616539386334323866
+39373133316637633330653636313436313635396539356436343631356461303639376265623862
+32303831353338323265373636613834356366666137666234633536343837326534386162343730
+35383938643662363266316365383930663939666134346562363363363661633335363938626262
+63623565366439323230633663333861313638656632396164313032643138363665663961656539
+31346135373066363038303038643431636139373331616663623638366331656336626664646166
+61346461626336363432636633613836326236666664663663356461373331613739663163326366
+31626230383132626437386361616237666130366536656136663931666239363430336433626535
+623564643364303638626233343331336361