- Seems to require
export ANSIBLE_BECOME_EXE=sudo.wsdue to this issue - Run with
ansible-playbook playbook.yml -i inventory.yml -kKwhere the flags have you manually input SSH password
ansible/- Contains Ansible playbook to bootstrap K3spulumi- IaC for managing cloud & k8s resources
flowchart TB
subgraph Internet
Users[External Users]
CF[Cloudflare]
end
subgraph Tailnet[Tailscale Network]
Admin[Admin/Internal Users]
end
subgraph Server["Server (new-bermuda)"]
subgraph K3s[K3s Cluster]
subgraph Networking
TSOperator[Tailscale Operator]
Cloudflared[cloudflared pods]
end
subgraph Apps[Applications]
Foundry[Foundry VTT]
Glance[Glance Dashboard]
Satisfactory[Satisfactory Server]
end
subgraph Monitoring[Monitoring Stack]
Prometheus[Prometheus]
Grafana[Grafana]
end
subgraph Storage
FoundryPV[(PV: /home/jack/foundrydata)]
SatisfactoryPV[(PV: /home/jack/satisfactory)]
GrafanaPV[(PV: Grafana)]
end
end
end
Users -->|HTTPS| CF
CF -->|Zero Trust Auth| CF
CF -->|Tunnel| Cloudflared
Cloudflared -->|:30000| Foundry
Admin -->|Tailscale Full Access| TSOperator
TSOperator -->|Ingress| Glance
TSOperator -->|Ingress| Foundry
TSOperator -->|Ingress| Satisfactory
TSOperator -->|Ingress| Grafana
Members[Tailnet Members] -->|Tailscale :7777 only| Satisfactory
Foundry --> FoundryPV
Satisfactory --> SatisfactoryPV
Grafana --> GrafanaPV
Prometheus -.Scrapes.- Foundry
Prometheus -.Scrapes.- Satisfactory
style CF fill:#f6821f
style TSOperator fill:#4a5568
style Foundry fill:#7c3aed
style Glance fill:#10b981
style Satisfactory fill:#f97316
style Grafana fill:#ff6b6b
style Prometheus fill:#e08234
- Cloudflare for 'application' access - in my case, Foundry for DnD sessions
- Tailscale for everything else
- Tailscale K8s operator pod
- ACL: admin user has full access; all other tailnet members restricted to Satisfactory server (port 7777) only
- Used to manage Cloudflare resources
- Creates tunnel & DNS records
- Creates zero-trust application
- Also creates Kubernetes resources, generally a file per application
- Bootstrap K8s cluster basically
- NOTE: in the future, probably will get more Hardware
- perhaps a stack per machine? maybe? that may not make sense though if a cluster is machine agnostic