feat: Add HA Kubernetes cluster with Terraform + Ansible

- 3x CX23 control plane nodes (HA)
- 4x CX33 worker nodes
- k3s with embedded etcd
- Hetzner CCM for load balancers
- Gitea CI/CD workflows
- Backblaze B2 for Terraform state

ansible/roles/k3s-server/tasks/main.yml

@@ -0,0 +1,56 @@
+---
+- name: Check if k3s is already installed
+  stat:
+    path: /usr/local/bin/k3s
+  register: k3s_binary
+
+- name: Download k3s install script
+  get_url:
+    url: https://get.k3s.io
+    dest: /tmp/install-k3s.sh
+    mode: "0755"
+  when: not k3s_binary.stat.exists
+
+- name: Install k3s server (primary)
+  environment:
+    INSTALL_K3S_VERSION: "{{ k3s_version if k3s_version != 'latest' else '' }}"
+    K3S_TOKEN: "{{ k3s_token }}"
+  command: /tmp/install-k3s.sh server --cluster-init
+  args:
+    creates: /usr/local/bin/k3s
+  when: 
+    - not k3s_binary.stat.exists
+    - k3s_primary | default(false)
+
+- name: Install k3s server (secondary)
+  environment:
+    INSTALL_K3S_VERSION: "{{ k3s_version if k3s_version != 'latest' else '' }}"
+    K3S_TOKEN: "{{ k3s_token }}"
+  command: /tmp/install-k3s.sh server --server https://{{ k3s_primary_ip }}:6443
+  args:
+    creates: /usr/local/bin/k3s
+  when: 
+    - not k3s_binary.stat.exists
+    - not (k3s_primary | default(false))
+
+- name: Wait for k3s to be ready
+  command: kubectl get nodes
+  register: k3s_ready
+  until: k3s_ready.rc == 0
+  retries: 30
+  delay: 10
+  changed_when: false
+
+- name: Copy kubeconfig to default location for root
+  file:
+    src: /etc/rancher/k3s/k3s.yaml
+    dest: /root/.kube/config
+    state: link
+    force: true
+
+- name: Ensure .kube directory exists for ansible user
+  file:
+    path: "/home/{{ ansible_user }}/.kube"
+    state: directory
+    mode: "0755"
+  when: ansible_user != 'root'