19 Commits

Author	SHA1	Message	Date
MichaelFisher1997	952a80a742	Fix HA cluster join via Load Balancer private IP ... Changes: - Use LB private IP (10.0.1.5) instead of public IP for cluster joins - Add LB private IP to k3s TLS SANs on primary control plane - This allows secondary CPs and workers to verify certificates when joining via LB Fixes x509 certificate validation error when joining via LB public IP.	2026-03-23 02:56:41 +00:00
MichaelFisher1997	4965017b86	Fix Load Balancer network attachment ... Add hcloud_load_balancer_network resource to attach LB to private network. This is required before targets can use use_private_ip=true. LB gets IP 10.0.1.5 on the private network.	2026-03-23 02:44:35 +00:00
MichaelFisher1997	b2b9c38b91	Fix Load Balancer output attribute - use ipv4 instead of ipv4_address	2026-03-23 02:40:50 +00:00
MichaelFisher1997	ff31cb4e74	Implement HA control plane with Load Balancer (3-3 topology) ... Major changes: - Terraform: Scale to 3 control planes (cx23) + 3 workers (cx33) - Terraform: Add Hetzner Load Balancer (lb11) for Kubernetes API - Terraform: Add kube_api_lb_ip output - Ansible: Add community.network collection to requirements - Ansible: Update inventory to include LB endpoint - Ansible: Configure secondary CPs and workers to join via LB - Ansible: Add k3s_join_endpoint variable for HA joins - Workflow: Add imports for cp-2, cp-3, and worker-3 - Docs: Update STABLE_BASELINE.md with HA topology and phase gates Topology: - 3 control planes (cx23 - 2 vCPU, 8GB RAM each) - 3 workers (cx33 - 4 vCPU, 16GB RAM each) - 1 Load Balancer (lb11) routing to all 3 control planes on port 6443 - Workers and secondary CPs join via LB endpoint for HA Cost impact: +~€26/month (2 extra CPs + 1 extra worker + LB)	2026-03-23 02:39:39 +00:00
MichaelFisher1997	522626a52b	refactor: simplify stable cluster baseline	2026-03-20 02:24:37 +00:00
MichaelFisher1997	0d83ef45c1	fix: allow optional non-tailnet CIDRs alongside tailnet restrictions	2026-03-01 14:01:32 +00:00
MichaelFisher1997	97084c1581	fix: make private IP outputs resilient during partial imports	2026-03-01 13:36:57 +00:00
MichaelFisher1997	011c220f59	fix: avoid server replacement; install tailscale via Ansible	2026-03-01 04:51:19 +00:00
MichaelFisher1997	1eebfe77df	feat: integrate tailscale access and lock SSH/API to tailnet	2026-03-01 04:04:56 +00:00
MichaelFisher1997	3fafb85780	fix: Switch to nbg1 location (fsn1 unavailable)	2026-02-28 22:13:13 +00:00
MichaelFisher1997	448e0e15f0	fix: Reference data source for SSH key	2026-02-28 22:04:57 +00:00
MichaelFisher1997	27cb069101	fix: Use existing 'infra' SSH key instead of creating new one	2026-02-28 22:03:46 +00:00
MichaelFisher1997	1607387529	fix: Simplify SSH key handling - delete existing key from Hetzner first	2026-02-28 21:58:19 +00:00
MichaelFisher1997	a42653b370	fix: Use eu-central network zone, handle existing SSH key	2026-02-28 21:54:49 +00:00
MichaelFisher1997	99408f55fd	fix: Use one() function to access network set in outputs	2026-02-28 21:29:13 +00:00
MichaelFisher1997	dff2d6a66d	fix: Remove backend.hcl from git, add to gitignore	2026-02-28 21:12:56 +00:00
MichaelFisher1997	4f0402decf	fix: Add TF_VAR_s3_endpoint and TF_VAR_s3_bucket env vars	2026-02-28 21:12:48 +00:00
MichaelFisher1997	cd16545ad3	fix: Add skip_requesting_account_id and use endpoints.s3 for Backblaze B2	2026-02-28 20:58:40 +00:00
MichaelFisher1997	3b3084b997	feat: Add HA Kubernetes cluster with Terraform + Ansible ... - 3x CX23 control plane nodes (HA) - 4x CX33 worker nodes - k3s with embedded etcd - Hetzner CCM for load balancers - Gitea CI/CD workflows - Backblaze B2 for Terraform state	2026-02-28 20:24:55 +00:00