From ff1150fa9e8a6779d1eb02b1669537afdad9e815 Mon Sep 17 00:00:00 2001
From: chrisfu <chrisfu@prole.org>
Date: Sun, 25 Jan 2026 22:18:10 -0800
Subject: [PATCH] add iscsi mount guardrails. get k3s server token script

---
 etc/set-k3s-token-vault.sh                    | 67 +++++++++++++++++++
 .../inventory/group_vars/all/vault_k3s.yml    | 11 +++
 .../inventory/host_vars/myrddin.prole.org     | 12 ++++
 .../inventory/host_vars/pi.prole.org.yml      |  4 ++
 4 files changed, 94 insertions(+)
 create mode 100755 etc/set-k3s-token-vault.sh
 create mode 100644 infrastructure/inventory/group_vars/all/vault_k3s.yml

diff --git a/etc/set-k3s-token-vault.sh b/etc/set-k3s-token-vault.sh
new file mode 100755
index 0000000..46dc363
--- /dev/null
+++ b/etc/set-k3s-token-vault.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Where k3s keeps the server join token on the first/control-plane server
+TOKEN_FILE="${TOKEN_FILE:-/var/lib/rancher/k3s/server/node-token}"
+
+# Pick a dedicated vault file so we don't stomp your existing vault.yml.
+# Change this if you want it somewhere else.
+VAULT_FILE="${VAULT_FILE:-infrastructure/inventory/group_vars/all/vault_k3s.yml}"
+
+# Variable name to store in the vault
+VAR_NAME="${VAR_NAME:-vault_k3s_token}"
+
+if [[ ! -r "$TOKEN_FILE" ]]; then
+  echo "ERROR: Cannot read token file: $TOKEN_FILE"
+  echo "Are you running this on a k3s server (pi.prole.org)?"
+  exit 1
+fi
+
+if ! command -v ansible-vault >/dev/null 2>&1; then
+  echo "ERROR: ansible-vault not found in PATH"
+  exit 1
+fi
+
+TOKEN="$(sudo cat "$TOKEN_FILE" | tr -d '\r\n')"
+
+if [[ -z "$TOKEN" ]]; then
+  echo "ERROR: Token read from $TOKEN_FILE is empty"
+  exit 1
+fi
+
+mkdir -p "$(dirname "$VAULT_FILE")"
+
+TMP="$(mktemp)"
+trap 'rm -f "$TMP"' EXIT
+
+# Build a vault yaml with exactly one variable
+# (ansible-vault encrypt_string outputs a full YAML block)
+ansible-vault encrypt_string \
+  --name "$VAR_NAME" \
+  "$TOKEN" > "$TMP"
+
+# If the vault file already exists, avoid duplicate var definitions:
+# - if VAR_NAME already present, we replace the whole file (simple + safe)
+# - otherwise, append
+if [[ -f "$VAULT_FILE" ]]; then
+  if grep -qE "^\s*${VAR_NAME}:" "$VAULT_FILE"; then
+    echo "Updating existing $VAR_NAME in $VAULT_FILE (replacing file contents)."
+    mv "$TMP" "$VAULT_FILE"
+  else
+    echo "Appending $VAR_NAME to $VAULT_FILE"
+    printf "\n" >> "$VAULT_FILE"
+    cat "$TMP" >> "$VAULT_FILE"
+  fi
+else
+  echo "Creating vault file: $VAULT_FILE"
+  mv "$TMP" "$VAULT_FILE"
+fi
+
+chmod 0600 "$VAULT_FILE"
+
+echo "Done."
+echo "Wrote: $VAULT_FILE"
+echo "Var:   $VAR_NAME"
+echo
+echo "Verify with:"
+echo "  ansible -i infrastructure/inventory/hosts.ini pi.prole.org -m assert -a 'that=${VAR_NAME} is defined' --ask-vault-pass"
diff --git a/infrastructure/inventory/group_vars/all/vault_k3s.yml b/infrastructure/inventory/group_vars/all/vault_k3s.yml
new file mode 100644
index 0000000..e978002
--- /dev/null
+++ b/infrastructure/inventory/group_vars/all/vault_k3s.yml
@@ -0,0 +1,11 @@
+vault_k3s_token: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          63653139653862326430333034343737616234386639663461643535653362343639666530323039
+          3337303264656331623038623866396366316335666437310a373862626164636463613166326264
+          34396631366361343365623761343361383734346664366664356262373764313961313338336137
+          3832373063633439350a326466303830626130333461646136623334323738616339383637373935
+          37313266346437303461653937363035643737373632613332363339386164356464613663616435
+          66353533666434323466383034326531653337323932303636353436623566316537326561366539
+          62386437313037386334323363343232643032663064383130656465633630306535623162353563
+          38306432396432346535326638613132353163363734633861666662666239646432333061626431
+          32653766616131336635636231646263323736323335386364356232643339333136
\ No newline at end of file
diff --git a/infrastructure/inventory/host_vars/myrddin.prole.org b/infrastructure/inventory/host_vars/myrddin.prole.org
index 0b0e5ba..b275fa6 100644
--- a/infrastructure/inventory/host_vars/myrddin.prole.org
+++ b/infrastructure/inventory/host_vars/myrddin.prole.org
@@ -50,3 +50,15 @@ iscsi_targets:
         fstype: ext4
         opts: "_netdev,noatime"
         src: "UUID=c8320979-d3eb-4b40-93e0-ee452a4b9780"
+
+---
+k3s_role: server
+k3s_server_url: "https://pi.prole.org:6443"
+k3s_token: "{{ vault_k3s_token }}"   # store this in vault
+k3s_tls_sans:
+  - pi.prole.org
+  - 10.0.0.5  # pi IP if you want
+
+k3s_write_kubeconfig_mode: "0640"
+k3s_kubeconfig_group: kubeadm
+k3s_kubeconfig_users: [chrisfu]
diff --git a/infrastructure/inventory/host_vars/pi.prole.org.yml b/infrastructure/inventory/host_vars/pi.prole.org.yml
index 7537551..ef1db10 100644
--- a/infrastructure/inventory/host_vars/pi.prole.org.yml
+++ b/infrastructure/inventory/host_vars/pi.prole.org.yml
@@ -20,3 +20,7 @@ iscsi_targets:
         fstype: ext4
         opts: "_netdev,noatime"
         src: "UUID=56b21ec3-2826-4171-b909-a6715223f9a4"
+
+---
+k3s_role: server
+k3s_cluster_init: true