glitched.systems Infrastructure

GitOps-managed infrastructure for glitched.systems.

Everything in the cluster is declarative. Push to main, and ArgoCD will reconcile.

Layout

infrastructure/
├── ansible/         Host bootstrap: SSH hardening, firewall, fail2ban, tailscale
├── kube/            k3s workloads, managed end-to-end by Argo CD
│   ├── root.yml     App-of-apps entrypoint (syncs kube/apps)
│   ├── apps/        Argo CD Application resources (Helm + manifest sources)
│   ├── charts/      Local Helm value overrides
│   └── manifests/   Plain Kubernetes manifests grouped by service
└── README.md

• See docs/secrets.md for the secrets that must exist before anything in kube/ will reconcile.
• See docs/operations.md for day-to-day operations.

Ansible

Install collections and run playbooks against a freshly-provisioned host:

cd ansible
ansible-galaxy install -r requirements.yml

# Render the host vars from the template (never commit this)
cp ./inventory/group_vars/all/vars.yml.template ./inventory/group_vars/all/vars.yml
$EDITOR ./inventory/group_vars/all/vars.yml

# Bootstrap a new host
ansible-playbook playbooks/tailscale.yml -l hostname
ansible-playbook playbooks/hardening.yml -l hostname

ansible.cfg requires ansible/.vault_pass whenever the run touches encrypted variables. See docs/secrets.md.

Kubernetes

The cluster is fully GitOps. Push to main and the App-of-apps at kube/root.yml propagates the change. Cross-app ordering is enforced by the argocd.argoproj.io/sync-wave annotations in each kube/apps/*.yml file. (see docs/operations.md)

Workflow

1. Make changes to a manifest or app file
2. Commit and push to main
3. Argo will do the rest