[TakGN]

Codifies building indexer boxes on Debian 13 with k3s, starting with indexers-chic1 (Cherry Servers, Chicago, 84.32.71.3). Over the next three months it is the test bed for a new indexer setup, which sf and sf2 are meant to adopt later.

Do not merge yet. The box hasn't been built. CI's site.yml runs refuse a box that isn't hardened yet, and need its host key pinned in inventory/known_hosts, so merging now would break them. Merge after ansible-playbook site.yml -l indexers-chic1 has run and the key is pinned.

What's in it

• Inventory: a new indexers group, and a managed_boxes parent for it and ipfs_nodes. Shared settings moved to group_vars/managed_boxes/. The IPFS boxes' resolved variables are unchanged, checked with ansible-inventory --host.
• site.yml and k3s-upgrade.yml: now cover indexers. Root login by key is tried before the password fallback. Boxes with undecided placeholders are refused.
• common role: Debian packages, unattended-upgrades also covering point releases on indexers, and reporting when a reboot is needed (needrestart reports only, plus a node-exporter metric).
• hardening role: removes cloud-image accounts, and checks the effective sshd config with sshd -T. That check also runs on the IPFS boxes.
• k3s-upgrade.yml: compares container IDs before and after each upgrade step, and fails if any container outside kube-system restarted.
• storage role: two new modes, zfs and md_xfs.
  • md_xfs creates a partition in the free space on each disk, an md array over them, and XFS at /ipni. It never recreates anything or uses force flags, refuses non-blank members, and won't create an array from CI.
  • k3s waits until the data volume is mounted.
• indexers-chic1's layout:
  • The OS on a 300 GB md RAID1 with ext4, installed by Cherry.
  • Data on md RAID5 over the rest of each disk, with XFS (about 27 TiB).
  • The drives were switched to 4096-byte sectors before the install.
• Docs: README ("Indexer boxes", package updates and reboots, the build steps) and AGENTS.md.

Tested

• yamllint and ansible-lint pass (production profile).
• --syntax-check passes on site.yml and k3s-upgrade.yml.
• Templates were rendered locally.
• The partition-planning logic was tested on made-up disk tables.

Not tested

• Anything on a real box: Debian, the partitioning, array and XFS creation, booting with the array, root key login, the first-build package upgrade, the container-ID check during a real k3s upgrade, and sshd -T on the IPFS boxes.
• mkfs.xfs may warn about the 4 KiB sector size on the Micron 7450s, which report a 256 KiB physical block.

Still to decide

• The k3s version for this box.
• Whether to extend platform.yml for Argo CD to this box.
• The indexer's host-network ports.
• Monitoring in ipni/infra.
• Managing the network bond from the repo.
• Removing exim4.
• needrestart reporting only on the IPFS boxes too.

🤖 Generated with Claude Code