exportin inventory vars

bootstrap/cluster/main.tf

@@ -32,6 +32,32 @@ resource "null_resource" "kubeadm_control_plane" {
     command     = <<EOT
 set -euo pipefail
 
+apt_get() {
+  sudo apt-get \
+    -o Acquire::Retries=4 \
+    -o Acquire::http::Timeout=20 \
+    -o Acquire::https::Timeout=20 \
+    "$@"
+}
+
+configure_debian_apt_https() {
+  for source_file in /etc/apt/sources.list /etc/apt/sources.list.d/debian.sources; do
+    if sudo test -f "$source_file"; then
+      sudo sed -i \
+        -e 's|http://deb.debian.org/debian|https://deb.debian.org/debian|g' \
+        -e 's|http://security.debian.org/debian-security|https://security.debian.org/debian-security|g' \
+        "$source_file"
+    fi
+  done
+}
+
+diagnose_apt_network() {
+  echo "APT package install failed; checking Debian mirror reachability..." >&2
+  ip route >&2 || true
+  getent hosts deb.debian.org >&2 || true
+  curl -I --connect-timeout 5 --max-time 10 https://deb.debian.org/debian/ >&2 || true
+}
+
 install_missing_packages() {
   missing_packages=""
   for package in "$@"; do
@@ -40,8 +66,12 @@ install_missing_packages() {
     fi
   done
   if [ -n "$missing_packages" ]; then
-    sudo apt-get update
-    sudo apt-get install -y --no-install-recommends $missing_packages
+    configure_debian_apt_https
+    apt_get update
+    apt_get install -y --no-install-recommends $missing_packages || {
+      diagnose_apt_network
+      exit 1
+    }
   fi
 }
 
@@ -66,8 +96,8 @@ DOCKER_SOURCES
     sudo apt-get remove -y containerd runc || true
   fi
 
-  sudo apt-get update
-  sudo apt-get install -y --no-install-recommends containerd.io
+  apt_get update
+  apt_get install -y --no-install-recommends containerd.io
   sudo apt-mark hold containerd.io
 }
 
@@ -445,6 +475,32 @@ resource "null_resource" "kubeadm_worker" {
       <<EOT
 set -eu
 
+apt_get() {
+  sudo apt-get \
+    -o Acquire::Retries=4 \
+    -o Acquire::http::Timeout=20 \
+    -o Acquire::https::Timeout=20 \
+    "$@"
+}
+
+configure_debian_apt_https() {
+  for source_file in /etc/apt/sources.list /etc/apt/sources.list.d/debian.sources; do
+    if sudo test -f "$source_file"; then
+      sudo sed -i \
+        -e 's|http://deb.debian.org/debian|https://deb.debian.org/debian|g' \
+        -e 's|http://security.debian.org/debian-security|https://security.debian.org/debian-security|g' \
+        "$source_file"
+    fi
+  done
+}
+
+diagnose_apt_network() {
+  echo "APT package install failed; checking Debian mirror reachability..." >&2
+  ip route >&2 || true
+  getent hosts deb.debian.org >&2 || true
+  curl -I --connect-timeout 5 --max-time 10 https://deb.debian.org/debian/ >&2 || true
+}
+
 install_missing_packages() {
   missing_packages=""
   for package in "$@"; do
@@ -453,8 +509,12 @@ install_missing_packages() {
     fi
   done
   if [ -n "$missing_packages" ]; then
-    sudo apt-get update
-    sudo apt-get install -y --no-install-recommends $missing_packages
+    configure_debian_apt_https
+    apt_get update
+    apt_get install -y --no-install-recommends $missing_packages || {
+      diagnose_apt_network
+      exit 1
+    }
   fi
 }
 
@@ -479,8 +539,8 @@ DOCKER_SOURCES
     sudo apt-get remove -y containerd runc || true
   fi
 
-  sudo apt-get update
-  sudo apt-get install -y --no-install-recommends containerd.io
+  apt_get update
+  apt_get install -y --no-install-recommends containerd.io
   sudo apt-mark hold containerd.io
 }
 
@@ -500,8 +560,8 @@ install_tailscale() {
     sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
   curl -fsSL "https://pkgs.tailscale.com/stable/debian/$${codename}.tailscale-keyring.list" |
     sudo tee /etc/apt/sources.list.d/tailscale.list >/dev/null
-  sudo apt-get update
-  sudo apt-get install -y --no-install-recommends tailscale
+  apt_get update
+  apt_get install -y --no-install-recommends tailscale
   sudo systemctl enable --now tailscaled
 }
 

bootstrap/platform/main.tf

@@ -1025,16 +1025,30 @@ if [ -z "$${repo_host}" ] || [ -z "$${repo_port}" ]; then
 fi
 
 known_hosts_file="$(mktemp)"
+known_hosts_scan="$(mktemp)"
 known_hosts_sorted="$(mktemp)"
-trap 'rm -f "$${known_hosts_file}" "$${known_hosts_sorted}"' EXIT
+trap 'rm -f "$${known_hosts_file}" "$${known_hosts_scan}" "$${known_hosts_sorted}"' EXIT
 
 kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "${self.triggers.namespace}" get configmap argocd-ssh-known-hosts-cm \
   -o jsonpath='{.data.ssh_known_hosts}' > "$${known_hosts_file}" 2>/dev/null || true
 if [ "$${repo_port}" = "22" ]; then
-  ssh-keyscan -H "$${repo_host}" >> "$${known_hosts_file}" 2>/dev/null
+  keyscan_cmd=(ssh-keyscan -T 10 -H "$${repo_host}")
 else
-  ssh-keyscan -H -p "$${repo_port}" "$${repo_host}" >> "$${known_hosts_file}" 2>/dev/null
+  keyscan_cmd=(ssh-keyscan -T 10 -H -p "$${repo_port}" "$${repo_host}")
 fi
+if ! "$${keyscan_cmd[@]}" > "$${known_hosts_scan}" 2>&1; then
+  echo "Could not scan GitOps SSH host key for $${repo_host}:$${repo_port}." >&2
+  cat "$${known_hosts_scan}" >&2
+  echo "Check Gitea SSH with: ssh-keyscan -T 10 -p $${repo_port} $${repo_host}" >&2
+  echo "Then verify auth with: ssh -T -p $${repo_port} git@$${repo_host}" >&2
+  exit 1
+fi
+if ! grep -Eq '^[^#[:space:]]+[[:space:]]+(ssh-|ecdsa-)' "$${known_hosts_scan}"; then
+  echo "ssh-keyscan returned no usable GitOps SSH host keys for $${repo_host}:$${repo_port}." >&2
+  cat "$${known_hosts_scan}" >&2
+  exit 1
+fi
+cat "$${known_hosts_scan}" >> "$${known_hosts_file}"
 sort -u "$${known_hosts_file}" > "$${known_hosts_sorted}"
 kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "${self.triggers.namespace}" create configmap argocd-ssh-known-hosts-cm \
   --from-file=ssh_known_hosts="$${known_hosts_sorted}" \

jeannie

@@ -2051,8 +2051,18 @@ preflight_warn() {
 
 check_gitea_reachable() {
     local gitea_url="${LAB_GITEA_LOCAL_URL:-http://${LAB_GITEA_HOST:-192.168.100.73}:${LAB_GITEA_HTTP_PORT:-3000}/}"
+    local output
 
-    curl -fsS --max-time 10 "${gitea_url}" >/dev/null
+    if output="$(curl -fsS --max-time 10 "${gitea_url}" 2>&1 >/dev/null)"; then
+        return 0
+    fi
+
+    printf '%s\n' "${output}" >&2
+    cat >&2 <<'EOF'
+Gitea local HTTP failed. Run ./jeannie doctor-gitea --verbose.
+If the local Gitea container is down or unhealthy, run ./jeannie deploy-gitea.
+EOF
+    return 1
 }
 
 check_debian_docker_root() {
@@ -4903,6 +4913,24 @@ apps() {
     echo "Application deployment successfully completed."
 }
 
+edge_apply() {
+    require_debian_server "edge"
+
+    if [[ -z "${TF_VAR_haproxy_stats_password:-}" ]] ||
+        ((${#TF_VAR_haproxy_stats_password} < 12)) ||
+        [[ "${TF_VAR_haproxy_stats_password}" == "adminpassword" ]]; then
+        cat >&2 <<'EOF'
+TF_VAR_haproxy_stats_password must be set to a non-default value with at least 12 characters before applying the edge stack.
+Example:
+  export TF_VAR_haproxy_stats_password='<existing-edge-stats-password>'
+  ./jeannie edge
+EOF
+        exit 1
+    fi
+
+    run_tofu_stack "bootstrap/edge"
+}
+
 ensure_cluster_worker_var_file() {
     if [[ -z "${LAB_CLUSTER_VAR_FILE:-}" ]]; then
         prepare_cluster_worker_var_file false
@@ -6683,6 +6711,8 @@ EOF
 
 nuke() {
     local target
+    local target_host
+    local worker_known_hosts_file="${REPO_ROOT}/.lab/rebuild-worker-known_hosts"
     declare -a CLUSTER_WORKER_TARGETS=()
 
     require_debian_server "nuke"
@@ -6698,6 +6728,12 @@ EOF
     echo "Brutally nuking the homelab infrastructure..."
     cluster_worker_targets
 
+    if ((${#CLUSTER_WORKER_TARGETS[@]} > 0)); then
+        mkdir -p "$(dirname "${worker_known_hosts_file}")"
+        touch "${worker_known_hosts_file}"
+        chmod 0600 "${worker_known_hosts_file}"
+    fi
+
     echo "--> Terminating local OpenTofu tasks..."
     killall tofu terraform 2>/dev/null || true
 
@@ -6707,7 +6743,10 @@ EOF
 
     for target in "${CLUSTER_WORKER_TARGETS[@]}"; do
         echo "--> Eviscerating remote Kubernetes components (${target})..."
-        if ! ssh -o ConnectTimeout=5 "${target}" "bash -s" <<'EOF'
+        target_host="${target#*@}"
+        target_host="${target_host%%:*}"
+        ssh-keygen -R "${target_host}" -f "${worker_known_hosts_file}" >/dev/null 2>&1 || true
+        if ! ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile="${worker_known_hosts_file}" "${target}" "bash -s" <<'EOF'
 set -euo pipefail
 
 cleanup_calico_links() {
@@ -7413,6 +7452,7 @@ Operator View And Reports
 Observability And GitOps
   grafana-dashboards {list|apply}            List or apply repo-managed Grafana dashboards.
   gitops-status                              Print focused Argo CD health and sync status.
+  edge                                       Deploy/check the OCI edge stack only.
   promote {plan|validate|rollback APP}       Run canary promotion gates and rollback plan.
   cert-check                                 Check public DNS, TLS, and edge URL health.
   backup-status                              Check backup and restore-drill freshness.
@@ -7534,6 +7574,10 @@ case "${1:-}" in
     gitops-status)
         gitops_status
         ;;
+    edge)
+        record_change_journal "edge" "$@"
+        edge_apply
+        ;;
     promote)
         promote "$@"
         ;;