Provisioning is highlighted; its page is below.

Provisioning

Each board starts from a fresh Raspberry Pi OS Lite image. One Ansible playbook does the rest, so rebuilding a node is a flash and a single command.

What the playbook does#

base: updates, unattended security upgrades, hardened SSH, time from the firewall, Wi-Fi and Bluetooth switched off in firmware.
A one-off playbook moves the admin user off uid 1000, before anything else runs. Many container images use 1000, OpenSearch among them; sharing it would let the login user change the SIEM's data without sudo.
k8s_prereqs: swap removed, memory cgroups enabled, kernel modules and sysctls for container networking.
k8s_packages: containerd with systemd cgroups, and pinned Kubernetes packages that will not upgrade by accident.
nvme_storage: mounts the NVMe on its node by UUID, and prepares the SIEM's data directory.
unifi_host: Podman on the sixth board, for the UniFi controller.

In the configuration#

ansible/site.yml

- hosts: all
  become: true
  roles: [base]
- hosts: k8s
  become: true
  roles: [k8s_prereqs, k8s_packages]
- hosts: nvme_storage
  become: true
  roles: [nvme_storage]
- hosts: unifi_host
  become: true
  roles: [unifi_host]