add git ignore

.gitignore

@@ -0,0 +1,23 @@
+# Terraform
+terraform/.terraform/
+terraform/.terraform.lock.hcl
+terraform/terraform.tfstate
+terraform/terraform.tfstate.backup
+terraform/*.tfstate
+terraform/*.tfstate.*
+terraform/*.tfvars.local
+terraform/.env
+terraform/k8s_terraform
+terraform/k8s_terraform.pub
+terraform/crash.log
+terraform/crash.*.log
+
+# Ansible
+ansible/*.retry
+ansible/.vault_pass
+ansible/*.log
+
+# OS/editor
+.DS_Store
+*.swp
+CLAUDE.md

ansible/playbooks/01-common.yml

@@ -3,7 +3,52 @@
   hosts: k8s
   become: true
 
+  vars:
+    timezone: Asia/Ho_Chi_Minh   # GMT+7
+
   tasks:
+    # ── Timezone + NTP ────────────────────────────────────────────────
+    - name: Set timezone
+      community.general.timezone:
+        name: "{{ timezone }}"
+
+    - name: Ensure chrony is installed
+      dnf:
+        name: chrony
+        state: present
+
+    - name: Enable and start chronyd
+      systemd:
+        name: chronyd
+        enabled: true
+        state: started
+
+    # ── SELinux ───────────────────────────────────────────────────────
+    - name: Set SELinux to permissive (runtime)
+      command: setenforce 0
+      ignore_errors: true   # already permissive/disabled is fine
+
+    - name: Set SELinux to permissive (persistent)
+      replace:
+        path: /etc/selinux/config
+        regexp: '^SELINUX=enforcing'
+        replace: 'SELINUX=permissive'
+
+    # ── Firewalld ─────────────────────────────────────────────────────
+    - name: Check if firewalld is installed
+      command: systemctl list-unit-files firewalld.service
+      register: firewalld_check
+      changed_when: false
+      failed_when: false
+
+    - name: Disable and stop firewalld
+      systemd:
+        name: firewalld
+        enabled: false
+        state: stopped
+      when: "'firewalld.service' in firewalld_check.stdout"
+
+    # ── Swap ──────────────────────────────────────────────────────────
     - name: Disable swap now
       command: swapoff -a
       when: ansible_facts['swaptotal_mb'] > 0
@@ -14,6 +59,7 @@
         regexp: '^([^#].*\s+swap\s+.*)$'
         replace: '# \1'
 
+    # ── Kernel modules ────────────────────────────────────────────────
     - name: Load kernel modules at boot
       copy:
         dest: /etc/modules-load.d/k8s.conf
@@ -28,6 +74,7 @@
         - overlay
         - br_netfilter
 
+    # ── sysctl ────────────────────────────────────────────────────────
     - name: Set sysctl for k8s networking
       copy:
         dest: /etc/sysctl.d/k8s.conf
@@ -38,3 +85,9 @@
 
     - name: Apply sysctl
       command: sysctl --system
+
+    # ── NFS client ────────────────────────────────────────────────────
+    - name: Install nfs-utils (required for NFS PVC mounts)
+      dnf:
+        name: nfs-utils
+        state: present