chore: document Flux bootstrap workflow

Author: glitchedmob

.github/workflows/ansible-manual.yml

@@ -5,8 +5,11 @@ on:
     inputs:
       playbook:
         description: Playbook filename under src/ansible/playbooks/
-        type: string
-        default: bootstrap.yml
+        required: true
+        type: choice
+        options:
+          - bootstrap.yml
+          - apply.yml
       initialize-terraform:
         description: Initialize Terraform first
         type: boolean

README.md

@@ -25,9 +25,10 @@ make tf-plan
 
 - `src/tf/connectivity.tf` includes a provider connectivity check that reads Proxmox node inventory.
 - `src/tf/k3s_nodes.tf` provisions two workload VMs pinned one-per-node by default.
-- `src/tf/ssh_key_inventory.tf` generates an SSH key, stores its private key in SSM, and publishes hosts via the Terraform Ansible provider.
+- `src/tf/ssh_key_inventory.tf` generates node SSH and Flux deploy keys, stores private keys in SSM, and publishes hosts via the Terraform Ansible provider.
 - `src/ansible/inventory.yml` uses the Terraform inventory plugin (`cloud.terraform.terraform_provider`).
 - `src/ansible/group_vars/all.yml` resolves `ssm_private_key_path` from AWS SSM at runtime.
+- `src/ansible/playbooks/apply.yml` bootstraps Flux and GitHub notifications for `sgfdevs/infra-k8s-apps`.
 - VM provisioning references Debian 13 image IDs keyed by node name in `src/tf/k3s_nodes.tf`.
 
 ## Required Terraform Variables
@@ -48,3 +49,9 @@ make tf-plan
 - `OUTPUT_ENCRYPTION_KEY`
 - `TF_VAR_proxmox_endpoint`
 - `TF_VAR_proxmox_api_token`
+
+## Flux Bootstrap Notes
+
+- Run `bootstrap.yml` first to install K3s, then run `apply.yml` to bootstrap Flux.
+- After Terraform apply, add `flux_git_public_key` output to `sgfdevs/infra-k8s-apps` as a read-only deploy key.
+- Update SSM parameter at `flux_github_status_token_ssm_path` with a valid GitHub token so Flux notifications can post status updates.