ced4568/rootnode-academy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ansible): idempotent role-based host config for both production VMs

Browse Source 
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles,
orchestrated by site.yml with the ordering that matters (firewall/TLS land
before the services that depend on them). Ansible Vault for secrets, no new
tool introduced for this project's modest secret surface. Explicit
dev/staging/production environment separation, no secrets committed
(.gitignore covers vault plaintext, TLS keys, Terraform state, *.env).

Validated: ansible-playbook --syntax-check clean.
This commit is contained in:
ced4568
2026-08-18 17:13:01 -05:00
parent cbf81b09e7
commit 507ac4c5d3
50 changed files with 1174 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/environments/README.md
+21
View File
@@ -0,0 +1,21 @@
# Environment configuration
Three environments, explicitly separated so production never silently inherits a dev default:
| | dev | staging | production |
|---|---|---|---|
| Where it runs | any dev machine, `platform/docker-compose.dev.yml` | homelab or a resource-limited slice of the dedicated server once it exists | rn-platform-01 / rn-lab-host-01 on Proxmox |
| `COOKIE_SECURE` | unset (plain HTTP) | `1` if served over HTTPS, else unset | `1` — required |
| `TRUST_PROXY` | unset | `1` if fronted by a proxy | `1` — required, real reverse proxy in front |
| `ADMIN`/owner bootstrap | `platform/api/bootstrap-owner.js` manually | same, against staging DB | same, against production DB, run once by a human, credential handled per `docs/PRODUCTION_DEPLOYMENT.md` §10 |
| Secrets | `platform/.env` (gitignored, throwaway) | `infra/environments/staging/*.env` (gitignored, real but low-stakes) | `infra/environments/production/*.env` (gitignored, real, backed up per `docs/BACKUP_DR.md`) |
| Lab image | built locally, `:test` tag | tagged build from CI, `:staging-<sha>` | tagged release, `:<sha>` or `:vX.Y.Z`, never `:latest` |
Each environment directory holds `*.env.template` files (tracked) — copy to `*.env` (gitignored
via `infra/.gitignore`) and fill in real values. **Never commit a filled `.env` file.** See
`docs/PRODUCTION_DEPLOYMENT.md` §10 for how production secrets are actually generated, stored,
and rotated (not just "don't commit them").
`dev/` is intentionally thin — it just points back at the existing
`platform/docker-compose.dev.yml` workflow (Phase 1–3B, unchanged); there was nothing new to
build there for Phase 4.