ced4568/rootnode-academy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ansible): idempotent role-based host config for both production VMs

Browse Source 
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles,
orchestrated by site.yml with the ordering that matters (firewall/TLS land
before the services that depend on them). Ansible Vault for secrets, no new
tool introduced for this project's modest secret surface. Explicit
dev/staging/production environment separation, no secrets committed
(.gitignore covers vault plaintext, TLS keys, Terraform state, *.env).

Validated: ansible-playbook --syntax-check clean.
This commit is contained in:
ced4568
2026-08-18 17:13:01 -05:00
parent cbf81b09e7
commit 507ac4c5d3
50 changed files with 1174 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/environments/production/postgres.env.template
+14
View File
@@ -0,0 +1,14 @@
# Production environment template for rn-platform-01's `postgres` service.
# Postgres itself binds only to localhost/the platform-internal Docker network — never exposed
# beyond rn-platform-01, see docs/PRODUCTION_NETWORK_SECURITY.md §6.
POSTGRES_USER=rootnode_platform
POSTGRES_PASSWORD=__REPLACE_WITH_STRONG_PASSWORD__
POSTGRES_DB=rootnode_platform
# Tuning baseline — conservative, meant to be revisited once rn-platform-01's real allocated
# RAM is known (see docs/production-postgres section in docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md
# §11). Applied via infra/docker/postgres/postgresql.conf.d/ — do not hand-edit the container.
# POSTGRES_SHARED_BUFFERS=1GB
# POSTGRES_EFFECTIVE_CACHE_SIZE=3GB
# POSTGRES_MAX_CONNECTIONS=100