feat(ansible): idempotent role-based host config for both production VMs

common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
2026-08-18 17:13:01 -05:00
parent cbf81b09e7
commit 507ac4c5d3
50 changed files with 1174 additions and 0 deletions
@@ -0,0 +1,15 @@
+# Production Provisioner config overlay
+
+Deployed by the `platform` Ansible role to `/etc/rootnode/provisioner-config/` on
+rn-platform-01 (`PROVISIONER_CONFIG_DIR`), replacing the dev-only files shipped in
+`platform/provisioner/config/`.
+
+- `lab-hosts.yaml` — points at the real rn-lab-host-01 VM over TLS instead of the dev Unix
+  socket. TLS paths reference material generated by `infra/scripts/docker-tls/` and deployed by
+  the `docker-tls` Ansible role — **never checked into this repo** (see
+  `infra/docker/tls/.gitignore`).
+- `resource-policy.yaml` — deliberately still the Phase 1 dev defaults, unchanged, with a
+  loud comment explaining why. Per the explicit Phase 4 instruction: do not hard-code final
+  per-Lab CPU/RAM numbers before the real host is benchmarked (`docs/CAPACITY_PLANNING.md`).
+  Whoever runs the first production load test (`infra/scripts/loadtest/`) updates this file
+  with real measured numbers, not this deployment.
@@ -0,0 +1,16 @@
+# Production lab_hosts seed — points at the real rn-lab-host-01 VM instead of Phase 1's dev
+# Unix socket. Same mechanism the Provisioner has had since Phase 1
+# (platform/provisioner/config/lab-hosts.seed.yaml), just pointed at a real remote endpoint —
+# no application code changes required for this, see docs/PRODUCTION_NETWORK_SECURITY.md §7.
+#
+# {{ lab_host_ip }} is an Ansible template variable — see infra/ansible/group_vars/production.yml.
+# Rendered by the `platform` role; the raw file here keeps the placeholder for readability.
+
+lab_hosts:
+  - lab_host_id: labhost-01
+    display_name: "RootNode Lab Host VM 01 (production)"
+    endpoint: "tcp://{{ lab_host_ip }}:2376"
+    tls_ca_path: /etc/rootnode/docker-tls/ca.pem
+    tls_cert_path: /etc/rootnode/docker-tls/provisioner-client-cert.pem
+    tls_key_path: /etc/rootnode/docker-tls/provisioner-client-key.pem
+    enabled: true
@@ -0,0 +1,25 @@
+# PRODUCTION OVERLAY — placeholder, deliberately unchanged from the Phase 1 dev defaults.
+# Do not hand-tune these before the real host exists (docs/CAPACITY_PLANNING.md, Phase 4 §25).
+# After the first real load test on rn-lab-host-01 (infra/scripts/loadtest/), replace this
+# comment block and the numbers below with actual measured values, then redeploy via the
+# `platform` Ansible role (idempotent — re-running just re-renders this file).
+#
+# Phase 1 resource policy — config-driven, not hard-coded (decision #4).
+# Target host class for planning is ~16 cores/32 threads, 128GB RAM, SSD/NVMe.
+
+default:
+  cpu_limit: 2.0          # vCPUs
+  mem_limit_mb: 4096
+  pids_limit: 512
+  storage_limit_mb: 8192  # only enforced if the host's Docker storage driver supports
+                           # --storage-opt size= (see known-limitations in the SOP)
+
+idle_threshold_minutes: 30       # past this: log a warning event only
+abandoned_threshold_minutes: 120 # past this: reaper destroys for real
+
+reaper_poll_interval_seconds: 60
+
+health_check:
+  path: /api/health
+  timeout_ms: 240000   # k3s cold start in a nested container can be slow — matches the
+                        # ~60-attempt wait already in scripts/entrypoint.sh