feat(ansible): idempotent role-based host config for both production VMs

common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
2026-08-18 17:13:01 -05:00
parent cbf81b09e7
commit 507ac4c5d3
50 changed files with 1174 additions and 0 deletions
@@ -0,0 +1,20 @@
+# Production environment template for rn-platform-01's `provisioner` service.
+# See platform.env.template for the secrets-handling convention.
+#
+# Docker-connectivity config (lab_hosts) and resource limits are NOT env vars — they're YAML
+# files the Provisioner already loads from PROVISIONER_CONFIG_DIR (Phase 1 design, unchanged).
+# Production overlays for both live at infra/environments/production/provisioner-config/ — see
+# that directory's README before touching resource-policy.yaml numbers.
+
+PLATFORM_DB_URL=postgres://rootnode_platform:__REPLACE_WITH_STRONG_PASSWORD__@localhost:5432/rootnode_platform
+PROVISIONER_SHARED_SECRET=__REPLACE_same_value_as_platform.env__
+PROVISIONER_PORT=4100
+PROVISIONER_CONFIG_DIR=/etc/rootnode/provisioner-config
+
+# Real Lab image, tagged (never :latest in production — see infra/docker/IMAGE_STRATEGY.md)
+LAB_IMAGE_REF=registry.example.com/rootnode/lab:__GIT_SHA_OR_TAG__
+
+# ── Egress proxy on rn-lab-host-01 ─────────────────────────────────────────────────────────
+EGRESS_PROXY_PORT=3128
+DNS_RESOLVER=127.0.0.11
+NO_PROXY_CIDRS=10.42.0.0/16,10.43.0.0/16