# Production Provisioner config overlay

Deployed by the `platform` Ansible role to `/etc/rootnode/provisioner-config/` on
rn-platform-01 (`PROVISIONER_CONFIG_DIR`), replacing the dev-only files shipped in
`platform/provisioner/config/`.

- `lab-hosts.yaml` — points at the real rn-lab-host-01 VM over TLS instead of the dev Unix
  socket. TLS paths reference material generated by `infra/scripts/docker-tls/` and deployed by
  the `docker-tls` Ansible role — **never checked into this repo** (see
  `infra/docker/tls/.gitignore`).
- `resource-policy.yaml` — deliberately still the Phase 1 dev defaults, unchanged, with a
  loud comment explaining why. Per the explicit Phase 4 instruction: do not hard-code final
  per-Lab CPU/RAM numbers before the real host is benchmarked (`docs/CAPACITY_PLANNING.md`).
  Whoever runs the first production load test (`infra/scripts/loadtest/`) updates this file
  with real measured numbers, not this deployment.