ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
7 lines
375 B
Bash
7 lines
375 B
Bash
PLATFORM_DB_URL=postgres://rootnode_platform:{{ vault_postgres_password }}@localhost:5432/rootnode_platform
|
|
BACKUP_DIR={{ rootnode_data_root }}/backups
|
|
BACKUP_ENCRYPTION_PASSPHRASE={{ vault_backup_encryption_passphrase }}
|
|
BACKUP_RETENTION_DAYS={{ backup_retention_days }}
|
|
BACKUP_OFFSITE_TARGET={{ backup_offsite_target }}
|
|
METRICS_TEXTFILE_DIR=/var/lib/node-exporter/textfile
|