ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
21 lines
1.2 KiB
Bash
21 lines
1.2 KiB
Bash
# Production environment template for rn-platform-01's `provisioner` service.
|
|
# See platform.env.template for the secrets-handling convention.
|
|
#
|
|
# Docker-connectivity config (lab_hosts) and resource limits are NOT env vars — they're YAML
|
|
# files the Provisioner already loads from PROVISIONER_CONFIG_DIR (Phase 1 design, unchanged).
|
|
# Production overlays for both live at infra/environments/production/provisioner-config/ — see
|
|
# that directory's README before touching resource-policy.yaml numbers.
|
|
|
|
PLATFORM_DB_URL=postgres://rootnode_platform:__REPLACE_WITH_STRONG_PASSWORD__@localhost:5432/rootnode_platform
|
|
PROVISIONER_SHARED_SECRET=__REPLACE_same_value_as_platform.env__
|
|
PROVISIONER_PORT=4100
|
|
PROVISIONER_CONFIG_DIR=/etc/rootnode/provisioner-config
|
|
|
|
# Real Lab image, tagged (never :latest in production — see infra/docker/IMAGE_STRATEGY.md)
|
|
LAB_IMAGE_REF=registry.example.com/rootnode/lab:__GIT_SHA_OR_TAG__
|
|
|
|
# ── Egress proxy on rn-lab-host-01 ─────────────────────────────────────────────────────────
|
|
EGRESS_PROXY_PORT=3128
|
|
DNS_RESOLVER=127.0.0.11
|
|
NO_PROXY_CIDRS=10.42.0.0/16,10.43.0.0/16
|