ced4568
5bc0743b08
Master overview (PHASE4_1_PREPRODUCTION_HARDENING.md) covering all 27 substantive items, plus REMOTE_AND_SELF_PACED_ARCHITECTURE.md (reviews what already works for remote/self-paced delivery - student-driven provisioning, cohort-less students, idle-reaper-destroy-then-continue - and the one real gap: student authentication, explicitly Phase 5 scope, not built here). Updated PRODUCTION_NETWORK_SECURITY.md (the Gateway-to-Lab gap is now RESOLVED, with the full design writeup and a new control-plane-vs-data-plane section), PRODUCTION_DEPLOYMENT.md (four-cert TLS bundle), PRODUCTION_VALIDATION_CHECKLIST.md (Router mTLS check, admission control checks), PHASE4_PRODUCTION_INFRASTRUCTURE.md and ENGINEERING_SOP.md and LAB_ARCHITECTURE.md (stale 'known gap' pointers updated to point at the resolution), BACKUP_DR.md (destructive drill), README.md and platform/README.md (Phase 4.1 pointers, lab-router component, updated known-limitations). Also fixes a real pre-existing bug found while auditing what gets committed: infra/.gitignore's patterns were written repo-root-relative (e.g. "infra/terraform/...") but the file lives in infra/, so git resolved them relative to THAT directory and none of them ever matched anything - a real .terraform/ provider cache showed up as untracked when it should have been ignored. Fixed by dropping the redundant leading "infra/" from every pattern. Status: PHASE 4.1 COMPLETE / PRE-PRODUCTION HARDENING COMPLETE / READY FOR HARDWARE DEPLOYMENT.
35 lines
1.2 KiB
Plaintext
35 lines
1.2 KiB
Plaintext
# Never commit filled secrets — only *.env.template files are tracked.
|
|
*.env
|
|
!*.env.template
|
|
|
|
# Docker TLS material — CA/server/client certs and keys, generated by
|
|
# infra/scripts/docker-tls/generate-ca.sh and friends. Templates/READMEs stay tracked.
|
|
docker/tls/*.pem
|
|
docker/tls/*.key
|
|
docker/tls/*.crt
|
|
docker/tls/*.srl
|
|
!docker/tls/**/README.md
|
|
|
|
# Ansible Vault password files and any decrypted vars
|
|
ansible/.vault_pass
|
|
ansible/**/vault_plain.yml
|
|
|
|
# Terraform/OpenTofu state and generated vars (may contain resource IDs/IPs)
|
|
# Phase 4.1: these patterns were previously written repo-root-relative (e.g.
|
|
# "infra/terraform/...") inside THIS file, which git resolves relative to the .gitignore's own
|
|
# directory (infra/) — so they silently matched nothing at all. Found via `git status` showing
|
|
# a real .terraform/ provider cache as untracked when it should have been ignored. Fixed by
|
|
# dropping the redundant leading "infra/" from every pattern below.
|
|
terraform/**/*.tfstate
|
|
terraform/**/*.tfstate.*
|
|
terraform/**/.terraform/
|
|
terraform/**/terraform.tfvars
|
|
!terraform/**/terraform.tfvars.example
|
|
|
|
# Backup output and restore scratch space
|
|
backup/output/
|
|
backup/restore-test/
|
|
|
|
# Load test results (local artifacts, not source)
|
|
scripts/loadtest/results/
|