ced4568
d2280d0f0d
Named-bridge-network production Compose (not host networking, unlike dev) for rn-platform-01; egress-proxy + agents for rn-lab-host-01. Caddy reverse proxy, single public origin, Grafana restricted to management_cidr. iptables-restore firewall rulesets for all three hosts (Proxmox host, rn-platform-01, rn-lab-host-01) codifying the Platform/Lab-Host boundary: no student-to-student traffic, no direct Proxmox exposure, no direct Postgres/Provisioner exposure from the Lab Host. Mutual TLS for the Provisioner<->Lab Host Docker connection: certificate generation/verification scripts, dockerd TLS config, firewall-restricted port 2376. Application support already existed since Phase 1; this is purely the operational half. Validated: docker compose config, caddy validate, firewall structural lint, and a real openssl s_server/s_client mTLS handshake proving the cert chain and mutual-auth rejection (legitimate client verified, rogue client correctly rejected with verify code 19).
Docker TLS material (generated, not committed)
Generate with infra/scripts/docker-tls/generate-docker-tls.sh. Deploy with the docker-tls
Ansible role. Verify with infra/scripts/docker-tls/verify-docker-tls.sh.
Nothing in this directory is ever committed — see infra/.gitignore. This README (and only
this README) is tracked, so the directory itself exists in the repo as documentation of what
belongs here operationally.
Files that will exist here on a real deployment host (never in git):
ca.pem # public — safe to distribute to both VMs
ca-key.pem # PRIVATE — offline/secrets-vault only, never on either VM
server-cert.pem / server-key.pem # rn-lab-host-01's dockerd
provisioner-client-cert.pem / provisioner-client-key.pem # rn-platform-01's Provisioner
Rotation procedure: docs/RUNBOOK_DOCKER_TLS_ROTATION.md.