Files

T

ced4568 507ac4c5d3 feat(ansible): idempotent role-based host config for both production VMs

common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles,
orchestrated by site.yml with the ordering that matters (firewall/TLS land
before the services that depend on them). Ansible Vault for secrets, no new
tool introduced for this project's modest secret surface. Explicit
dev/staging/production environment separation, no secrets committed
(.gitignore covers vault plaintext, TLS keys, Terraform state, *.env).

Validated: ansible-playbook --syntax-check clean.

2026-08-18 17:13:01 -05:00

lab-hosts.yaml

feat(ansible): idempotent role-based host config for both production VMs

2026-08-18 17:13:01 -05:00

README.md

feat(ansible): idempotent role-based host config for both production VMs

2026-08-18 17:13:01 -05:00

resource-policy.yaml

feat(ansible): idempotent role-based host config for both production VMs

2026-08-18 17:13:01 -05:00

README.md

Production Provisioner config overlay

Deployed by the platform Ansible role to /etc/rootnode/provisioner-config/ on rn-platform-01 (PROVISIONER_CONFIG_DIR), replacing the dev-only files shipped in platform/provisioner/config/.

lab-hosts.yaml — points at the real rn-lab-host-01 VM over TLS instead of the dev Unix socket. TLS paths reference material generated by infra/scripts/docker-tls/ and deployed by the docker-tls Ansible role — never checked into this repo (see infra/docker/tls/.gitignore).
resource-policy.yaml — deliberately still the Phase 1 dev defaults, unchanged, with a loud comment explaining why. Per the explicit Phase 4 instruction: do not hard-code final per-Lab CPU/RAM numbers before the real host is benchmarked (docs/CAPACITY_PLANNING.md). Whoever runs the first production load test (infra/scripts/loadtest/) updates this file with real measured numbers, not this deployment.