ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
14 lines
377 B
Django/Jinja
14 lines
377 B
Django/Jinja
{
|
|
"tls": true,
|
|
"tlsverify": true,
|
|
"tlscacert": "/etc/rootnode/docker-tls/ca.pem",
|
|
"tlscert": "/etc/rootnode/docker-tls/server-cert.pem",
|
|
"tlskey": "/etc/rootnode/docker-tls/server-key.pem",
|
|
"hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2376"],
|
|
|
|
"storage-driver": "overlay2",
|
|
"default-address-pools": [
|
|
{ "base": "10.42.0.0/16", "size": 24 }
|
|
]
|
|
}
|