ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
17 lines
445 B
INI
17 lines
445 B
INI
# Production inventory. IPs/hostnames are placeholders — fill in once the real VMs exist
|
|
# (docs/PRODUCTION_DEPLOYMENT.md §1). This file is safe to commit (no secrets, just topology).
|
|
|
|
[platform]
|
|
rn-platform-01 ansible_host=__PLATFORM_VM_IP__
|
|
|
|
[lab_host]
|
|
rn-lab-host-01 ansible_host=__LAB_HOST_VM_IP__
|
|
|
|
[rootnode:children]
|
|
platform
|
|
lab_host
|
|
|
|
[rootnode:vars]
|
|
ansible_user=rootnode-deploy
|
|
ansible_ssh_common_args='-o StrictHostKeyChecking=yes'
|