ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
16 lines
956 B
Markdown
16 lines
956 B
Markdown
# Production Provisioner config overlay
|
|
|
|
Deployed by the `platform` Ansible role to `/etc/rootnode/provisioner-config/` on
|
|
rn-platform-01 (`PROVISIONER_CONFIG_DIR`), replacing the dev-only files shipped in
|
|
`platform/provisioner/config/`.
|
|
|
|
- `lab-hosts.yaml` — points at the real rn-lab-host-01 VM over TLS instead of the dev Unix
|
|
socket. TLS paths reference material generated by `infra/scripts/docker-tls/` and deployed by
|
|
the `docker-tls` Ansible role — **never checked into this repo** (see
|
|
`infra/docker/tls/.gitignore`).
|
|
- `resource-policy.yaml` — deliberately still the Phase 1 dev defaults, unchanged, with a
|
|
loud comment explaining why. Per the explicit Phase 4 instruction: do not hard-code final
|
|
per-Lab CPU/RAM numbers before the real host is benchmarked (`docs/CAPACITY_PLANNING.md`).
|
|
Whoever runs the first production load test (`infra/scripts/loadtest/`) updates this file
|
|
with real measured numbers, not this deployment.
|