ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
53 lines
1.3 KiB
YAML
53 lines
1.3 KiB
YAML
---
|
|
# Top-level playbook — full production/staging deployment. Idempotent: re-running against an
|
|
# already-deployed host converges it, doesn't rebuild from scratch (Phase 4 §20 requirement).
|
|
#
|
|
# Usage:
|
|
# ansible-playbook site.yml -i inventory/production.ini --vault-password-file .vault_pass
|
|
# ansible-playbook site.yml -i inventory/staging.ini -e env=staging
|
|
#
|
|
# Role order matters: firewall and docker-tls must land before platform/lab-host bring up
|
|
# services that depend on the network policy / TLS material already being in place.
|
|
|
|
- name: Base hardening — all RootNode hosts
|
|
hosts: rootnode
|
|
become: true
|
|
roles:
|
|
- common
|
|
|
|
- name: Firewall policy — all RootNode hosts
|
|
hosts: rootnode
|
|
become: true
|
|
roles:
|
|
- firewall
|
|
|
|
- name: Docker TLS — both hosts (server cert on lab_host, client cert on platform)
|
|
hosts: rootnode
|
|
become: true
|
|
roles:
|
|
- docker-tls
|
|
|
|
- name: Deploy the Platform VM
|
|
hosts: platform
|
|
become: true
|
|
roles:
|
|
- platform
|
|
|
|
- name: Deploy the Lab Host VM
|
|
hosts: lab_host
|
|
become: true
|
|
roles:
|
|
- lab-host
|
|
|
|
- name: Deploy monitoring configuration — both hosts
|
|
hosts: rootnode
|
|
become: true
|
|
roles:
|
|
- monitoring-agent
|
|
|
|
- name: Deploy backup automation — Platform VM only (that's where Postgres lives)
|
|
hosts: platform
|
|
become: true
|
|
roles:
|
|
- backup
|