ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
17 lines
898 B
YAML
17 lines
898 B
YAML
# Production lab_hosts seed — points at the real rn-lab-host-01 VM instead of Phase 1's dev
|
|
# Unix socket. Same mechanism the Provisioner has had since Phase 1
|
|
# (platform/provisioner/config/lab-hosts.seed.yaml), just pointed at a real remote endpoint —
|
|
# no application code changes required for this, see docs/PRODUCTION_NETWORK_SECURITY.md §7.
|
|
#
|
|
# {{ lab_host_ip }} is an Ansible template variable — see infra/ansible/group_vars/production.yml.
|
|
# Rendered by the `platform` role; the raw file here keeps the placeholder for readability.
|
|
|
|
lab_hosts:
|
|
- lab_host_id: labhost-01
|
|
display_name: "RootNode Lab Host VM 01 (production)"
|
|
endpoint: "tcp://{{ lab_host_ip }}:2376"
|
|
tls_ca_path: /etc/rootnode/docker-tls/ca.pem
|
|
tls_cert_path: /etc/rootnode/docker-tls/provisioner-client-cert.pem
|
|
tls_key_path: /etc/rootnode/docker-tls/provisioner-client-key.pem
|
|
enabled: true
|