ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
26 lines
1.2 KiB
YAML
26 lines
1.2 KiB
YAML
# PRODUCTION OVERLAY — placeholder, deliberately unchanged from the Phase 1 dev defaults.
|
|
# Do not hand-tune these before the real host exists (docs/CAPACITY_PLANNING.md, Phase 4 §25).
|
|
# After the first real load test on rn-lab-host-01 (infra/scripts/loadtest/), replace this
|
|
# comment block and the numbers below with actual measured values, then redeploy via the
|
|
# `platform` Ansible role (idempotent — re-running just re-renders this file).
|
|
#
|
|
# Phase 1 resource policy — config-driven, not hard-coded (decision #4).
|
|
# Target host class for planning is ~16 cores/32 threads, 128GB RAM, SSD/NVMe.
|
|
|
|
default:
|
|
cpu_limit: 2.0 # vCPUs
|
|
mem_limit_mb: 4096
|
|
pids_limit: 512
|
|
storage_limit_mb: 8192 # only enforced if the host's Docker storage driver supports
|
|
# --storage-opt size= (see known-limitations in the SOP)
|
|
|
|
idle_threshold_minutes: 30 # past this: log a warning event only
|
|
abandoned_threshold_minutes: 120 # past this: reaper destroys for real
|
|
|
|
reaper_poll_interval_seconds: 60
|
|
|
|
health_check:
|
|
path: /api/health
|
|
timeout_ms: 240000 # k3s cold start in a nested container can be slow — matches the
|
|
# ~60-attempt wait already in scripts/entrypoint.sh
|