ced4568
eae8e48d43
Adds platform/lab-router/ — a narrow service that runs on the Lab Host, authenticates the Gateway via mTLS, and resolves an opaque routing token to a local container purely from Docker label state (no Postgres access, no callback to the Provisioner). Replaces the Gateway's env.internal_ip assumption (only valid when Gateway and Lab share a Docker daemon) with a data-driven direct/router decision per lab_host (lab_hosts.routing_mode/router_endpoint, migration 004), resolved in one place (platform/gateway/src/lab-endpoint.js's labTarget()) that every proxy/fetch call site in server.js now goes through. Extends the existing Docker TLS CA (infra/scripts/docker-tls/generate-docker-tls.sh) with a second mTLS leaf pair (router-server/gateway-client) for this new data-plane connection, deployed by the docker-tls Ansible role into a separate directory from the control-plane pair. Firewall (rn-lab-host-01.rules) replaces the old speculative wide port-range allowance with one narrow rule: platform_ip -> the Router's port only. dev-local stays routing_mode: direct — zero behavior change for local dev, confirmed by the full existing regression suite passing unmodified.
34 lines
2.2 KiB
YAML
34 lines
2.2 KiB
YAML
# Production variables — referenced by every {{ }} placeholder in infra/docker/, infra/firewall/,
|
|
# and the roles below. Fill in the __PLACEHOLDER__ values once the real server exists
|
|
# (docs/PRODUCTION_DEPLOYMENT.md §1). Nothing here is a secret — real secrets live in
|
|
# infra/environments/production/*.env (gitignored) and Ansible Vault (see
|
|
# infra/ansible/group_vars/production.vault.yml.template), never in this plain-vars file.
|
|
|
|
env: production
|
|
academy_domain: __REPLACE_e.g._academy.rootnode.example__
|
|
|
|
# ── Network topology (Phase 4 §5 — placeholders until real hardware exists) ────────────────
|
|
platform_ip: __PLATFORM_VM_IP__
|
|
lab_host_ip: __LAB_HOST_VM_IP__
|
|
management_cidr: __YOUR_ADMIN_ACCESS_CIDR__ # e.g. a VPN/WireGuard subnet, never 0.0.0.0/0
|
|
proxmox_mgmt_cidr: __PROXMOX_HOST_MGMT_CIDR__
|
|
lab_subnet_range: "10.42.0.0/16" # matches NO_PROXY_CIDRS already used by the app
|
|
lab_router_port: "8443" # Gateway -> Lab Host Router (data plane) — see docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1-3
|
|
|
|
# ── Storage (Phase 4 §4 — a decision framework, not a final layout; see docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md §4)
|
|
rootnode_data_root: /srv/rootnode-data # expected to be a ZFS dataset mountpoint on the real host
|
|
|
|
# ── Registry / images (infra/docker/IMAGE_STRATEGY.md) ─────────────────────────────────────
|
|
registry: git.synthossystems.com
|
|
image_tag: __GIT_SHA_OR_RELEASE_TAG__
|
|
|
|
postgres_exporter_user: rootnode_exporter
|
|
|
|
# ── Observability (infra/monitoring/) ───────────────────────────────────────────────────────
|
|
prometheus_retention_days: 30
|
|
alertmanager_webhook_url: __REPLACE_e.g._uptime_kuma_or_ntfy_webhook__
|
|
|
|
# ── Backup (infra/backup/) ───────────────────────────────────────────────────────────────────
|
|
backup_retention_days: 30
|
|
backup_offsite_target: __REPLACE_e.g._Hetzner_Storage_Box_path_or_S3_bucket__
|