ced4568
bf1e1b5c76
Master overview (PHASE4_PRODUCTION_INFRASTRUCTURE.md) plus five detail docs (PRODUCTION_DEPLOYMENT, PRODUCTION_NETWORK_SECURITY, BACKUP_DR, OBSERVABILITY, CAPACITY_PLANNING), a master PRODUCTION_VALIDATION_CHECKLIST, and 12 runbooks (first deployment, normal deploy, rollback, Postgres restore, VM rebuild for both hosts, Docker TLS rotation, TLS renewal, owner recovery, stuck Lab cleanup, failed migration, backup failure, disk failure, Lab Host resource pressure). PRODUCTION_NETWORK_SECURITY.md prominently documents the one genuine architectural gap this phase surfaced: the Gateway's existing env.internal_ip mechanism for reaching a Lab container assumes Gateway and Lab share a Docker daemon, which breaks once Labs run on a genuinely separate rn-lab-host-01 VM. The network-policy half is built (a firewall allowance for Gateway->Lab-Host on a published port range); the application half (Provisioner/Gateway address handling) is an explicit, reviewed, NOT-YET-BUILT follow-up flagged there rather than silently decided. Updated LAB_ARCHITECTURE.md, ENGINEERING_SOP.md, README.md, and platform/README.md with Phase 4 pointers, consistent with how every prior phase updated these. Status: PHASE 4 BUILD COMPLETE / PRODUCTION DEPLOYMENT PENDING HARDWARE.
35 lines
1.4 KiB
Markdown
35 lines
1.4 KiB
Markdown
# Runbook: First Production Deployment
|
|
|
|
Prerequisites: Proxmox installed (`infra/proxmox/README.md`), VMs created
|
|
(`infra/terraform/`), DNS pointed at rn-platform-01's public IP.
|
|
|
|
```bash
|
|
# 1. Generate Docker TLS material (offline, on your own machine — never on either VM)
|
|
cd infra/scripts/docker-tls
|
|
./generate-docker-tls.sh --out-dir ./out --lab-host-ip <real-lab-host-ip> --lab-host-dns rn-lab-host-01.internal
|
|
./verify-docker-tls.sh ./out
|
|
|
|
# 2. Fill in real values
|
|
cd ../../ansible
|
|
cp group_vars/production.vault.yml.template group_vars/production.vault.yml
|
|
$EDITOR group_vars/production.vault.yml # real passwords/secrets — openssl rand -hex 32 etc.
|
|
ansible-vault encrypt group_vars/production.vault.yml
|
|
$EDITOR group_vars/production.yml # real IPs, domain, CIDRs
|
|
$EDITOR inventory/production.ini # real IPs
|
|
|
|
# 3. Deploy
|
|
ROOTNODE_TLS_BUNDLE_DIR=../scripts/docker-tls/out \
|
|
ansible-playbook site.yml -i inventory/production.ini --ask-vault-pass
|
|
|
|
# 4. Bootstrap the owner account (once, by a human)
|
|
ssh rootnode-deploy@rn-platform-01
|
|
docker exec -it rootnode-platform-api-1 node bootstrap-owner.js [email protected] "Your Name"
|
|
# (password comes from BOOTSTRAP_OWNER_PASSWORD in the environment, or the CLI prompt — see
|
|
# platform/api/README.md)
|
|
|
|
# 5. Verify
|
|
../../infra/scripts/production-smoke-test.sh
|
|
```
|
|
|
|
Then work through `docs/PRODUCTION_VALIDATION_CHECKLIST.md` in full before calling this done.
|