coulomb/railiance-infra
0
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Wiki Activity
106 Commits 1 Branch 0 Tags
f2ffbc0d56a3d2b498d4bdff7088087f259fc20e
Commit Graph

106 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
tegwick
f2ffbc0d56 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-hosts
 2026-04-21 03:41:05 +02:00
tegwick
e0e0ff5b6e chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-infra
 2026-04-21 03:26:37 +02:00
tegwick
b294518069 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-hosts
 2026-04-21 03:26:28 +02:00
tegwick
3f1234a286 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-infra
 2026-04-21 03:11:58 +02:00
tegwick
57a41f9885 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-hosts
 2026-04-21 03:11:50 +02:00
tegwick
02af1d85c7 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-infra
 2026-04-21 02:57:20 +02:00
tegwick
7e49eb2746 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-hosts
 2026-04-21 02:57:09 +02:00
tegwick
185bed088d chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-infra
 2026-04-21 02:42:42 +02:00
tegwick
25a7f34030 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-hosts
 2026-04-21 02:42:31 +02:00
tegwick
270e11c84e chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-infra
 2026-04-21 02:29:00 +02:00
tegwick
6d9900eb6c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-hosts
 2026-04-21 02:28:46 +02:00
tegwick
677cdb79df chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-04-21:
  - update .custodian-brief.md for railiance-infra
 2026-04-21 02:15:44 +02:00
tegwick
3f4f03e838 feat(ansible): inject ops-bridge key in base role at bootstrap 
Add ops_bridge_pubkey to group_vars/all.yaml (public key only, safe to
commit) and inject it via ansible.posix.authorized_key in the base role,
immediately after SSH hardening. This ensures ops-bridge tunnel
connectivity is available as soon as SSH infrastructure is up on any
managed host — no manual key provisioning required for new nodes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 23:52:54 +01:00
tegwick
ab92c58bda chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 13:42:11 +01:00
tegwick
127231bf62 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 13:41:52 +01:00
tegwick
72da7bd151 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 13:41:46 +01:00
tegwick
93080128fd chore(workplan): mark T06 done (Gitea values → railiance-apps) 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 13:41:21 +01:00
tegwick
d722cac4a5 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 10:03:40 +01:00
tegwick
afd664b248 chore(workplan): mark T05 done — Valkey standalone S3 asset deployed 
bitnami/valkey 5.4.9 in platform namespace; gitea-valkey-cluster
subchart decommissioned; Gitea cache/session/queue verified working.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 10:03:14 +01:00
tegwick
28f08b17f3 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 09:12:50 +01:00
tegwick
26849bd4d6 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 09:12:40 +01:00
tegwick
dfed454353 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 09:12:39 +01:00
tegwick
bbde20d78d chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 09:12:31 +01:00
tegwick
7bff1f211d chore(workplan): mark T04 done — Gitea migrated to cnpg gitea-db 
postgresql-ha subchart decommissioned; 4 users, 26 repos verified intact;
NetworkPolicy for default→databases ingress applied.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 09:12:22 +01:00
tegwick
2d7e0101bc feat(infra): UFW k3s routing + full deploy runbook 
- base role: allow UFW routing direction (required for k3s flannel
  pod networking to function across nodes)
- docs/deploy-stack.md: full S1→S5 ordered deploy runbook with
  pre-conditions checklist and layer-by-layer steps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 02:28:51 +01:00
tegwick
aa822164b5 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 02:24:47 +01:00
tegwick
74f7c72dbb chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 02:24:32 +01:00
tegwick
13443ee2d5 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 02:24:27 +01:00
tegwick
11a2c37bde chore(workplan): mark T03 and T08 done in WP-0004 
T03 (gitea-db cnpg cluster): cluster healthy after adding missing
NetworkPolicies for databases namespace default-deny-all policy.
T08 (deploy-stack docs): docs/deploy-stack.md written last session.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 02:24:07 +01:00
tegwick
a787a8acb0 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 02:20:53 +01:00
tegwick
8c08b4b806 fix(custodian-agent): dedicated playbook, correct working dir 
- ansible/playbooks/custodian-agent.yaml: minimal playbook with only
  the custodian_agent role — avoids loading base/sops_agent/etc when
  all we need is key injection
- Makefile: use custodian-agent.yaml in provision targets; remove
  --tags workaround (was fragile; standalone playbook is correct)

Manual invocation (from CoulombCore):
  cd ~/railiance-infra/ansible
  ansible-playbook playbooks/custodian-agent.yaml -u tegwick --limit Railiance01

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 02:20:33 +01:00
tegwick
087f5da57b chore: add .venv to .gitignore 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 01:53:58 +01:00
tegwick
ff59d4e0f8 feat(ansible): add swapfile + resource_limits roles; add CoulombCore to inventory 
T01: roles/swapfile — idempotent 4GB swapfile, vm.swappiness=10, fstab entry
T02: roles/resource_limits — PAM nproc caps (512/1024), systemd user-1000.slice
     memory limits (1500M/512M); templated per-host via host_vars
- inventory/host_vars/CoulombCore.yml — host-specific vars for both roles
- inventory/servers.yaml — add CoulombCore with id_ops SSH key
- inventory_from_yaml.py — load host_vars files into Ansible hostvars
- playbooks/bootstrap.yaml — include swapfile + resource_limits roles
- workplans/WP-0004 — flag T04/T09/T10 needs_human, add CoulombCore-local convergence note

Codifies manual INC-002 hardening. See RAIL-HO-WP-0004-T01/T02.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 01:49:35 +01:00
tegwick
e10789bdd2 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 01:26:01 +01:00
tegwick
abb3c50a5c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 01:25:27 +01:00
tegwick
f5bfc1a922 feat(custodian-agent): add custodian agent public key 
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9

Generated 2026-03-27 via make custodian-keygen. Private key at workstation
only (~/.ssh/id_custodian_agent), never committed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 01:22:45 +01:00
tegwick
30a3f908aa feat(custodian-agent): Ansible role + Makefile for Custodian SSH identity 
Establishes a dedicated SSH keypair for the Custodian automation agent:
- ansible/roles/custodian_agent/: authorized_key task (tagged custodian_agent)
- ansible/inventory/group_vars/all.yaml: custodian_agent_user/pubkey vars
- ansible/playbooks/bootstrap.yaml: custodian_agent role added
- Makefile: provision-custodian-agent / provision-custodian-agent-host targets

Keypair generation: cd ~/the-custodian && make custodian-keygen
Then deploy:        cd ~/railiance-infra && make provision-custodian-agent

The private key lives at ~/.ssh/id_custodian_agent — never committed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 01:21:57 +01:00
tegwick
caa6ae36da feat(workplan): add RAIL-HO-WP-0004 production-readiness workplan 
10-task cross-layer workplan covering: Ansible hardening codification (T01-T02),
cnpg platform baseline superseding stale WP-0001 (T03-T05), S2→S5 Gitea boundary
fix (T06), SSH git automation on CoulombCore (T07, done), deploy-stack docs (T08),
state-hub + activity-core migration to cluster (T09-T10).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 01:01:47 +01:00
tegwick
9d59b5c667 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 01:00:15 +01:00
tegwick
967707bdca chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 00:59:45 +01:00
tegwick
c4470fa4ac chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 00:58:30 +01:00
tegwick
f2951f1a5b chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 00:58:11 +01:00
tegwick
3d647e7181 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 00:54:37 +01:00
tegwick
8688750dce chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 00:54:27 +01:00
tegwick
4b3c2dcdce chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 00:53:47 +01:00
tegwick
1c56bd3efc chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 00:53:38 +01:00
tegwick
cc8c05fdd2 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 00:53:06 +01:00
tegwick
1171a27324 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 00:52:54 +01:00
tegwick
86ceabd80e chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-hosts
 2026-03-27 00:10:20 +01:00
tegwick
fda9d1c386 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for railiance-infra
 2026-03-27 00:10:12 +01:00