tegwick
8f2d17ae06
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbc-910e-77a0-b336-3130194350b3
55 lines
3.4 KiB
Markdown
55 lines
3.4 KiB
Markdown
# Infrastructure as code and bootstrap placement
|
|
|
|
Status: reviewed planning recommendation, 2026-09-14; owner assent and live
|
|
implementation are tracked in RCLK-WP-0005. No infrastructure is deployed by seed.
|
|
|
|
## Recommended split
|
|
|
|
| Concern | Source/operation owner | Bootstrap responsibility |
|
|
| --- | --- | --- |
|
|
| Host UTC daemon, upstreams, OS baseline, health adapter | railiance-infra S1 (confirmed by ADR-0004 and RCLK-WP-0005-T01) | Invoke owner convergence before time-sensitive higher layers |
|
|
| Cluster/network substrate | railiance-cluster and reef-railiance | Sequence their existing prerequisite gates |
|
|
| Application-clock source and contract | railiance-clock | Consume a published version; do not embed a second implementation |
|
|
| Workload packaging and placement | Reviewed rapp package / rail-kubernetes / reef-railiance | Invoke admitted deployment after prerequisites |
|
|
| Keys, identity, TLS and rotation | Existing platform/NetKingdom owners | Use declared bootstrap trust and retire temporary material |
|
|
| UTC quality and operational alerts | Clock operator with railiance-telemetry | Verify and hand off; do not keep operating after bootstrap |
|
|
|
|
The current railiance-bootstrap INTENT says it sequences a new estate and hands
|
|
off, and explicitly excludes ongoing operations and S1 OS baseline ownership.
|
|
railiance-infra owns the declarative substrate. railiance-hosts contains historical S1 content and is superseded. T01 confirmed
|
|
railiance-infra as canonical against railiance-master ADR-0004; RAIL-HO-WP-0013
|
|
owns the host time implementation.
|
|
|
|
## Practical deployment choice
|
|
|
|
Keep host UTC discipline at host level. Prefer a non-privileged application time
|
|
service on the estate's default rail-kubernetes, privately placed on railiance01's
|
|
reef. It reports an estimate and host-quality evidence; it never sets host time.
|
|
An early host daemon/service alternative must explain its bootstrap advantage,
|
|
owned unit/package/config IaC and later handoff. Creating a new execution rail
|
|
merely for this small service is not the default.
|
|
|
|
The role of Forgejo is committed configuration and audit/review history. Basic
|
|
external UTC and transport trust must already work before fetching protected
|
|
source, bootstrapping secrets or obtaining Railiance application time. Document
|
|
any attended bootstrap action and how it is retired; do not create a circular
|
|
clock -> TLS -> secret -> clock prerequisite.
|
|
|
|
## Required IaC delivery evidence
|
|
|
|
All durable resources and configuration must derive from versioned owner source:
|
|
parameterized target inventory, upstream policy, daemon settings, workload manifests,
|
|
trust delivery references, exposure/network rules, resources, probes and monitoring.
|
|
Secret material stays in admitted custody, not in source or rendered evidence.
|
|
|
|
Require preflight/render, exact reviewed diff, scoped apply, live readback,
|
|
idempotent reconvergence, drift detection, disposable rebuild and rollback proof.
|
|
Every live result names source revision, target, artifact digest and observed time
|
|
quality. A temporary emergency correction is evidence to reconcile back into
|
|
source, never the completed implementation. Avoid recording unrelated secrets or
|
|
assuming read-only health means the clock is accurate.
|
|
|
|
RCLK-WP-0005 covers infrastructure setup and operational handoff. RCLK-WP-0004
|
|
covers consumer migration and measured acceptance. Fresh-estate bootstrap includes
|
|
clock ordering; an existing railiance01 upgrade uses the steady-state owner path,
|
|
not a rerun of whole-estate bootstrap.
|