coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Gate reef web ports on exposure grants
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
This commit is contained in:
codex 2026-08-22 12:34:25 +02:00
parent c569fe168a
commit 61c6082ea8
9 changed files with 228 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

26
Makefile
View file

@ -167,25 +167,25 @@ deploy-stack: ## Print the full S1→S5 ordered deploy sequence (operator follow
@echo "PRE-CONDITIONS"
@echo " [ ] SSH key: ~/.ssh/id_ops"
@echo " [ ] SOPS key: ~/.config/sops/age/keys.txt (or SOPS_AGE_KEY)"
@echo " [ ] ops-bridge: bridge up state-hub-coulombcore k3s-api-coulombcore k3s-api-railiance01"
@echo " [ ] ops-bridge: bridge up state-hub-railiance01 k3s-api-railiance01"
@echo ""
@echo "S1 — Infrastructure Substrate (this repo)"
@echo " make tf-plan && make tf-apply # provision server (skip if exists)"
@echo " ssh tegwick@92.205.130.254 'cd ~/railiance-infra/ansible && ansible-playbook playbooks/bootstrap.yaml -c local --become -l CoulombCore'"
@echo " ssh tegwick@92.205.62.239 'cd ~/railiance-infra/ansible && ansible-playbook playbooks/bootstrap.yaml -c local --become -l Railiance01'"
@echo " make verify"
@echo ""
@echo "S2 — Cluster Runtime (railiance-cluster)"
@echo " ssh tegwick@92.205.130.254 'cd ~/railiance-cluster && make converge && make smoke'"
@echo " ssh tegwick@92.205.62.239 'cd ~/railiance-cluster && make converge && make smoke'"
@echo ""
@echo "S3 — Platform Services (railiance-platform)"
@echo " ssh tegwick@92.205.130.254 'cd ~/railiance-platform && make db-deploy && make valkey-deploy'"
@echo " ssh tegwick@92.205.62.239 'cd ~/railiance-platform && make forgejo-db-status'"
@echo ""
@echo "S4 — Developer Enablement (no workplan yet — ArgoCD already at cluster)"
@echo " (no steps required)"
@echo "S4 — Developer Enablement (railiance-enablement)"
@echo " make -C ~/railiance-enablement check test"
@echo ""
@echo "S5 — Workloads (railiance-apps)"
@echo " ssh tegwick@92.205.130.254 'cd ~/railiance-apps && make gitea-deploy'"
@echo " ssh tegwick@92.205.130.254 'cd ~/railiance-apps && make state-hub-deploy' # T09"
@echo "S5 — Workloads and forge consumer checks"
@echo " make -C ~/railiance-forge gitea-status"
@echo " deploy each application through its owning rapp/release runbook"
@echo ""
@echo " Full runbook: docs/deploy-stack.md"
@ -302,11 +302,15 @@ converge-tags: ## Run only certain tags: make converge-tags TAGS="base,ufw"
converge-firewall: ## Apply only UFW tasks: make converge-firewall HOST=Railiance01
@test -n "$(HOST)" || (echo "Usage: make converge-firewall HOST=Railiance01"; exit 1)
cd $(ANS_DIR) && ansible-playbook playbooks/firewall.yaml $(ANSIBLE_USER_FLAG) -l $(HOST) --tags firewall
cd $(ANS_DIR) && ansible-playbook playbooks/firewall.yaml $(ANSIBLE_USER_FLAG) -l $(HOST) --tags firewall \
$(if $(REEF_DECLARATION),-e reef_declaration_path="$(abspath $(REEF_DECLARATION))",)
validate-reef-exposure: ## Validate PORTS against REEF_DECLARATION without changing a host
@test -n "$(REEF_DECLARATION)" || (echo "Usage: make validate-reef-exposure REEF_DECLARATION=... PORTS=80,443"; exit 1)
python3 scripts/validate-reef-exposure.py --reef-declaration "$(REEF_DECLARATION)" --ports "$(or $(PORTS),80,443)"
converge-check: ## Dry-run (no changes), great for previews
cd $(ANS_DIR) && ansible-playbook $(PLAY) $(ANSIBLE_USER_FLAG) --check
converge-diff: ## Show file/templating diffs while applying changes
cd $(ANS_DIR) && ansible-playbook $(PLAY) $(ANSIBLE_USER_FLAG) --diff