coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement reproducible S1 handoff contracts
Some checks failed
CI Smoke / source-contract (push) Failing after 2s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
This commit is contained in:
codex 2026-08-23 12:02:23 +02:00
parent c8cb1c8edf
commit b93af8cc78
44 changed files with 2035 additions and 342 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/convergence.md
View file

@ -23,8 +23,8 @@ make converge
```
This will:
1. Decrypt secrets locally (with your age key)
2. Run the Ansible playbooks against all hosts in your `inventory/servers.yaml`
1. Validate and resolve each host's baseline profile from source
2. Run the Ansible playbooks against all hosts in `inventory/servers.yaml`
3. Apply the baseline security and tooling configuration
## Verifying
@ -48,5 +48,6 @@ make status
## Notes
- Convergence is **idempotent**: re-running it will not break your server.
- Only your workstation (control node) needs the age private key; hosts never see it.
- Convergence does not load provider credentials. The `sops_agent` role installs
SOPS/age clients but does not place an age private key on a host.
- Additional roles (e.g. WireGuard, Kubernetes, apps) can be layered later.