diff --git a/registry/capabilities/capability.railiance.infra-provisioning.md b/registry/capabilities/capability.railiance.infra-provisioning.md index a66ab42..8e5cac8 100644 --- a/registry/capabilities/capability.railiance.infra-provisioning.md +++ b/registry/capabilities/capability.railiance.infra-provisioning.md @@ -1,9 +1,7 @@ --- id: capability.railiance.infra-provisioning -name: RailianceHosts Infrastructure Provisioning -summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, - cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source - of truth. +name: Host convergence and security baseline +summary: Ansible inventory, firewall, SSH bootstrap and baseline verification. owner: railiance-infra status: draft domain: financials @@ -12,20 +10,26 @@ tags: - terraform - ansible - infrastructure +- security +- netkingdom +- framework-reuse maturity: discovery: current: D4 target: D5 confidence: high - rationale: README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets - setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) - as source of truth — an unusually complete operational README among the swept repos. + rationale: README documents a complete, concrete quickstart (clone, prerequisites, + SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) + with a specific inventory file (`inventory/servers.yaml`) as source of truth + — an unusually complete operational README among the swept repos. availability: current: A2 target: A3 confidence: high - rationale: Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI - already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack. + rationale: 'Source interface assessed 2026-10-14: Ansible inventory, firewall, + SSH bootstrap and baseline verification. Availability describes the delivery + form, not production acceptance. Current hosts differ from the retained Hetzner + provisioning path.' external_evidence: completeness: level: C2 @@ -42,41 +46,39 @@ external_evidence: confidence: low basis: consumer_quality_signals known_reliability_risks: - - reproducibility not independently re-verified via a live provisioning run in this sweep + - reproducibility not independently re-verified via a live provisioning run in + this sweep discovery: - intent: Provision and manage servers on Hosteurope/Hetzner Cloud entirely from Git — Terraform for lifecycle, - cloud-init for first boot, Ansible for convergence — as the S1 Infrastructure Substrate of the Railiance - OAS Stack. + intent: Ansible inventory, firewall, SSH bootstrap and baseline verification includes: - - Terraform server lifecycle management - - cloud-init first-boot configuration - - Ansible convergence playbooks - - SOPS+age encrypted secrets in-repo + - Ansible inventory, firewall, SSH bootstrap and baseline verification excludes: - - Kubernetes cluster bootstrap on top of provisioned hosts (see railiance-cluster) - - platform services (see railiance-platform) + - Current hosts differ from the retained Hetzner provisioning path assumptions: [] - use_cases: [] + use_cases: + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' research_memos: [] availability: current_level: A2 target_level: A3 current_artifacts: - - Terraform configs - - Ansible playbooks - - scripts/ - - tools/ + - SCOPE.md target_artifacts: [] consumption_modes: - - cli (terraform/ansible) - - gitops + - CLI + - source relations: depends_on: [] supports: [] - related_to: [] + related_to: + - capability.security.iam-tooling-suite evidence: documentation: - - README.md - SCOPE.md tests: - sbom-tools.yaml @@ -86,46 +88,36 @@ evidence: incidents: [] consumer_guidance: recommended_for: - - operators provisioning Railiance bare-metal/cloud hosts from Git with encrypted-secret custody + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings not_recommended_for: - - needs above the OS/host substrate layer (see railiance-cluster for Kubernetes, railiance-platform - for shared services) + - Current hosts differ from the retained Hetzner provisioning path known_limitations: - - reproducibility not independently re-verified via a live provisioning run in this sweep + - Current hosts differ from the retained Hetzner provisioning path + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. promotion_history: [] --- -# RailianceHosts Infrastructure Provisioning +# Host convergence and security baseline -## Overview +Ansible inventory, firewall, SSH bootstrap and baseline verification. -`railiance-infra` (RailianceHosts) is Git-driven automation for provisioning and converging servers on Hosteurope and Hetzner Cloud — Terraform for lifecycle, cloud-init for first boot, Ansible for convergence — with secrets encrypted in-repo via SOPS/age and `inventory/servers.yaml` as the source of truth. It is the S1 Infrastructure Substrate layer of the Railiance OAS Stack. +## Reuse boundary -## Assessment notes +Current hosts differ from the retained Hetzner provisioning path. -### Discovery +## Supported use cases -README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) as source of truth — an unusually complete operational README among the swept repos. +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings -### Availability +## Evidence and integration -Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack. +- [SCOPE.md](../../SCOPE.md) -### Completeness - -First-pass honest assessment from the REUSE-WP-0017 coverage campaign -(reuse-surface). No external consumer feedback exists yet; levels reflect -scope-vs-intent documentation quality, not internal code quality. - -### Reliability - -No production consumer telemetry exists yet; reliability level is -intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. - -## Promotion checklist - -- [x] ID follows `capability..` pattern -- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` -- [x] `external_evidence` is populated separately from `maturity` -- [ ] Relations reference valid capability IDs (none yet) -- [x] Index entry added in `registry/indexes/capabilities.yaml` +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index 6a463c2..d2aa940 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,22 +1,23 @@ version: 1 -updated: '2026-07-06' +updated: '2026-10-14' domain: helix_forge capabilities: - id: capability.railiance.infra-provisioning - name: RailianceHosts Infrastructure Provisioning - summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, - cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source - of truth. - vector: D4 / A2 / C2 / R1 + name: Host convergence and security baseline + summary: Ansible inventory, firewall, SSH bootstrap and baseline verification. domain: financials status: draft owner: railiance-infra - path: registry/capabilities/capability.railiance.infra-provisioning.md tags: - railiance - terraform - ansible - infrastructure + - security + - netkingdom + - framework-reuse + vector: D4 / A2 / C2 / R1 + path: registry/capabilities/capability.railiance.infra-provisioning.md consumption_modes: - - cli (terraform/ansible) - - gitops + - CLI + - source