---
id: capability.railiance.infra-provisioning
name: RailianceHosts Infrastructure Provisioning
summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform,
  cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source
  of truth.
owner: railiance-infra
status: draft
domain: financials
tags:
- railiance
- terraform
- ansible
- infrastructure
maturity:
  discovery:
    current: D4
    target: D5
    confidence: high
    rationale: README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets
      setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`)
      as source of truth — an unusually complete operational README among the swept repos.
  availability:
    current: A2
    target: A3
    confidence: high
    rationale: Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI
      already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
external_evidence:
  completeness:
    level: C2
    confidence: low
    basis: scope_vs_intent_and_consumer_expectations
    satisfied_expectations:
    - documented end-to-end quickstart from bare cloud account to converged servers
    - SOPS+age encrypted secrets with a documented key-custody model
    - inventory/servers.yaml as explicit source of truth
    broken_expectations: []
    out_of_scope_expectations: []
  reliability:
    level: R1
    confidence: low
    basis: consumer_quality_signals
    known_reliability_risks:
    - reproducibility not independently re-verified via a live provisioning run in this sweep
discovery:
  intent: Provision and manage servers on Hosteurope/Hetzner Cloud entirely from Git — Terraform for lifecycle,
    cloud-init for first boot, Ansible for convergence — as the S1 Infrastructure Substrate of the Railiance
    OAS Stack.
  includes:
  - Terraform server lifecycle management
  - cloud-init first-boot configuration
  - Ansible convergence playbooks
  - SOPS+age encrypted secrets in-repo
  excludes:
  - Kubernetes cluster bootstrap on top of provisioned hosts (see railiance-cluster)
  - platform services (see railiance-platform)
  assumptions: []
  use_cases: []
  research_memos: []
availability:
  current_level: A2
  target_level: A3
  current_artifacts:
  - Terraform configs
  - Ansible playbooks
  - scripts/
  - tools/
  target_artifacts: []
  consumption_modes:
  - cli (terraform/ansible)
  - gitops
relations:
  depends_on: []
  supports: []
  related_to: []
evidence:
  documentation:
  - README.md
  - SCOPE.md
  tests:
  - sbom-tools.yaml
  - .forgejo/
  consumer_feedback: []
  bug_reports: []
  incidents: []
consumer_guidance:
  recommended_for:
  - operators provisioning Railiance bare-metal/cloud hosts from Git with encrypted-secret custody
  not_recommended_for:
  - needs above the OS/host substrate layer (see railiance-cluster for Kubernetes, railiance-platform
    for shared services)
  known_limitations:
  - reproducibility not independently re-verified via a live provisioning run in this sweep
promotion_history: []
---

# RailianceHosts Infrastructure Provisioning

## Overview

`railiance-infra` (RailianceHosts) is Git-driven automation for provisioning and converging servers on Hosteurope and Hetzner Cloud — Terraform for lifecycle, cloud-init for first boot, Ansible for convergence — with secrets encrypted in-repo via SOPS/age and `inventory/servers.yaml` as the source of truth. It is the S1 Infrastructure Substrate layer of the Railiance OAS Stack.

## Assessment notes

### Discovery

README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) as source of truth — an unusually complete operational README among the swept repos.

### Availability

Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.

### Completeness

First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.

### Reliability

No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.

## Promotion checklist

- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`