tegwick
d755cd613f
Honest first-pass maturity vector grounded in README/docs/tests present in this repo; no invented evidence. Flagged for human review before publish. See reuse-surface history/2026-07-06-coverage-classification.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
131 lines
4.8 KiB
Markdown
131 lines
4.8 KiB
Markdown
---
|
|
id: capability.railiance.infra-provisioning
|
|
name: RailianceHosts Infrastructure Provisioning
|
|
summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform,
|
|
cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source
|
|
of truth.
|
|
owner: railiance-infra
|
|
status: draft
|
|
domain: financials
|
|
tags:
|
|
- railiance
|
|
- terraform
|
|
- ansible
|
|
- infrastructure
|
|
maturity:
|
|
discovery:
|
|
current: D4
|
|
target: D5
|
|
confidence: high
|
|
rationale: README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets
|
|
setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`)
|
|
as source of truth — an unusually complete operational README among the swept repos.
|
|
availability:
|
|
current: A2
|
|
target: A3
|
|
confidence: high
|
|
rationale: Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI
|
|
already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
|
|
external_evidence:
|
|
completeness:
|
|
level: C2
|
|
confidence: low
|
|
basis: scope_vs_intent_and_consumer_expectations
|
|
satisfied_expectations:
|
|
- documented end-to-end quickstart from bare cloud account to converged servers
|
|
- SOPS+age encrypted secrets with a documented key-custody model
|
|
- inventory/servers.yaml as explicit source of truth
|
|
broken_expectations: []
|
|
out_of_scope_expectations: []
|
|
reliability:
|
|
level: R1
|
|
confidence: low
|
|
basis: consumer_quality_signals
|
|
known_reliability_risks:
|
|
- reproducibility not independently re-verified via a live provisioning run in this sweep
|
|
discovery:
|
|
intent: Provision and manage servers on Hosteurope/Hetzner Cloud entirely from Git — Terraform for lifecycle,
|
|
cloud-init for first boot, Ansible for convergence — as the S1 Infrastructure Substrate of the Railiance
|
|
OAS Stack.
|
|
includes:
|
|
- Terraform server lifecycle management
|
|
- cloud-init first-boot configuration
|
|
- Ansible convergence playbooks
|
|
- SOPS+age encrypted secrets in-repo
|
|
excludes:
|
|
- Kubernetes cluster bootstrap on top of provisioned hosts (see railiance-cluster)
|
|
- platform services (see railiance-platform)
|
|
assumptions: []
|
|
use_cases: []
|
|
research_memos: []
|
|
availability:
|
|
current_level: A2
|
|
target_level: A3
|
|
current_artifacts:
|
|
- Terraform configs
|
|
- Ansible playbooks
|
|
- scripts/
|
|
- tools/
|
|
target_artifacts: []
|
|
consumption_modes:
|
|
- cli (terraform/ansible)
|
|
- gitops
|
|
relations:
|
|
depends_on: []
|
|
supports: []
|
|
related_to: []
|
|
evidence:
|
|
documentation:
|
|
- README.md
|
|
- SCOPE.md
|
|
tests:
|
|
- sbom-tools.yaml
|
|
- .forgejo/
|
|
consumer_feedback: []
|
|
bug_reports: []
|
|
incidents: []
|
|
consumer_guidance:
|
|
recommended_for:
|
|
- operators provisioning Railiance bare-metal/cloud hosts from Git with encrypted-secret custody
|
|
not_recommended_for:
|
|
- needs above the OS/host substrate layer (see railiance-cluster for Kubernetes, railiance-platform
|
|
for shared services)
|
|
known_limitations:
|
|
- reproducibility not independently re-verified via a live provisioning run in this sweep
|
|
promotion_history: []
|
|
---
|
|
|
|
# RailianceHosts Infrastructure Provisioning
|
|
|
|
## Overview
|
|
|
|
`railiance-infra` (RailianceHosts) is Git-driven automation for provisioning and converging servers on Hosteurope and Hetzner Cloud — Terraform for lifecycle, cloud-init for first boot, Ansible for convergence — with secrets encrypted in-repo via SOPS/age and `inventory/servers.yaml` as the source of truth. It is the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
|
|
|
|
## Assessment notes
|
|
|
|
### Discovery
|
|
|
|
README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) as source of truth — an unusually complete operational README among the swept repos.
|
|
|
|
### Availability
|
|
|
|
Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
|
|
|
|
### Completeness
|
|
|
|
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
|
|
(reuse-surface). No external consumer feedback exists yet; levels reflect
|
|
scope-vs-intent documentation quality, not internal code quality.
|
|
|
|
### Reliability
|
|
|
|
No production consumer telemetry exists yet; reliability level is
|
|
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
|
|
|
|
## Promotion checklist
|
|
|
|
- [x] ID follows `capability.<domain>.<name>` pattern
|
|
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
|
|
- [x] `external_evidence` is populated separately from `maturity`
|
|
- [ ] Relations reference valid capability IDs (none yet)
|
|
- [x] Index entry added in `registry/indexes/capabilities.yaml`
|