feat: add IaC layer with shared var/t1 and var/t3 data paths

Ansible provisions the k3d cluster and Flux controllers; Terraform modules deploy the simulated fleet and ground warehouse. Compose and k3d share var/t1 (live lake) and var/t3 (warehouse). The prototype gains a live mode fed by the explorer read-only SQL API.
2026-07-08 20:17:32 +01:00
parent d58569b25c
commit cb4664f5ee
44 changed files with 8067 additions and 35 deletions
@@ -0,0 +1,39 @@
+# Ansible — host preparation
+
+Ansible owns everything that happens **on a host before workloads run**.
+Terraform ([`../terraform/`](../terraform/)) owns the workloads themselves.
+The boundary is deliberate and documented in
+[06 — Environments](../../docs/06-environments.md#iac-boundaries).
+
+| Playbook | Target | What it does |
+| --- | --- | --- |
+| `drone-provision.yml` | Drone (on the bench, before a mission) | Identity keys, peer trust with forced commands, WireGuard, Compose bundle from the fleet release manifest |
+| `sim-cluster.yml` | Local workstation / CI host | k3d cluster that miniatures the ground segment; shared data volume; simulator image import |
+
+## Provision a drone
+
+```bash
+ansible-playbook -i inventory.example.yml drone-provision.yml
+```
+
+The playbook is idempotent and runs only over the bench network — drones
+are never provisioned in flight (see [05 — Network & security](../../docs/05-network-security.md)):
+
+1. **Identity**: generate the drone's ed25519 keypair if absent.
+2. **Peer trust**: install every fleet member's public key into
+   `authorized_keys`, each pinned to the read-only SQL forced command —
+   the only thing a peer can execute.
+3. **WireGuard**: render `wg0.conf` with the drone's address and peers.
+4. **Data plane**: lay down the Compose bundle referenced by the fleet
+   release manifest and enable it as a systemd unit.
+
+## Create the simulation cluster
+
+```bash
+ansible-playbook sim-cluster.yml            # creates k3d cluster 'swarm-sim'
+cd ../terraform/sim-env && terraform init && terraform apply
+```
+
+The cluster mounts a shared host directory as `/data` on the (single)
+node, so drone pods, the exporter, and the explorer see one Parquet lake —
+the same contract as the on-board NVMe layout.