# Ansible — host preparation

Ansible owns everything that happens **on a host before workloads run**.
Terraform ([`../terraform/`](../terraform/)) owns the workloads themselves.
The boundary is deliberate and documented in
[06 — Environments](../../docs/06-environments.md#iac-boundaries).

| Playbook | Target | What it does |
| --- | --- | --- |
| `drone-provision.yml` | Drone (on the bench, before a mission) | Identity keys, peer trust with forced commands, WireGuard, Compose bundle from the fleet release manifest |
| `sim-cluster.yml` | Local workstation / CI host | k3d cluster that miniatures the ground segment; shared data volume; simulator image import |

## Provision a drone

```bash
ansible-playbook -i inventory.example.yml drone-provision.yml
```

The playbook is idempotent and runs only over the bench network — drones
are never provisioned in flight (see [05 — Network & security](../../docs/05-network-security.md)):

1. **Identity**: generate the drone's ed25519 keypair if absent.
2. **Peer trust**: install every fleet member's public key into
   `authorized_keys`, each pinned to the read-only SQL forced command —
   the only thing a peer can execute.
3. **WireGuard**: render `wg0.conf` with the drone's address and peers.
4. **Data plane**: lay down the Compose bundle referenced by the fleet
   release manifest and enable it as a systemd unit.

## Create the simulation cluster

```bash
ansible-playbook sim-cluster.yml            # creates k3d cluster 'swarm-sim'
cd ../terraform/sim-env && terraform init && terraform apply
```

The cluster mounts a shared host directory as `/data` on the (single)
node, so drone pods, the exporter, and the explorer see one Parquet lake —
the same contract as the on-board NVMe layout.