# Ansible — host preparation

Ansible = host prep before workloads run. Terraform ([`../terraform/`](../terraform/)) owns workloads. Boundary: [06 — IaC boundaries](../../docs/06-environments.md#iac-boundaries).

| Playbook | Target | What it does |
| --- | --- | --- |
| `drone-provision.yml` | Drone (bench, before mission) | Identity keys, peer trust with forced commands, WireGuard, Compose bundle from fleet manifest |
| `sim-cluster.yml` | Local workstation / CI host | k3d cluster miniaturing ground segment; shared data volume; simulator image import |

## Provision a drone

```bash
ansible-playbook -i inventory.example.yml drone-provision.yml
```

Idempotent. Bench network only. Never provision in flight ([05 — Network & security](../../docs/05-network-security.md)):

1. **Identity**: generate drone ed25519 keypair if absent.
2. **Peer trust**: fleet public keys in `authorized_keys`, each pinned to read-only SQL forced command.
3. **WireGuard**: render `wg0.conf` with drone address and peers.
4. **Data plane**: Compose bundle from fleet manifest, systemd unit enabled.

## Create the simulation cluster

```bash
ansible-playbook sim-cluster.yml            # creates k3d cluster 'swarm-sim'
cd ../terraform/sim-env && terraform init && terraform apply
```

Shared host directory mounted as `/data` — drone pods, exporter, explorer see one Parquet lake (same contract as on-board NVMe).