eSlider
cb4664f5ee
Ansible provisions the k3d cluster and Flux controllers; Terraform modules deploy the simulated fleet and ground warehouse. Compose and k3d share var/t1 (live lake) and var/t3 (warehouse). The prototype gains a live mode fed by the explorer read-only SQL API.
40 lines
1.7 KiB
Markdown
40 lines
1.7 KiB
Markdown
# Ansible — host preparation
|
|
|
|
Ansible owns everything that happens **on a host before workloads run**.
|
|
Terraform ([`../terraform/`](../terraform/)) owns the workloads themselves.
|
|
The boundary is deliberate and documented in
|
|
[06 — Environments](../../docs/06-environments.md#iac-boundaries).
|
|
|
|
| Playbook | Target | What it does |
|
|
| --- | --- | --- |
|
|
| `drone-provision.yml` | Drone (on the bench, before a mission) | Identity keys, peer trust with forced commands, WireGuard, Compose bundle from the fleet release manifest |
|
|
| `sim-cluster.yml` | Local workstation / CI host | k3d cluster that miniatures the ground segment; shared data volume; simulator image import |
|
|
|
|
## Provision a drone
|
|
|
|
```bash
|
|
ansible-playbook -i inventory.example.yml drone-provision.yml
|
|
```
|
|
|
|
The playbook is idempotent and runs only over the bench network — drones
|
|
are never provisioned in flight (see [05 — Network & security](../../docs/05-network-security.md)):
|
|
|
|
1. **Identity**: generate the drone's ed25519 keypair if absent.
|
|
2. **Peer trust**: install every fleet member's public key into
|
|
`authorized_keys`, each pinned to the read-only SQL forced command —
|
|
the only thing a peer can execute.
|
|
3. **WireGuard**: render `wg0.conf` with the drone's address and peers.
|
|
4. **Data plane**: lay down the Compose bundle referenced by the fleet
|
|
release manifest and enable it as a systemd unit.
|
|
|
|
## Create the simulation cluster
|
|
|
|
```bash
|
|
ansible-playbook sim-cluster.yml # creates k3d cluster 'swarm-sim'
|
|
cd ../terraform/sim-env && terraform init && terraform apply
|
|
```
|
|
|
|
The cluster mounts a shared host directory as `/data` on the (single)
|
|
node, so drone pods, the exporter, and the explorer see one Parquet lake —
|
|
the same contract as the on-board NVMe layout.
|