eSlider
5f6fd8462c
CI & Release / Verify simulator (push) Skipped
CI & Release / Trivy scan (push) Skipped
CI & Release / Semantic Release (push) Skipped
CI & Release / Verify simulator (pull_request) Failing after 4s
CI & Release / Trivy scan (pull_request) Skipped
CI & Release / Semantic Release (pull_request) Skipped
Extend glossary with storage floors, source of truth, and linkable anchors. Fix broken links, pose frame drift, rsync/offload wording, and README tone. Add docs/improvement audit records and live demo links in design journey.
31 lines
1.4 KiB
Markdown
31 lines
1.4 KiB
Markdown
# Ansible — host preparation
|
|
|
|
Ansible = host prep before workloads run. Terraform ([`../terraform/`](../terraform/)) owns workloads. Boundary: [06 — IaC boundaries](../../docs/06-environments.md#iac-boundaries).
|
|
|
|
| Playbook | Target | What it does |
|
|
| --- | --- | --- |
|
|
| `drone-provision.yml` | Drone (bench, before mission) | Identity keys, peer trust with forced commands, WireGuard, Compose bundle from fleet manifest |
|
|
| `sim-cluster.yml` | Local workstation / CI host | k3d cluster miniaturing ground segment; shared data volume; simulator image import |
|
|
|
|
## Provision a drone
|
|
|
|
```bash
|
|
ansible-playbook -i inventory.example.yml drone-provision.yml
|
|
```
|
|
|
|
Idempotent. Bench network only. Never provision in flight ([05 — Network & security](../../docs/05-network-security.md)):
|
|
|
|
1. **Identity**: generate drone ed25519 keypair if absent.
|
|
2. **Peer trust**: fleet public keys in `authorized_keys`, each pinned to read-only SQL forced command.
|
|
3. **WireGuard**: render `wg0.conf` with drone address and peers.
|
|
4. **Data plane**: Compose bundle from fleet manifest, systemd unit enabled.
|
|
|
|
## Create the simulation cluster
|
|
|
|
```bash
|
|
ansible-playbook sim-cluster.yml # creates k3d cluster 'swarm-sim'
|
|
cd ../terraform/sim-env && terraform init && terraform apply
|
|
```
|
|
|
|
Shared host directory mounted as `/data` — drone pods, exporter, explorer see one Parquet lake (same contract as on-board NVMe).
|