foundation/bootstrap/index.ts

// index.ts — foundation bootstrap entrypoint (the egg, PLAN-002 §0, Layer 0).
//
// Phase orchestration (PLAN-002 §2, §5). Components are created against the shared
// provider + foundation-net (ADR-006); GATES between phases are Pulumi dependsOn
// edges, NOT imperative sequencing, so `pulumi up` derives the order. Wave-2+ tasks
// fill the marked slots — this file is the single composition point; components stay
// pure factories in components/*.
import { loadConfig } from "./config";
import { buildBaseContext, DeployCtx } from "./lib/context";
import { deployNetwork } from "./components/network";
import { deployDns } from "./components/dns";
import { generateCredentials } from "./components/credentials";
import { deployPostgres } from "./components/postgres";

const cfg = loadConfig();

// --- shared substrate: provider + network (always first) ---
const base = buildBaseContext(cfg);
const network = deployNetwork(base);
const ctx: DeployCtx = { ...base, network };

// --- public DNS records → the VM (independent of the container plane) ---
const dnsRecords = deployDns(ctx);
export const dnsHosts = dnsRecords.map((r) => r.name);

// --- credentials: generation is pure (no deps); Vault distribution is T06 ---
const credentials = generateCredentials(ctx);

// =============================================================================
// PHASE 3 — DATA PLANE  (depends on: network)
//   T03 postgres ✓ · T04 rustfs · T05 vault (sealed)
// -----------------------------------------------------------------------------
const postgres = deployPostgres(ctx, credentials.postgres);
// const rustfs   = deployRustfs(ctx, credentials.rustfs);
// const vault    = deployVault(ctx);
//
// --- GATE A: Vault init + unseal (T05) → writes unseal keys to encrypted config;
//     credentials.ts (T06) dependsOn the init resource.
// writeCredentialsToVault(ctx, credentials, { vault });
//
// =============================================================================
// PHASE 6 — FORGE  (depends on: credentials, GATE A)
//   T07 caddy · T08 forgejo · T10 runner
// -----------------------------------------------------------------------------
// const proxy   = deployProxy(ctx);
// const forgejo = deployForgejo(ctx, { postgres, rustfs, credentials, proxy });
//   --- GATE B: Forgejo healthy → handover (T11) + runner registration (T10).
// const runner  = deployRunner(ctx, { forgejo, credentials });
// =============================================================================

// Stack outputs (extended as phases land).
export const phase = "T03-postgres"; // network + DNS + data-plane: postgres
export const networkName = network.name;
export const vmTarget = `${cfg.vm.user}@${cfg.vm.host}`;
export const postgresEndpoint = postgres.endpoint;
export const enabledFeatures = Object.entries(cfg.features)
  .filter(([, on]) => on)
  .map(([name]) => name);