olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
foundation/bootstrap/Pulumi.foundation.yaml

70 lines
3.5 KiB
YAML
Raw Normal View History

feat(bootstrap): real olsitec.net config + DNS records (steps 1+2) CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222), cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort). - components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF provider from encrypted token). Deployed + verified authoritative = 204.168.234.72. - Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222, letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds). Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE. - run.sh: reproducible deploy (passphrase + ssh key from pass/home). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:47:30 +02:00
# Pulumi.foundation.yaml — stack config for the `foundation` stack (initial Hetzner home).
feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02 - Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under packagemanager: bun (no npm fallback needed). - bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig() fails closed, aggregating all missing+malformed keys in one error. Reads flat dotted keys; image digests excluded (they live in VERSIONS, D5). - bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host, .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0 resources under the passphrase provider via gitignored file:// state backend. - Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only, logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained. Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:06:21 +02:00
#
feat(bootstrap): real olsitec.net config + DNS records (steps 1+2) CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222), cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort). - components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF provider from encrypted token). Deployed + verified authoritative = 204.168.234.72. - Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222, letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds). Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE. - run.sh: reproducible deploy (passphrase + ssh key from pass/home). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:47:30 +02:00
# NON-SECRET values only here (CONTRACT_001 §1.2) — safe to commit in plaintext.
# Secrets (CONTRACT_001 §1.3) are added by `pulumi config set --secret` as
# `secure: v1:…` (passphrase-encrypted): foundation:cloudflareApiToken,
# foundation:backup.offsiteAccessKey/SecretKey, and later vaultCredentials:*.
feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02 - Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under packagemanager: bun (no npm fallback needed). - bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig() fails closed, aggregating all missing+malformed keys in one error. Reads flat dotted keys; image digests excluded (they live in VERSIONS, D5). - bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host, .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0 resources under the passphrase provider via gitignored file:// state backend. - Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only, logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained. Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:06:21 +02:00
#
feat(bootstrap): real olsitec.net config + DNS records (steps 1+2) CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222), cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort). - components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF provider from encrypted token). Deployed + verified authoritative = 204.168.234.72. - Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222, letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds). Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE. - run.sh: reproducible deploy (passphrase + ssh key from pass/home). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:47:30 +02:00
# Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE (the ONE
# external secret). Image digests live in foundation/VERSIONS, not here (D5).
feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02 - Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under packagemanager: bun (no npm fallback needed). - bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig() fails closed, aggregating all missing+malformed keys in one error. Reads flat dotted keys; image digests excluded (they live in VERSIONS, D5). - bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host, .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0 resources under the passphrase provider via gitignored file:// state backend. - Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only, logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained. Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:06:21 +02:00
config:
feat(bootstrap): real olsitec.net config + DNS records (steps 1+2) CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222), cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort). - components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF provider from encrypted token). Deployed + verified authoritative = 204.168.234.72. - Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222, letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds). Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE. - run.sh: reproducible deploy (passphrase + ssh key from pass/home). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:47:30 +02:00
# --- identity / networking (real: olsitec.net) ---
foundation:baseDomain: olsitec.net
foundation:hosts.forge: forge.olsitec.net
foundation:hosts.vault: vault.olsitec.net
foundation:hosts.s3: s3.olsitec.net
foundation:hosts.git: git.olsitec.net
foundation:forgeSshPort: "2222"
# --- deployment target: the Helsinki cx33 VM (Docker-over-SSH, port 222) ---
foundation:vm.host: 204.168.234.72
foundation:vm.user: root
foundation:vm.sshPort: "222"
# --- container plane (CONTRACT_003) ---
feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02 - Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under packagemanager: bun (no npm fallback needed). - bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig() fails closed, aggregating all missing+malformed keys in one error. Reads flat dotted keys; image digests excluded (they live in VERSIONS, D5). - bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host, .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0 resources under the passphrase provider via gitignored file:// state backend. - Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only, logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained. Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:06:21 +02:00
foundation:network.name: foundation-net
foundation:network.subnet: 172.30.0.0/24
foundation:dataRoot: /srv/foundation
feat(bootstrap): real olsitec.net config + DNS records (steps 1+2) CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222), cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort). - components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF provider from encrypted token). Deployed + verified authoritative = 204.168.234.72. - Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222, letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds). Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE. - run.sh: reproducible deploy (passphrase + ssh key from pass/home). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:47:30 +02:00
# --- TLS: real Let's Encrypt via Cloudflare DNS-01 ---
foundation:tls.mode: letsencrypt-dns01
foundation:tls.acmeEmail: a.niemann@olsitec.de
# --- Cloudflare (DNS records + DNS-01); token is a SECRET set separately ---
foundation:cloudflare.zoneId: 27e587d5574d5fd6e2cf75b9e914a02c
# --- fixed names (derived, non-secret; creds generated → Vault) ---
feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02 - Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under packagemanager: bun (no npm fallback needed). - bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig() fails closed, aggregating all missing+malformed keys in one error. Reads flat dotted keys; image digests excluded (they live in VERSIONS, D5). - bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host, .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0 resources under the passphrase provider via gitignored file:// state backend. - Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only, logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained. Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:06:21 +02:00
foundation:postgres.db: foundation
foundation:postgres.forgejoDb: forgejo
foundation:rustfs.buckets:
- forgejo-packages
- forgejo-artifacts
- forgejo-lfs
- foundation-backups
foundation:forgejo.adminUser: platform-admin
foundation:forgejo.orgName: olsitec
foundation:runner.labels:
- docker:docker://node:20-bookworm
- dind:docker://-
feat(bootstrap): real olsitec.net config + DNS records (steps 1+2) CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222), cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort). - components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF provider from encrypted token). Deployed + verified authoritative = 204.168.234.72. - Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222, letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds). Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE. - run.sh: reproducible deploy (passphrase + ssh key from pass/home). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:47:30 +02:00
# --- credential feature flags (ADR-002) ---
foundation:features.postgres: "true"
foundation:features.rustfs: "true"
foundation:features.forgejo: "true"
foundation:features.runner: "true"
foundation:features.backup: "true"
foundation:features.registry: "true"
# --- backup: offsite = home Synology MinIO (CONTRACT_004); creds are SECRET ---
feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02 - Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under packagemanager: bun (no npm fallback needed). - bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig() fails closed, aggregating all missing+malformed keys in one error. Reads flat dotted keys; image digests excluded (they live in VERSIONS, D5). - bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host, .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0 resources under the passphrase provider via gitignored file:// state backend. - Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only, logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained. Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 18:06:21 +02:00
foundation:backup.bucket: foundation-backups
feat(bootstrap): real olsitec.net config + DNS records (steps 1+2) CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222), cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort). - components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF provider from encrypted token). Deployed + verified authoritative = 204.168.234.72. - Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222, letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds). Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE. - run.sh: reproducible deploy (passphrase + ssh key from pass/home). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:47:30 +02:00
foundation:backup.offsiteEndpoint: https://minio.wob.olsitec.de:19000
foundation:backup.retentionDaily: "7"
foundation:backup.retentionWeekly: "4"
foundation:cloudflareApiToken:
secure: v1:xDFqTVZxRm2nvIrQ:ddjNyqKi4C27Fppp9YA0B+gNZPtjWig/NBC6y9dR3cQ8xfNfwEsEHxvRgn8aUTH9UrmjXtLEoYk=
foundation:backup.offsiteAccessKey:
secure: v1:svEvJ5K9u+FMnpV/:RztjS8VMSxrdgpBtbNpBPA6gfPLVgnABp77diBC6nWGHZRnG
foundation:backup.offsiteSecretKey:
secure: v1:lkkGBjgmJqVziusc:gpmw5lkfFAjXzeFikhtQnvWObYpKD3Bq5XSmrBA/vlLaoqqxFGAAO4Cq7V8nOLZ926x3fXukPQI=
feat(bootstrap): vault init/unseal + capture to encrypted config (T05) foundation-vault (hashicorp/vault:1.18, digest-pinned) with integrated raft storage in foundation-vault-data (-> /vault/file, which the entrypoint chowns to the vault user), IPC_LOCK for mlock, internal only (8200 unpublished). Init + unseal reuse the olsitec-core pattern but over docker-exec/SSH (ADR-007): the foundation-vault-init command inits 1-of-1 Shamir, unseals, and emits keys + root token on stdout — marked secret and NOT streamed (logging:Stderr) so they never reach the terminal/logs (D2). run.sh captures them into vaultCredentials:* (the one bootstrap secret that cannot live in Vault, CONTRACT_002 §2.4) with an idempotent guard that avoids churning the config. vault-unseal.sh is the passphrase-gated reboot helper (ADR-004): reads keys from config, unseals over an SSH stdin pipe. run.sh also now pins the Pulumi backend per-process (PULUMI_BACKEND_URL) instead of a global `pulumi login`. Live on cx33 Helsinki: initialized + unsealed (raft 1.18.5), keys captured to encrypted config, idempotent re-up reuses stored keys, container-restart reseal recovered by vault-unseal.sh. Acceptance T05 met. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 21:32:52 +02:00
vaultCredentials:unsealKeys:
secure: v1:9YpTkFoQanMwxAQV:dJ4YmXS0aOTHPbuK1H6AJ0SAJ0CjYX0iIyLOQAUNfsOWLsSy5TXxPpGecieBWkzc4AALDkJNlQN9Xo6Q0ZcaSg==
vaultCredentials:rootToken:
secure: v1:OUpYMjnaftxMUKjv:2m+dydQopXGRleeX6ddhYSHgHP7HHZXYLAvQHXUvaA91qajoxU+VugDB/Rs=
feat(backup): age at-rest encryption of bundles (CONTRACT_004 §4.3) Close the known gap: backup bundles were uploaded unencrypted, relying solely on destination access control. Now every data artifact is age-encrypted on the VM before upload and decrypted on restore. - backup-remote.sh: assemble rustfs blobs into rustfs-blobs.tar.zst (so the whole bundle is one encrypted unit), then age -r <recipient> each artifact to <name>.age and drop the plaintext. MANIFEST.json stays cleartext — it is the inventory + integrity gate and carries no secrets; it records each artifact's PLAINTEXT sha256 so restore verifies after decrypt. - restore-remote.sh: materialise the age identity to a 0600 file, decrypt each .age, then run the existing sha + scratch-restore asserts; add a rustfs-blobs extract+assert. - backup.sh / restore.sh: pass the public recipient (arg) / secret identity (stdin, never argv) from passphrase-encrypted config. - provision/index.ts: install age + zstd on the VM via cloud-init so a fresh DR VM (T13) has the backup tools from first boot. - Pulumi.foundation.yaml: seed backup.ageRecipient (public) + backup.ageIdentity (secure:). The identity lives in config so {repo + passphrase} can decrypt a bundle even after total Vault loss (CONTRACT_004 §4.3). Validated live: encrypted backup + restore-verify PASS from both RustFS and offsite; bucket shows only *.age + cleartext MANIFEST.json. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 23:23:38 +02:00
foundation:backup.ageRecipient: age1x6dmgtt2eahpvyzkmy6j80rts28chw2lcam0rcxq3nhc8ld649sslzpsy4
foundation:backup.ageIdentity:
secure: v1:VCFVXswrmMrXyFbr:p4pfG/Kp2lreetYX4O86rZqpU1xQugRycF+PBBiNGZnaD0c15R+mJuLNrl0rBXY5vJwyZTbNSpFY1zPQ7TwuQcVp9h8oiGcgVEobsbb4BBp3lFhsObllgYM9
feat(bootstrap): real olsitec.net config + DNS records (steps 1+2) CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222), cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort). - components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF provider from encrypted token). Deployed + verified authoritative = 204.168.234.72. - Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222, letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds). Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE. - run.sh: reproducible deploy (passphrase + ssh key from pass/home). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:47:30 +02:00
encryptionsalt: v1:5YhUt8BVfH0=:v1:DPCHl+7zwn4RaMPj:A19tZzBlZ1NmDtTWrHreEKk5e8idyw==
Reference in a new issue Copy permalink