olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(bootstrap): real olsitec.net config + DNS records (steps 1+2)

Browse source 
CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222),
cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort).
- components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF
  provider from encrypted token). Deployed + verified authoritative = 204.168.234.72.
- Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222,
  letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds).
  Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE.
- run.sh: reproducible deploy (passphrase + ssh key from pass/home).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andreas Niemann 2026-06-30 20:47:30 +02:00
parent db47037bdc
commit 185be52763
10 changed files with 141 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

3
documentation/command-log/2026-06-30_foundation-bootstrap.log
View file

@ -32,3 +32,6 @@ NOTE: docker-over-SSH provider path needs SSH_PRIVATE_KEY_PATH=~/.ssh/foundation
--- 2026-06-30T18:32:52Z --- HOST: mac->minio.wob.olsitec.de:19000 CMD: pulumi up (olsitec-foundation bucket + scoped SA) EXIT: RUNNING NOTE: offsite backup target setup
--- 2026-06-30T18:32:54Z UPDATE --- EXIT: 0 — bucket+scoped SA created on home MinIO
--- 2026-06-30T18:34:55Z UPDATE --- EXIT: 0 — olsitec-foundation bucket + scoped SA verified (put/list/delete OK, cross-bucket DENIED).
--- 2026-06-30T18:45:46Z --- HOST: mac->VM(204.168.234.72:222)+cloudflare CMD: ./run.sh up (foundation-net + 4 DNS A records) EXIT: RUNNING NOTE: steps 1+2 — real config deploy: network on Helsinki VM + forge/vault/s3/git.olsitec.net DNS
--- 2026-06-30T18:45:52Z UPDATE --- EXIT: 0 (see above)
--- 2026-06-30T18:47:30Z UPDATE --- EXIT: 0 — DNS authoritative=204.168.234.72 for forge/vault/s3/git; foundation-net live on VM.

15
documentation/contracts/CONTRACT_001_config_schema.md
View file

@ -101,3 +101,18 @@ Namespace **`vaultCredentials:`** and **`foundation:`** as appropriate:
Adding a service = add its `features.<x>` flag + its fixed names here, then its Vault keys in
CONTRACT_002 and its container in CONTRACT_003. Breaking key renames require a minor version note in
this contract and a coordinated update across consumers.
---
## Amendment 2026-06-30 (steps 1+2)
Added to the typed surface (FoundationConfig):
- **`hosts.git`** — `git.olsitec.net`, dedicated Git-over-SSH host (forge+vault+s3+git set).
- **`vm.sshPort`** — optional number, **default 22**; the test/initial Helsinki VM uses **222**
(the vendored hetzner cloud-init moves sshd to 222). `lib/context.ts` builds the Docker-over-SSH
provider host as `ssh://<user>@<host>:<sshPort>`.
- **`cloudflare.zoneId`** — non-secret zone id for DNS records + ACME DNS-01. The matching API token
is the secret `foundation:cloudflareApiToken` (§1.3).
The `foundation` stack is now the **initial Hetzner home** (olsitec.net, vm `204.168.234.72:222`).
Master passphrase: `pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE` (the single external secret).