olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(bootstrap): postgres data-plane + remote helper (T03)

Browse source 
foundation-postgres (postgres:17, digest-pinned in VERSIONS) on foundation-net,
internal only (5432 unpublished); named volume foundation-postgres-data with
retainOnDelete. The forgejo login role + database are created post-boot by an
idempotent, readiness-gated remote.Command (ADR-007), since 5432 isn't reachable
from the operator. Adds the generator half of credentials.ts (@pulumi/random →
CONTRACT_002 postgres keys) and lib/remote.ts (vmConnection over the VM SSH path).

Live on cx33 Helsinki: container healthy, role 'forgejo' + db 'forgejo' present,
no published ports. Acceptance T03 met.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andreas Niemann 2026-06-30 21:10:34 +02:00
parent 2e11fd2448
commit 6edba60612
8 changed files with 252 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

19
bootstrap/index.ts
View file

@ -9,6 +9,8 @@ import { loadConfig } from "./config";
import { buildBaseContext, DeployCtx } from "./lib/context";
import { deployNetwork } from "./components/network";
import { deployDns } from "./components/dns";
import { generateCredentials } from "./components/credentials";
import { deployPostgres } from "./components/postgres";
const cfg = loadConfig();
@ -21,17 +23,20 @@ const ctx: DeployCtx = { ...base, network };
const dnsRecords = deployDns(ctx);
export const dnsHosts = dnsRecords.map((r) => r.name);
// --- credentials: generation is pure (no deps); Vault distribution is T06 ---
const credentials = generateCredentials(ctx);
// =============================================================================
// PHASE 3 — DATA PLANE (depends on: network)
// T03 postgres · T04 rustfs · T05 vault (sealed)
// T03 postgres ✓ · T04 rustfs · T05 vault (sealed)
// -----------------------------------------------------------------------------
// const postgres = deployPostgres(ctx);
// const rustfs = deployRustfs(ctx);
const postgres = deployPostgres(ctx, credentials.postgres);
// const rustfs = deployRustfs(ctx, credentials.rustfs);
// const vault = deployVault(ctx);
//
// --- GATE A: Vault init + unseal (T05) → writes unseal keys to encrypted config;
// credentials.ts (T06) dependsOn the init resource.
// const credentials = deployCredentials(ctx, { postgres, rustfs, vault });
// writeCredentialsToVault(ctx, credentials, { vault });
//
// =============================================================================
// PHASE 6 — FORGE (depends on: credentials, GATE A)
@ -44,12 +49,10 @@ export const dnsHosts = dnsRecords.map((r) => r.name);
// =============================================================================
// Stack outputs (extended as phases land).
export const phase = "T03-precursor"; // network + shared provider only
export const phase = "T03-postgres"; // network + DNS + data-plane: postgres
export const networkName = network.name;
export const vmTarget = `${cfg.vm.user}@${cfg.vm.host}`;
export const postgresEndpoint = postgres.endpoint;
export const enabledFeatures = Object.entries(cfg.features)
.filter(([, on]) => on)
.map(([name]) => name);
// ctx is consumed by the Wave-2 slots above once uncommented.
void ctx;