Andreas Niemann
185be52763
CONTRACT_001 amendments: hosts.git, vm.sshPort (default 22; VM uses 222), cloudflare.zoneId. config.ts + lib/context.ts (provider host uses sshPort). - components/dns.ts: forge/vault/s3/git.olsitec.net A -> VM (DNS-only, own CF provider from encrypted token). Deployed + verified authoritative = 204.168.234.72. - Pulumi.foundation.yaml: real config (olsitec.net, vm 204.168.234.72:222, letsencrypt-dns01) + encrypted secrets (cloudflare token, offsite creds). Master passphrase: pass olsitec-foundation/PULUMI_CONFIG_PASSPHRASE. - run.sh: reproducible deploy (passphrase + ssh key from pass/home). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
55 lines
2.6 KiB
TypeScript
55 lines
2.6 KiB
TypeScript
// index.ts — foundation bootstrap entrypoint (the egg, PLAN-002 §0, Layer 0).
|
|
//
|
|
// Phase orchestration (PLAN-002 §2, §5). Components are created against the shared
|
|
// provider + foundation-net (ADR-006); GATES between phases are Pulumi dependsOn
|
|
// edges, NOT imperative sequencing, so `pulumi up` derives the order. Wave-2+ tasks
|
|
// fill the marked slots — this file is the single composition point; components stay
|
|
// pure factories in components/*.
|
|
import { loadConfig } from "./config";
|
|
import { buildBaseContext, DeployCtx } from "./lib/context";
|
|
import { deployNetwork } from "./components/network";
|
|
import { deployDns } from "./components/dns";
|
|
|
|
const cfg = loadConfig();
|
|
|
|
// --- shared substrate: provider + network (always first) ---
|
|
const base = buildBaseContext(cfg);
|
|
const network = deployNetwork(base);
|
|
const ctx: DeployCtx = { ...base, network };
|
|
|
|
// --- public DNS records → the VM (independent of the container plane) ---
|
|
const dnsRecords = deployDns(ctx);
|
|
export const dnsHosts = dnsRecords.map((r) => r.name);
|
|
|
|
// =============================================================================
|
|
// PHASE 3 — DATA PLANE (depends on: network)
|
|
// T03 postgres · T04 rustfs · T05 vault (sealed)
|
|
// -----------------------------------------------------------------------------
|
|
// const postgres = deployPostgres(ctx);
|
|
// const rustfs = deployRustfs(ctx);
|
|
// const vault = deployVault(ctx);
|
|
//
|
|
// --- GATE A: Vault init + unseal (T05) → writes unseal keys to encrypted config;
|
|
// credentials.ts (T06) dependsOn the init resource.
|
|
// const credentials = deployCredentials(ctx, { postgres, rustfs, vault });
|
|
//
|
|
// =============================================================================
|
|
// PHASE 6 — FORGE (depends on: credentials, GATE A)
|
|
// T07 caddy · T08 forgejo · T10 runner
|
|
// -----------------------------------------------------------------------------
|
|
// const proxy = deployProxy(ctx);
|
|
// const forgejo = deployForgejo(ctx, { postgres, rustfs, credentials, proxy });
|
|
// --- GATE B: Forgejo healthy → handover (T11) + runner registration (T10).
|
|
// const runner = deployRunner(ctx, { forgejo, credentials });
|
|
// =============================================================================
|
|
|
|
// Stack outputs (extended as phases land).
|
|
export const phase = "T03-precursor"; // network + shared provider only
|
|
export const networkName = network.name;
|
|
export const vmTarget = `${cfg.vm.user}@${cfg.vm.host}`;
|
|
export const enabledFeatures = Object.entries(cfg.features)
|
|
.filter(([, on]) => on)
|
|
.map(([name]) => name);
|
|
|
|
// ctx is consumed by the Wave-2 slots above once uncommented.
|
|
void ctx;
|