27f4f83f73
docs(prod): resolve cross-layer inconsistencies and complete prod env implementation
...
Ansible roles:
- act_runner/defaults: set act_runner_name to inventory_hostname (was
hardcoded to iklim-test-app); added vault_gitea_runner_token to vault.yml
- prod/group_vars/all: restructured from flat files to all/ directory;
added act_runner_labels override (prod-runner,ubuntu-24.04,hostname);
added storagebox_managed_directories; added swarm_manager_ip and other
prod-specific vars
- prod/roles/db_stack: prod-specific db_node tasks using StorageBox paths
(/mnt/storagebox/db/...) instead of local paths
- docker/tasks: split firewalld loop into all-nodes (Swarm ports) and
app-only (80/443) tasks
- swarm/tasks: added --advertise-addr private_ip to join commands for
correct multi-homed node advertisement
- hardening/tasks: corrected firewalld drop zone configuration
- node_dirs/tasks: added /opt/iklimco/vault/data for Vault Raft volume
- db_stack/tasks/app_node: updated stale comment (removed pg-proxy reference)
- db_stack/templates: removed pg-proxy and mongo-proxy service blocks
- test/host_vars/iklim-app-01: added act_runner_name override to preserve
existing test runner registration
Roadmap and setup docs:
- roadmap/03-infra-stack-changes: added replicas:0 for etcd/postgresql/
mongodb/pg-proxy/mongo-proxy in prod overlay; updated placement table;
fixed grafana/data mkdir (auto-created by Ansible); translated Turkish
note to English
- roadmap/08-deploy-pipeline-update: updated stale "remains idle" note
for standalone etcd (now disabled with replicas:0)
- roadmap/01-swarm-init-multinode: consistency fixes
- setup/06: added Outputs section and etcd firewall port documentation
- setup/07: removed prometheus/data from StorageBox acceptance criteria;
replaced manual StorageBox mkdir section with Ansible auto-creation note;
updated prod README section with full bootstrap instructions and vault docs;
added act_runner_labels prod policy
- setup/08: extensive rewrite — aligned with Patroni etcd overlay DNS,
corrected hcloud_firewall.app reference, updated all StorageBox paths
from /prod/db/ to /db/
- setup/09: removed prometheus/data from acceptance criteria; updated
runner label policy (removed docker/swarm-manager labels); added
acceptance criterion for disabled services absent from docker service ls
Terraform:
- prod/firewall.tf: added missing DB subnet mutual rules (etcd, Patroni)
- prod/outputs.tf: added prod_floating_ip and prod_private_ips outputs
- prod/servers.tf: aligned placement group and naming
- prod/variables.tf: corrected variable descriptions
- prod/terraform.tfvars.example: updated defaults
- terraform/hetzner/README.md: new comprehensive README covering both
test and prod environments with firewall tables and inventory instructions
ansible/README.md: expanded prod section with inventory groups, bootstrap
run order, runner label policy, and vault variable documentation
2026-05-18 19:17:56 +03:00
2198f932cd
Implement: Gitea Actions runner, automated DB stack, and Turkish localization
...
* Introduces an Ansible role for installing and registering `act_runner` for Gitea Actions.
* Automates PostgreSQL and MongoDB deployment on Docker Swarm in the test environment, leveraging Docker named volumes for data persistence.
* Translates core documentation, including `README.md` and `setup/04-test-db-docker-kurulum.md`, to Turkish.
* Adds comprehensive documentation for firewall architecture (`facts/firewall.md`) and Docker Swarm node recovery (`facts/swarm-node-recovery.md`).
* Enhances security hardening by ensuring `fail2ban` is enabled and streamlining admin SSH key management via Ansible.
* Updates Ansible vault structure to support new secret variables and adds `.vault_pass` to `.gitignore`.
2026-05-12 18:34:24 +03:00
