27f4f83f73
docs(prod): resolve cross-layer inconsistencies and complete prod env implementation
...
Ansible roles:
- act_runner/defaults: set act_runner_name to inventory_hostname (was
hardcoded to iklim-test-app); added vault_gitea_runner_token to vault.yml
- prod/group_vars/all: restructured from flat files to all/ directory;
added act_runner_labels override (prod-runner,ubuntu-24.04,hostname);
added storagebox_managed_directories; added swarm_manager_ip and other
prod-specific vars
- prod/roles/db_stack: prod-specific db_node tasks using StorageBox paths
(/mnt/storagebox/db/...) instead of local paths
- docker/tasks: split firewalld loop into all-nodes (Swarm ports) and
app-only (80/443) tasks
- swarm/tasks: added --advertise-addr private_ip to join commands for
correct multi-homed node advertisement
- hardening/tasks: corrected firewalld drop zone configuration
- node_dirs/tasks: added /opt/iklimco/vault/data for Vault Raft volume
- db_stack/tasks/app_node: updated stale comment (removed pg-proxy reference)
- db_stack/templates: removed pg-proxy and mongo-proxy service blocks
- test/host_vars/iklim-app-01: added act_runner_name override to preserve
existing test runner registration
Roadmap and setup docs:
- roadmap/03-infra-stack-changes: added replicas:0 for etcd/postgresql/
mongodb/pg-proxy/mongo-proxy in prod overlay; updated placement table;
fixed grafana/data mkdir (auto-created by Ansible); translated Turkish
note to English
- roadmap/08-deploy-pipeline-update: updated stale "remains idle" note
for standalone etcd (now disabled with replicas:0)
- roadmap/01-swarm-init-multinode: consistency fixes
- setup/06: added Outputs section and etcd firewall port documentation
- setup/07: removed prometheus/data from StorageBox acceptance criteria;
replaced manual StorageBox mkdir section with Ansible auto-creation note;
updated prod README section with full bootstrap instructions and vault docs;
added act_runner_labels prod policy
- setup/08: extensive rewrite — aligned with Patroni etcd overlay DNS,
corrected hcloud_firewall.app reference, updated all StorageBox paths
from /prod/db/ to /db/
- setup/09: removed prometheus/data from acceptance criteria; updated
runner label policy (removed docker/swarm-manager labels); added
acceptance criterion for disabled services absent from docker service ls
Terraform:
- prod/firewall.tf: added missing DB subnet mutual rules (etcd, Patroni)
- prod/outputs.tf: added prod_floating_ip and prod_private_ips outputs
- prod/servers.tf: aligned placement group and naming
- prod/variables.tf: corrected variable descriptions
- prod/terraform.tfvars.example: updated defaults
- terraform/hetzner/README.md: new comprehensive README covering both
test and prod environments with firewall tables and inventory instructions
ansible/README.md: expanded prod section with inventory groups, bootstrap
run order, runner label policy, and vault variable documentation
2026-05-18 19:17:56 +03:00
f4b7f49968
chore: prepare prod ansible and db operations
...
Add the Ansible README and expand prod bootstrap coverage for StorageBox keys, DB labels, DB stack configuration, and act runner setup. Update MongoDB configuration for replica set support and refresh prod roadmap/setup documentation for Swarm labels, StorageBox-backed cert paths, and recovery guidance.
2026-05-15 20:39:57 +03:00
f6fa947281
Remove iklim-db stack deploy; update Harbor push docs
...
- ansible: db_stack app_node ve test-db-post-stack'ten artık kullanılmayan stack deploy adımları kaldırıldı (DB servisleri iklimco stack'ine taşındı)
- setup/05: push-harbor-custom-images.sh artık config dosyalarını kendisi üretiyor, init-base.sh ön adımı kaldırıldı
2026-05-13 21:21:22 +03:00
2198f932cd
Implement: Gitea Actions runner, automated DB stack, and Turkish localization
...
* Introduces an Ansible role for installing and registering `act_runner` for Gitea Actions.
* Automates PostgreSQL and MongoDB deployment on Docker Swarm in the test environment, leveraging Docker named volumes for data persistence.
* Translates core documentation, including `README.md` and `setup/04-test-db-docker-kurulum.md`, to Turkish.
* Adds comprehensive documentation for firewall architecture (`facts/firewall.md`) and Docker Swarm node recovery (`facts/swarm-node-recovery.md`).
* Enhances security hardening by ensuring `fail2ban` is enabled and streamlining admin SSH key management via Ansible.
* Updates Ansible vault structure to support new secret variables and adds `.vault_pass` to `.gitignore`.
2026-05-12 18:34:24 +03:00
