46 lines
2.6 KiB
YAML
46 lines
2.6 KiB
YAML
- name: Deploy Wikideck
|
|
hosts: alpha-control-plane
|
|
become: true
|
|
vars_files:
|
|
- ~/Desktop/secrets.yaml
|
|
pre_tasks:
|
|
- name: Require an explicitly approved, immutable mainnet release
|
|
ansible.builtin.assert:
|
|
that:
|
|
- wikideck_mainnet_deployment_approved | default(false) | bool
|
|
- wikideck_release_image is defined and wikideck_release_image is string and wikideck_release_image is match('^.+@sha256:[a-f0-9]{64}$')
|
|
- wikideck_mainnet_peers is defined and wikideck_mainnet_peers is sequence and wikideck_mainnet_peers is not string and wikideck_mainnet_peers | length >= 2
|
|
- wikideck_mainnet_peers | unique | list | length == wikideck_mainnet_peers | length
|
|
- wikideck_candidate_chain_id is defined and wikideck_candidate_chain_id is match('^[a-f0-9]{64}$')
|
|
- wikideck_candidate_risk_ack | default('') == 'operator-accepts-unaudited-risk'
|
|
- wikideck_release_genesis_time is defined and (wikideck_release_genesis_time | string) is match('^[1-9][0-9]{8,10}$')
|
|
- wikideck_release_genesis_time | int >= 1700000000 and wikideck_release_genesis_time | int <= 4102444800
|
|
- wikideck_release_genesis_time | int <= ansible_date_time.epoch | int
|
|
fail_msg: >-
|
|
Mainnet is currently NO-GO. Do not deploy until the operator has approved
|
|
a digest-pinned image with a verified frozen manifest, arrived genesis,
|
|
at least two independent public HTTPS peers, and explicit risk acceptance.
|
|
roles:
|
|
- role: ericomeehan.wikideck
|
|
vars:
|
|
wikideck_image: "{{ wikideck_release_image }}"
|
|
wikideck_image_pull_policy: IfNotPresent
|
|
wikideck_peers: "{{ wikideck_mainnet_peers }}"
|
|
wikideck_mainnet_launch: "{{ wikideck_candidate_chain_id }}"
|
|
wikideck_mainnet_risk_ack: "{{ wikideck_candidate_risk_ack }}"
|
|
wikideck_public_origin: https://wikideck.eom.dev
|
|
wikideck_ingress_enabled: true
|
|
wikideck_ingress_host: wikideck.eom.dev
|
|
wikideck_ingress_class_name: nginx
|
|
wikideck_ingress_annotations:
|
|
cert-manager.io/cluster-issuer: ca-issuer
|
|
# Match the actual ingress controller namespace; add its podSelector if known.
|
|
wikideck_network_policy_ingress_from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: ingress-nginx
|
|
wikideck_storage_size: 2Ti
|
|
wikideck_storage_class: nfs-client
|
|
# Populate only after confirming the real proxy source IPs/CIDRs.
|
|
wikideck_trusted_proxies: "{{ wikideck_ingress_proxy_sources | default([]) }}"
|