platform/orca-platform
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(iac): drop vms/ — Orca does not provision VMs
ci / shared (pull_request) Successful in 3s
Details
ci / validate (pull_request) Successful in 2s
Details

Browse Source 
Re-read the Orca spec: 'orca nodes' lists already-joined hosts and
'orca join' attaches an existing node to a cluster, but Orca does not
provision the VMs themselves. VM provisioning (SysEleven OpenStack
via Terraform) is a separate concern and will land in a dedicated repo
under the M1.2 milestone, not in orca-platform.

Removes vms/{vm-edge,vm-control,vm-data,stage}.toml + vms/README.md.
Updates README directory tree and milestone fill-in table to reflect
that M1.2's VM specs live elsewhere. validate.sh stops checking vms/.

Refs: M1.1
This commit is contained in:
Sharang Parnerkar
2026-05-18 22:13:32 +02:00
parent 1a728428cf
commit 3d7b67060e
8 changed files with 2 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1 -1
View File
@@ -6,7 +6,7 @@ Generated section is appended on release tag via `git-cliff` (see `.gitea/workfl
## [Unreleased]
### Added
- feat(iac): scaffold orca-platform — manifests/, overlays/, vms/, dns/, scripts/, Makefile (M1.1)
- feat(iac): scaffold orca-platform — manifests/, overlays/, dns/, scripts/, Makefile (M1.1)
-
### Changed
README.md
+1 -6
View File
@@ -29,11 +29,6 @@ The single source of truth for which container runs on which VM in which environ
│ ├── dev/overlay.toml no-op; dev runs docker-compose per-service
│ ├── stage/overlay.toml include manifests/stage/, image_tag=env-stage
│ └── prod/overlay.toml include vm-{edge,control,data}, image_tag=env-prod
├── vms/ # OpenStack VM specs (consumed by M1.2 provisioner)
│ ├── vm-edge.toml m2.small, public IP, identity+infra
│ ├── vm-control.toml m2.medium, private, control plane
│ ├── vm-data.toml m2.medium, private, data plane (scale driver)
│ └── stage.toml m2.small, public IP, ephemeral
├── dns/
│ └── breakpilot.com.zone.template PowerDNS zone — body lands in M0.3
├── cluster.toml.tmpl # Cluster-level config (acme_email, backup, ai); rendered per env
@@ -63,7 +58,7 @@ Each stub manifest in `manifests/` carries a header comment naming the milestone
| Milestone | What it fills in |
|---|---|
| **M0.3** | `vm-edge/powerdns-auth.toml`, DNS zone body, orca-proxy routes |
| **M1.2** | VM provisioning (consumes `vms/*.toml`); brings `make apply` online |
| **M1.2** | VM provisioning (Terraform/OpenStack in a separate repo); brings `make apply` online |
| **M1.3** | Backup cron services + `scripts/restore-drill.sh` |
| **M2.1** | `vm-edge/keycloak.toml` + `pg-keycloak.toml` |
| **M3.1** | `vm-edge/infisical.toml` + `pg-infisical.toml` + `redis-infisical.toml` |
scripts/validate.sh
-7
View File
@@ -49,13 +49,6 @@ for p in sorted(root.glob('overlays/*/overlay.toml')):
tomllib.load(open(p, 'rb'))
except Exception as e:
errs.append(f'{p}: TOML parse: {e}')
# Validate VMs parse too
for p in sorted(root.glob('vms/*.toml')):
count += 1
try:
tomllib.load(open(p, 'rb'))
except Exception as e:
errs.append(f'{p}: TOML parse: {e}')
print(f'checked {count} files')
for e in errs:
print(' ', e)
vms/README.md
-6
View File
@@ -1,6 +0,0 @@
# VM specs
Source of truth for the four billable VMs in `INFRASTRUCTURE.md §1`. These
files are consumed by the M1.2 provisioning step (Terraform/OpenStack against
SysEleven DUS2). Orca itself ignores this directory — it deals with services,
not infrastructure.
vms/stage.toml
-20
View File
@@ -1,20 +0,0 @@
# stage — single-VM stage environment. App plane only, ephemeral DBs.
# Calls OUT to prod Keycloak + prod Stalwart per §2 isolation rules.
[vm]
name = "stage"
env = "stage"
flavor = "m2.small" # 2 vCPU, 8 GB RAM
public_ip = true # tester access without VPN
region = "DUS2"
private_network = "platform-stage"
private_ip_cidr = "10.1.1.0/24"
[vm.disk]
block_volume_gb = 50 # pg-stage + mongo-stage + qdrant-stage; reset per release
[vm.firewall]
ingress_public = [
{ proto = "tcp", ports = [80, 443], source = "0.0.0.0/0", purpose = "stage portal" },
]
ingress_private = [] # stage does not accept private traffic from prod
vms/vm-control.toml
-20
View File
@@ -1,20 +0,0 @@
# vm-control — Control plane (portal, tenant-registry, ERPNext, Stalwart).
# See INFRASTRUCTURE.md §1, §2, §6.
[vm]
name = "vm-control"
env = "prod"
flavor = "m2.medium" # 4 vCPU, 16 GB RAM
public_ip = false # only reachable via vm-edge orca-proxy
region = "DUS2"
private_network = "platform-prod"
private_ip_cidr = "10.0.2.0/24"
[vm.disk]
block_volume_gb = 250 # MariaDB (ERPNext) + Stalwart mail spool, medium growth
[vm.firewall]
ingress_public = [] # no public ingress
ingress_private = [
{ proto = "tcp", ports = "all", source = "10.0.0.0/16", purpose = "intra-platform" },
]
vms/vm-data.toml
-20
View File
@@ -1,20 +0,0 @@
# vm-data — Data plane (CERTifAI, compliance, pg-app, MongoDB, MinIO).
# Scale driver — bump flavor at Tier B/C per §13.
[vm]
name = "vm-data"
env = "prod"
flavor = "m2.medium" # 4 vCPU, 16 GB RAM (Tier B bump: m2.large)
public_ip = false
region = "DUS2"
private_network = "platform-prod"
private_ip_cidr = "10.0.3.0/24"
[vm.disk]
block_volume_gb = 500 # MongoDB + pg-app + Qdrant + MinIO, fast growth (scales with N customers)
[vm.firewall]
ingress_public = []
ingress_private = [
{ proto = "tcp", ports = "all", source = "10.0.0.0/16", purpose = "intra-platform" },
]
vms/vm-edge.toml
-26
View File
@@ -1,26 +0,0 @@
# vm-edge — Identity + Infra plane, public IP, root auth dependency.
# See INFRASTRUCTURE.md §1, §2.
[vm]
name = "vm-edge"
env = "prod"
flavor = "m2.small" # 2 vCPU, 8 GB RAM
public_ip = true
region = "DUS2"
private_network = "platform-prod"
private_ip_cidr = "10.0.1.0/24"
[vm.disk]
block_volume_gb = 50 # pg-keycloak + pg-infisical + Gitea repos (slow growth)
[vm.firewall]
# vm-edge is the only host accepting public traffic. Everything else is
# behind the private network.
ingress_public = [
{ proto = "tcp", ports = [80, 443], source = "0.0.0.0/0", purpose = "orca-proxy HTTP/HTTPS" },
{ proto = "tcp", ports = [53], source = "0.0.0.0/0", purpose = "PowerDNS (TCP)" },
{ proto = "udp", ports = [53], source = "0.0.0.0/0", purpose = "PowerDNS (UDP)" },
]
ingress_private = [
{ proto = "tcp", ports = "all", source = "10.0.0.0/16", purpose = "intra-platform" },
]