refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming (#6)

3 Orca clusters (breakpilot-edge / breakpilot-control / breakpilot-app), 1 plane each. Single-VM core with Keycloak co-tenant on vm-edge. App cluster gets prod + stage VMs. Manifests reorganized into clusters/<name>/services/; validator now enforces per-cluster node whitelist. Multi-VM rollout gated on legal entity.
2026-06-30 20:30:14 +00:00
parent f1c3fd14b9
commit 6be727d404
44 changed files with 428 additions and 125 deletions
@@ -0,0 +1,22 @@
+# infisical stub — full config lands in M3.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "infisical"
+image = "infisical/infisical:latest"
+port = 8080
+depends_on = ["pg-infisical", "redis-infisical"]
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.env]
+DB_CONNECTION_URI = "${secrets.INFISICAL_DB_URI}"
+REDIS_URL = "redis://redis-infisical:6379"
+ENCRYPTION_KEY = "${secrets.INFISICAL_ENCRYPTION_KEY}"
+AUTH_SECRET = "${secrets.INFISICAL_AUTH_SECRET}"
+SITE_URL = "https://infisical.breakpilot.com"