feat(iac): scaffold orca-platform layout (M1.1)

Lands manifests/, overlays/, dns/, scripts/, Makefile per M1.1. Bundles yourplatform.com→breakpilot.com rename. vms/ removed (out-of-scope for Orca).

Refs: M1.1

manifests/README.md

@@ -0,0 +1,28 @@
+# Manifests
+
+One `service.toml` per service, grouped by host VM, per `INFRASTRUCTURE.md §2`.
+
+| Directory       | VM            | Plane(s)         | Owner milestone of "real" config |
+|---|---|---|---|
+| `vm-edge/`      | vm-edge       | Identity + Infra | M2.1 (Keycloak), M3.1 (Infisical), M0.3 (PowerDNS), M2.x (Gitea), M1.2 (proxy) |
+| `vm-control/`   | vm-control    | Control          | M5.1 (portal), M4.1 (tenant-registry), M8.1 (ERPNext), M3.2 (Stalwart)         |
+| `vm-data/`      | vm-data       | Data             | M6.x (CERTifAI), M7.x (compliance), M4.1 (pg-app)                              |
+| `stage/`        | stage         | App plane only   | promotion target of stage builds                                               |
+
+Each file in this directory is currently a **shape-only stub** — fields are set but image references and env wiring will be finalised by the milestone listed in the file header.
+
+## Adding a new service
+
+1. Pick the owning VM per `INFRASTRUCTURE.md §2`.
+2. Create `<vm-name>/<service-name>.toml` following the shape of an existing stub.
+3. Set `placement.node = "<vm-name>"`, `resources.memory`/`cpu` per the co-tenant budget in `INFRASTRUCTURE.md §6`.
+4. Reference secrets as `${secrets.NAME}` — Infisical resolves these. No plaintext values except the Keycloak bootstrap DB URI exception (`INFRASTRUCTURE.md §8 rule 3`).
+5. Run `make validate` before pushing.
+
+## Validation
+
+`make validate` parses every TOML and checks required fields (`name`, image OR build OR module, `placement.node`, `resources.memory`). It does NOT contact a running cluster.
+
+`make plan ENV=<env>` merges the base manifest with the matching overlay in `overlays/<env>/` and prints the resulting service definitions. It is a no-op until matching overlays exist for the env.
+
+`make apply ENV=<env>` is gated on a real Orca controller URL — refuses to run until `ORCA_API_URL` is set (lands in M1.2).

manifests/stage/admin-compliance.toml

@@ -0,0 +1,14 @@
+# admin-compliance stub — full config lands in M7.x.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "admin-compliance"
+image = "registry.breakpilot.com/admin-compliance:env-stage"
+port = 3002
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.25

manifests/stage/ai-compliance-sdk.toml

@@ -0,0 +1,14 @@
+# ai-compliance-sdk stub — full config lands in M7.x.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "ai-compliance-sdk"
+image = "registry.breakpilot.com/ai-compliance-sdk:env-stage"
+port = 3001
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

manifests/stage/backend-compliance.toml

@@ -0,0 +1,14 @@
+# backend-compliance stub — full config lands in M7.x.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "backend-compliance"
+image = "registry.breakpilot.com/backend-compliance:env-stage"
+port = 3000
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

manifests/stage/certifai-dashboard.toml

@@ -0,0 +1,14 @@
+# certifai-dashboard stub — full config lands in M6.x.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "certifai-dashboard"
+image = "registry.breakpilot.com/certifai:env-stage"
+port = 3000
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

manifests/stage/customer-portal.toml

@@ -0,0 +1,15 @@
+# customer-portal stub — full config lands in M5.1.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "customer-portal"
+image = "registry.breakpilot.com/portal:env-stage"
+port = 3000
+domain = "*.stage.breakpilot.com"
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

manifests/stage/litellm.toml

@@ -0,0 +1,14 @@
+# litellm stub — full config lands in M6.x.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "litellm"
+image = "ghcr.io/berriai/litellm:main-stable"
+port = 4000
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

manifests/stage/mongodb-stage.toml

@@ -0,0 +1,15 @@
+# mongodb-stage stub — full config lands in M6.x.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Ephemeral.
+
+[[service]]
+name = "mongodb-stage"
+image = "mongo:7"
+port = 27017
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

manifests/stage/orca-proxy.toml

@@ -0,0 +1,15 @@
+# orca-proxy stub — full config lands in M1.2.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Stage proxy only routes to stage app containers.
+
+[[service]]
+name = "orca-proxy"
+image = "orca-managed/orca-proxy:placeholder"
+port = 443
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.5

manifests/stage/pg-app-stage.toml

@@ -0,0 +1,15 @@
+# pg-app-stage stub — full config lands in M4.1.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Ephemeral; no backup, no volume; reset on each release.
+
+[[service]]
+name = "pg-app-stage"
+image = "postgres:16-alpine"
+port = 5432
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

manifests/stage/qdrant-stage.toml

@@ -0,0 +1,15 @@
+# qdrant-stage stub — full config lands in M7.x.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Ephemeral, tiny corpus.
+
+[[service]]
+name = "qdrant-stage"
+image = "qdrant/qdrant:v1.10.0"
+port = 6333
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

manifests/stage/tenant-registry.toml

@@ -0,0 +1,19 @@
+# tenant-registry stub — full config lands in M4.1.
+# Host: stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Calls PROD Keycloak per §2 "Calls OUT to prod"; audience is stage_client_id.
+
+[[service]]
+name = "tenant-registry"
+image = "registry.breakpilot.com/tenant-registry:env-stage"
+port = 8080
+depends_on = ["pg-app-stage"]
+
+[service.placement]
+node = "stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25
+
+[service.env]
+KEYCLOAK_ISSUER = "https://auth.breakpilot.com/realms/breakpilot-prod"

manifests/vm-control/customer-portal.toml

@@ -0,0 +1,20 @@
+# customer-portal stub — full config lands in M5.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "customer-portal"
+image = "registry.breakpilot.com/portal:placeholder"
+port = 3000
+domain = "*.breakpilot.com"
+depends_on = ["tenant-registry"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 1.0
+
+[service.env]
+KEYCLOAK_ISSUER = "https://auth.breakpilot.com/realms/breakpilot-prod"
+TENANT_REGISTRY_URL = "http://tenant-registry:8080"

manifests/vm-control/erpnext.toml

@@ -0,0 +1,25 @@
+# erpnext stub — full config lands in M8.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "erpnext"
+image = "frappe/erpnext:v15"
+port = 8000
+domain = "erp.breakpilot.com"
+depends_on = ["mariadb", "redis-erpnext"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "6Gi"
+cpu = 2.0
+
+[service.volume]
+path = "/home/frappe/frappe-bench/sites"
+
+[service.env]
+DB_HOST = "mariadb"
+REDIS_QUEUE = "redis://redis-erpnext:6379/0"
+REDIS_CACHE = "redis://redis-erpnext:6379/1"
+ADMIN_PASSWORD = "${secrets.ERPNEXT_ADMIN_PASSWORD}"

manifests/vm-control/frappe-hd.toml

@@ -0,0 +1,15 @@
+# frappe-hd stub — full config lands in M9.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "frappe-hd"
+image = "frappe/helpdesk:v1"
+port = 8001
+depends_on = ["mariadb", "redis-erpnext"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

manifests/vm-control/mariadb.toml

@@ -0,0 +1,20 @@
+# mariadb stub — full config lands in M8.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "mariadb"
+image = "mariadb:11"
+port = 3306
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "3Gi"
+cpu = 1.0
+
+[service.volume]
+path = "/var/lib/mysql"
+
+[service.env]
+MARIADB_ROOT_PASSWORD = "${secrets.MARIADB_ROOT_PASSWORD}"

manifests/vm-control/redis-erpnext.toml

@@ -0,0 +1,14 @@
+# redis-erpnext stub — full config lands in M8.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "redis-erpnext"
+image = "redis:7-alpine"
+port = 6379
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.25

manifests/vm-control/stalwart.toml

@@ -0,0 +1,22 @@
+# stalwart stub — full config lands in M3.2.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "stalwart"
+image = "stalwartlabs/mail-server:latest"
+port = 587
+domain = "mail.breakpilot.com"
+extra_ports = ["25:25", "465:465", "587:587", "993:993"]
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.volume]
+path = "/opt/stalwart-mail"
+
+[service.env]
+STALWART__SERVER__HOSTNAME = "mail.breakpilot.com"

manifests/vm-control/tenant-registry.toml

@@ -0,0 +1,20 @@
+# tenant-registry stub — full config lands in M4.1.
+# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "tenant-registry"
+image = "registry.breakpilot.com/tenant-registry:placeholder"
+port = 8080
+
+[service.placement]
+node = "vm-control"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.env]
+DATABASE_URL = "${secrets.TENANT_REGISTRY_DB_URL}"
+KEYCLOAK_ISSUER = "https://auth.breakpilot.com/realms/breakpilot-prod"
+KEYCLOAK_ADMIN_USER = "${secrets.KEYCLOAK_ADMIN_USER}"
+KEYCLOAK_ADMIN_PASS = "${secrets.KEYCLOAK_ADMIN_PASS}"

manifests/vm-data/admin-compliance.toml

@@ -0,0 +1,15 @@
+# admin-compliance stub — full config lands in M7.x.
+# Host: vm-data. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "admin-compliance"
+image = "registry.breakpilot.com/admin-compliance:placeholder"
+port = 3002
+depends_on = ["backend-compliance", "ai-compliance-sdk"]
+
+[service.placement]
+node = "vm-data"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

manifests/vm-data/ai-compliance-sdk.toml

@@ -0,0 +1,15 @@
+# ai-compliance-sdk stub — full config lands in M7.x.
+# Host: vm-data. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "ai-compliance-sdk"
+image = "registry.breakpilot.com/ai-compliance-sdk:placeholder"
+port = 3001
+depends_on = ["pg-app", "qdrant", "litellm"]
+
+[service.placement]
+node = "vm-data"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

manifests/vm-data/backend-compliance.toml

@@ -0,0 +1,15 @@
+# backend-compliance stub — full config lands in M7.x.
+# Host: vm-data. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "backend-compliance"
+image = "registry.breakpilot.com/backend-compliance:placeholder"
+port = 3000
+depends_on = ["pg-app", "minio"]
+
+[service.placement]
+node = "vm-data"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

manifests/vm-data/certifai-dashboard.toml

@@ -0,0 +1,15 @@
+# certifai-dashboard stub — full config lands in M6.x.
+# Host: vm-data. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "certifai-dashboard"
+image = "registry.breakpilot.com/certifai:placeholder"
+port = 3000
+depends_on = ["mongodb", "litellm"]
+
+[service.placement]
+node = "vm-data"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

manifests/vm-data/litellm.toml

@@ -0,0 +1,18 @@
+# litellm stub — full config lands in M6.x.
+# Host: vm-data. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "litellm"
+image = "ghcr.io/berriai/litellm:main-stable"
+port = 4000
+
+[service.placement]
+node = "vm-data"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.env]
+LITELLM_MASTER_KEY = "${secrets.LITELLM_MASTER_KEY}"
+LITELLM_SALT_KEY = "${secrets.LITELLM_SALT_KEY}"

manifests/vm-data/minio.toml

@@ -0,0 +1,23 @@
+# minio stub — full config lands in M7.x.
+# Host: vm-data. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "minio"
+image = "minio/minio:latest"
+port = 9000
+extra_ports = ["9001:9001"]
+cmd = ["server", "/data", "--console-address", ":9001"]
+
+[service.placement]
+node = "vm-data"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.volume]
+path = "/data"
+
+[service.env]
+MINIO_ROOT_USER = "${secrets.MINIO_ROOT_USER}"
+MINIO_ROOT_PASSWORD = "${secrets.MINIO_ROOT_PASSWORD}"

manifests/vm-data/mongodb.toml

@@ -0,0 +1,21 @@
+# mongodb stub — full config lands in M6.x.
+# Host: vm-data. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "mongodb"
+image = "mongo:7"
+port = 27017
+
+[service.placement]
+node = "vm-data"
+
+[service.resources]
+memory = "2Gi"
+cpu = 1.0
+
+[service.volume]
+path = "/data/db"
+
+[service.env]
+MONGO_INITDB_ROOT_USERNAME = "${secrets.MONGO_ADMIN_USER}"
+MONGO_INITDB_ROOT_PASSWORD = "${secrets.MONGO_ADMIN_PASSWORD}"

manifests/vm-data/pg-app.toml

@@ -0,0 +1,23 @@
+# pg-app stub — full config lands in M4.1.
+# Host: vm-data. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# RISK-1 (§12): single instance owns tenant_registry + compliance schemas. Split into pg-registry + pg-compliance at Tier B.
+
+[[service]]
+name = "pg-app"
+image = "postgres:16-alpine"
+port = 5432
+
+[service.placement]
+node = "vm-data"
+
+[service.resources]
+memory = "3Gi"
+cpu = 1.0
+
+[service.volume]
+path = "/var/lib/postgresql/data"
+
+[service.env]
+POSTGRES_DB = "platform"
+POSTGRES_USER = "platform"
+POSTGRES_PASSWORD = "${secrets.PG_APP_PASSWORD}"

manifests/vm-data/qdrant.toml

@@ -0,0 +1,17 @@
+# qdrant stub — full config lands in M7.x.
+# Host: vm-data. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "qdrant"
+image = "qdrant/qdrant:v1.10.0"
+port = 6333
+
+[service.placement]
+node = "vm-data"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.volume]
+path = "/qdrant/storage"

manifests/vm-edge/gitea.toml

@@ -0,0 +1,25 @@
+# gitea stub — full config lands in M3.x.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "gitea"
+image = "gitea/gitea:1.22"
+port = 3000
+domain = "git.breakpilot.com"
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.volume]
+path = "/data"
+
+[service.env]
+USER_UID = "1000"
+USER_GID = "1000"
+GITEA__database__DB_TYPE = "sqlite3"
+GITEA__database__PATH = "/data/gitea/gitea.db"
+GITEA__server__ROOT_URL = "https://git.breakpilot.com"

manifests/vm-edge/infisical.toml

@@ -0,0 +1,22 @@
+# infisical stub — full config lands in M3.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "infisical"
+image = "infisical/infisical:latest"
+port = 8080
+depends_on = ["pg-infisical", "redis-infisical"]
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.env]
+DB_CONNECTION_URI = "${secrets.INFISICAL_DB_URI}"
+REDIS_URL = "redis://redis-infisical:6379"
+ENCRYPTION_KEY = "${secrets.INFISICAL_ENCRYPTION_KEY}"
+AUTH_SECRET = "${secrets.INFISICAL_AUTH_SECRET}"
+SITE_URL = "https://infisical.breakpilot.com"

manifests/vm-edge/keycloak.toml

@@ -0,0 +1,25 @@
+# keycloak stub — full config lands in M2.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Bootstrap exception per §8 rule 3: KC_DB_URL lives in Orca env, not Infisical (Infisical runs on same VM).
+
+[[service]]
+name = "keycloak"
+image = "quay.io/keycloak/keycloak:26.0"
+port = 8443
+domain = "auth.breakpilot.com"
+depends_on = ["pg-keycloak"]
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "2Gi"
+cpu = 1.0
+
+[service.env]
+KC_DB = "postgres"
+KC_DB_URL = "${secrets.KC_DB_URL}"
+KC_HOSTNAME = "auth.breakpilot.com"
+KC_PROXY_HEADERS = "xforwarded"
+KC_HEALTH_ENABLED = "true"
+JAVA_OPTS_APPEND = "-Xms1g -Xmx1500m"

manifests/vm-edge/orca-proxy.toml

@@ -0,0 +1,15 @@
+# orca-proxy stub — full config lands in M1.2/M0.3.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Wildcard TLS terminator; routing rules land with M0.3.
+
+[[service]]
+name = "orca-proxy"
+image = "orca-managed/orca-proxy:placeholder"
+port = 443
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.5

manifests/vm-edge/pg-infisical.toml

@@ -0,0 +1,22 @@
+# pg-infisical stub — full config lands in M3.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "pg-infisical"
+image = "postgres:16-alpine"
+port = 5432
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.25
+
+[service.volume]
+path = "/var/lib/postgresql/data"
+
+[service.env]
+POSTGRES_DB = "infisical"
+POSTGRES_USER = "infisical"
+POSTGRES_PASSWORD = "${secrets.PG_INFISICAL_PASSWORD}"

manifests/vm-edge/pg-keycloak.toml

@@ -0,0 +1,22 @@
+# pg-keycloak stub — full config lands in M2.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "pg-keycloak"
+image = "postgres:16-alpine"
+port = 5432
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.5
+
+[service.volume]
+path = "/var/lib/postgresql/data"
+
+[service.env]
+POSTGRES_DB = "keycloak"
+POSTGRES_USER = "keycloak"
+POSTGRES_PASSWORD = "${secrets.PG_KEYCLOAK_PASSWORD}"

manifests/vm-edge/powerdns-auth.toml

@@ -0,0 +1,15 @@
+# powerdns-auth stub — full config lands in M0.3.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "powerdns-auth"
+image = "powerdns/pdns-auth:4.9"
+port = 53
+extra_ports = ["53:53/udp", "53:53/tcp"]
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.25

manifests/vm-edge/redis-infisical.toml

@@ -0,0 +1,15 @@
+# redis-infisical stub — full config lands in M3.1.
+# Host: vm-edge. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Ephemeral cache; no volume.
+
+[[service]]
+name = "redis-infisical"
+image = "redis:7-alpine"
+port = 6379
+
+[service.placement]
+node = "vm-edge"
+
+[service.resources]
+memory = "128Mi"
+cpu = 0.1