Sharang Parnerkar
8971152da0
Restructures the draft to reflect the 2026-06-30 cluster decision:
Three Orca clusters, each becoming its own Gitea repo at migration time:
- breakpilot-edge → vm-edge (Identity + Infra: KC, Gitea, Infisical, PowerDNS, Orca-Proxy)
- breakpilot-control → vm-control (Portal, tenant-registry, ERPNext, MariaDB, Stalwart)
- breakpilot-app → vm-app-prod + vm-app-stage (CERTifAI, compliance-*, Mongo, MinIO, Qdrant, LiteLLM)
Key model points encoded:
- Identity (Keycloak) co-tenant with Infra on vm-edge (1 VM core), per
INFRASTRUCTURE.md §6 — heap pinned so it cannot starve PowerDNS/Infisical
- Stage and prod live in the same breakpilot-app cluster on different
VMs. Stage authenticates via prod Keycloak under tenant.kind = "stage";
no duplicated identity, no duplicated control plane (per §5).
- The existing CERTifAI Keycloak will be repurposed for breakpilot-edge
rather than standing up a fresh one — same realm, same users.
- Multi-VM rollout gated on legal entity being established so we can sign
SysEleven / Hetzner business contracts. Until then, single-VM ops
continues via ~/workspace/orca-infra; this repo is design-only.
Mechanical changes:
- manifests/{vm-edge,vm-control,vm-data,stage}/ → clusters/{breakpilot-edge,breakpilot-control,breakpilot-app/services/{prod,stage}}/services/
- vm-data → vm-app-prod, stage → vm-app-stage in node references and headers
- overlays/{stage,prod}/overlay.toml point at the new cluster paths
- scripts/validate.sh now enforces a per-cluster node whitelist
(breakpilot-edge → vm-edge, breakpilot-control → vm-control,
breakpilot-app → {vm-app-prod, vm-app-stage}) instead of dir-name equality
- New READMEs at clusters/, clusters/breakpilot-edge/,
clusters/breakpilot-control/, clusters/breakpilot-app/ documenting
scope, SLA targets, co-tenant notes, and the future-repo split
- Top README rewritten to lead with the cluster-split decision and the
legal-entity gate; per-milestone fill-in table re-pathed
Validation:
- make validate → 38 files OK (35 manifests + 3 overlays)
- make plan ENV=stage → 11 resolved manifests in .orca-out/stage/
- make plan ENV=prod → 24 resolved manifests in .orca-out/prod/
21 lines
581 B
TOML
21 lines
581 B
TOML
# tenant-registry stub — full config lands in M4.1.
|
|
# Host: vm-control. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
|
|
|
|
[[service]]
|
|
name = "tenant-registry"
|
|
image = "registry.breakpilot.com/tenant-registry:placeholder"
|
|
port = 8090
|
|
|
|
[service.placement]
|
|
node = "vm-control"
|
|
|
|
[service.resources]
|
|
memory = "512Mi"
|
|
cpu = 0.5
|
|
|
|
[service.env]
|
|
DATABASE_URL = "${secrets.TENANT_REGISTRY_DB_URL}"
|
|
KEYCLOAK_ISSUER = "https://auth.breakpilot.com/realms/breakpilot-prod"
|
|
KEYCLOAK_ADMIN_USER = "${secrets.KEYCLOAK_ADMIN_USER}"
|
|
KEYCLOAK_ADMIN_PASS = "${secrets.KEYCLOAK_ADMIN_PASS}"
|