platform/orca-platform

Fork 0

Files

T

Sharang Parnerkar 8971152da0

ci / shared (pull_request) Successful in 23s

Details

ci / validate (pull_request) Successful in 4s

Details

refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming

Restructures the draft to reflect the 2026-06-30 cluster decision:

Three Orca clusters, each becoming its own Gitea repo at migration time:
- breakpilot-edge   → vm-edge       (Identity + Infra: KC, Gitea, Infisical, PowerDNS, Orca-Proxy)
- breakpilot-control → vm-control   (Portal, tenant-registry, ERPNext, MariaDB, Stalwart)
- breakpilot-app    → vm-app-prod + vm-app-stage (CERTifAI, compliance-*, Mongo, MinIO, Qdrant, LiteLLM)

Key model points encoded:
- Identity (Keycloak) co-tenant with Infra on vm-edge (1 VM core), per
  INFRASTRUCTURE.md §6 — heap pinned so it cannot starve PowerDNS/Infisical
- Stage and prod live in the same breakpilot-app cluster on different
  VMs. Stage authenticates via prod Keycloak under tenant.kind = "stage";
  no duplicated identity, no duplicated control plane (per §5).
- The existing CERTifAI Keycloak will be repurposed for breakpilot-edge
  rather than standing up a fresh one — same realm, same users.
- Multi-VM rollout gated on legal entity being established so we can sign
  SysEleven / Hetzner business contracts. Until then, single-VM ops
  continues via ~/workspace/orca-infra; this repo is design-only.

Mechanical changes:
- manifests/{vm-edge,vm-control,vm-data,stage}/ → clusters/{breakpilot-edge,breakpilot-control,breakpilot-app/services/{prod,stage}}/services/
- vm-data → vm-app-prod, stage → vm-app-stage in node references and headers
- overlays/{stage,prod}/overlay.toml point at the new cluster paths
- scripts/validate.sh now enforces a per-cluster node whitelist
  (breakpilot-edge → vm-edge, breakpilot-control → vm-control,
  breakpilot-app → {vm-app-prod, vm-app-stage}) instead of dir-name equality
- New READMEs at clusters/, clusters/breakpilot-edge/,
  clusters/breakpilot-control/, clusters/breakpilot-app/ documenting
  scope, SLA targets, co-tenant notes, and the future-repo split
- Top README rewritten to lead with the cluster-split decision and the
  legal-entity gate; per-milestone fill-in table re-pathed

Validation:
- make validate → 38 files OK (35 manifests + 3 overlays)
- make plan ENV=stage → 11 resolved manifests in .orca-out/stage/
- make plan ENV=prod  → 24 resolved manifests in .orca-out/prod/

2026-06-30 22:14:51 +02:00

2.0 KiB

Raw Blame History

breakpilot-edge

Identity + Infra plane. Single VM (vm-edge).

Becomes its own Gitea repo platform/breakpilot-edge at migration time.

Services (8)

Service	Purpose
`gitea.toml`	Source forge — every config change to every cluster lands here
`infisical.toml`	Secret store. Every other plane's `${secrets.*}` resolves here
`keycloak.toml`	Single tenant of truth for identity. Repurposed from `certifai` Keycloak — same realm, same users.
`orca-proxy.toml`	Ingress for vm-edge: TLS termination + Let's Encrypt ACME for `*.breakpilot.com`
`pg-infisical.toml`	Infisical's Postgres
`pg-keycloak.toml`	Keycloak's Postgres
`powerdns-auth.toml`	Authoritative DNS for `breakpilot.com`; bound to port 53 on vm-edge
`redis-infisical.toml`	Cache + session store for Infisical

SLA targets (per `INFRASTRUCTURE.md §6`)

Owns:    AVAILABILITY ≥ 99.5% (root dep for every other plane)
         RTO ≤ 15 min (Keycloak)
         AUDIT_TRAIL — realm-level audit (logins, token issuance, IdP events)
         DATA_RESIDENCY — Keycloak realm data must stay EU
         STAGE_ISOLATION — rate-limits stage_client_id; rejects stage JWTs in prod audiences

Co-tenant note

Keycloak's JVM heap is pinned to 1.5 GB in keycloak.toml (JAVA_OPTS_APPEND = "-Xms1g -Xmx1500m") so it cannot starve PowerDNS or Infisical. If the heap fight ever shows up in alerts, the escape hatch is to peel Keycloak off onto its own VM inside the same cluster — no schema migration, just a placement.node flip.

Bootstrap exception

Per INFRASTRUCTURE.md §8 rule 3, KC_DB_URL lives in Orca env (not in Infisical), because Infisical runs on the same VM and we'd otherwise have a circular bootstrap dependency.

2.0 KiB Raw Blame History