Sharang Parnerkar
8971152da0
Restructures the draft to reflect the 2026-06-30 cluster decision:
Three Orca clusters, each becoming its own Gitea repo at migration time:
- breakpilot-edge → vm-edge (Identity + Infra: KC, Gitea, Infisical, PowerDNS, Orca-Proxy)
- breakpilot-control → vm-control (Portal, tenant-registry, ERPNext, MariaDB, Stalwart)
- breakpilot-app → vm-app-prod + vm-app-stage (CERTifAI, compliance-*, Mongo, MinIO, Qdrant, LiteLLM)
Key model points encoded:
- Identity (Keycloak) co-tenant with Infra on vm-edge (1 VM core), per
INFRASTRUCTURE.md §6 — heap pinned so it cannot starve PowerDNS/Infisical
- Stage and prod live in the same breakpilot-app cluster on different
VMs. Stage authenticates via prod Keycloak under tenant.kind = "stage";
no duplicated identity, no duplicated control plane (per §5).
- The existing CERTifAI Keycloak will be repurposed for breakpilot-edge
rather than standing up a fresh one — same realm, same users.
- Multi-VM rollout gated on legal entity being established so we can sign
SysEleven / Hetzner business contracts. Until then, single-VM ops
continues via ~/workspace/orca-infra; this repo is design-only.
Mechanical changes:
- manifests/{vm-edge,vm-control,vm-data,stage}/ → clusters/{breakpilot-edge,breakpilot-control,breakpilot-app/services/{prod,stage}}/services/
- vm-data → vm-app-prod, stage → vm-app-stage in node references and headers
- overlays/{stage,prod}/overlay.toml point at the new cluster paths
- scripts/validate.sh now enforces a per-cluster node whitelist
(breakpilot-edge → vm-edge, breakpilot-control → vm-control,
breakpilot-app → {vm-app-prod, vm-app-stage}) instead of dir-name equality
- New READMEs at clusters/, clusters/breakpilot-edge/,
clusters/breakpilot-control/, clusters/breakpilot-app/ documenting
scope, SLA targets, co-tenant notes, and the future-repo split
- Top README rewritten to lead with the cluster-split decision and the
legal-entity gate; per-milestone fill-in table re-pathed
Validation:
- make validate → 38 files OK (35 manifests + 3 overlays)
- make plan ENV=stage → 11 resolved manifests in .orca-out/stage/
- make plan ENV=prod → 24 resolved manifests in .orca-out/prod/
71 lines
2.6 KiB
Bash
Executable File
71 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# TOML syntax + structural sanity for every manifest in this repo.
|
|
# Used by `make validate` and by .gitea/workflows/ci.yaml.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
cd "$ROOT"
|
|
|
|
python3 - "$ROOT" <<'PY'
|
|
import sys, tomllib, pathlib
|
|
root = pathlib.Path(sys.argv[1])
|
|
errs = []
|
|
count = 0
|
|
|
|
# Cluster → expected node names. Each cluster ships its own VM(s); a service's
|
|
# placement.node must be one of the cluster's declared VMs.
|
|
CLUSTER_NODES = {
|
|
'breakpilot-edge': {'vm-edge'},
|
|
'breakpilot-control': {'vm-control'},
|
|
'breakpilot-app': {'vm-app-prod', 'vm-app-stage'},
|
|
}
|
|
|
|
for p in sorted(root.glob('clusters/*/services/**/*.toml')):
|
|
count += 1
|
|
try:
|
|
data = tomllib.load(open(p, 'rb'))
|
|
except Exception as e:
|
|
errs.append(f'{p}: TOML parse: {e}')
|
|
continue
|
|
svcs = data.get('service')
|
|
if not svcs:
|
|
errs.append(f'{p}: no [[service]] block')
|
|
continue
|
|
# cluster name = first path component under clusters/
|
|
rel = p.relative_to(root)
|
|
cluster = rel.parts[1] # clusters/<cluster>/services/...
|
|
expected_nodes = CLUSTER_NODES.get(cluster)
|
|
if expected_nodes is None:
|
|
errs.append(f'{p}: unknown cluster "{cluster}" (expected one of {sorted(CLUSTER_NODES)})')
|
|
continue
|
|
for svc in svcs:
|
|
for required in ('name', 'image'):
|
|
if required not in svc:
|
|
errs.append(f'{p}: service missing required field "{required}"')
|
|
# forbidden nesting bugs
|
|
for sub in ('placement', 'resources', 'env', 'volume'):
|
|
if isinstance(svc.get(sub), dict):
|
|
for fb in ('depends_on', 'extra_ports', 'cmd', 'mounts'):
|
|
if fb in svc[sub]:
|
|
errs.append(f'{p}: "{fb}" nested under [service.{sub}] — must be at [[service]] level')
|
|
node = (svc.get('placement') or {}).get('node')
|
|
if not node:
|
|
errs.append(f'{p}: missing placement.node')
|
|
elif node not in expected_nodes:
|
|
errs.append(f'{p}: placement.node "{node}" not valid for cluster "{cluster}" (expected one of {sorted(expected_nodes)})')
|
|
mem = (svc.get('resources') or {}).get('memory')
|
|
if not mem:
|
|
errs.append(f'{p}: missing resources.memory (mandatory per §8 rule 5)')
|
|
# Validate overlays parse too
|
|
for p in sorted(root.glob('overlays/*/overlay.toml')):
|
|
count += 1
|
|
try:
|
|
tomllib.load(open(p, 'rb'))
|
|
except Exception as e:
|
|
errs.append(f'{p}: TOML parse: {e}')
|
|
print(f'checked {count} files')
|
|
for e in errs:
|
|
print(' ', e)
|
|
sys.exit(1 if errs else 0)
|
|
PY
|