GuestOps Ansible handoff

This playbook is the application-owned deployment contract. Copy or import it into the private Futuresens Ansible repository and bind the guestops inventory group there. Do not commit inventory secrets, .env contents, provider credentials, hostnames other than the public service name, or restricted evidence paths to GuestOps.

Required extra variables:

guestops_release_version: matched application version, for example 0.2.1;
guestops_release_commit: full 40-character packaged commit;
guestops_archive: controller path to the generated .tar.gz;
guestops_archive_sha256: approved lowercase SHA-256;
guestops_source_record: controller path to the matching .source.json;
guestops_evidence_directory: existing restricted controller directory for the fetched release record.

The target must already have Docker Engine with Compose, Nginx, Python 3, ss, a trusted certificate under /etc/letsencrypt/live/sandbox-guestops.futuresens.co.uk, and /etc/guestops/guestops.env owned by root with mode 0600. The private environment file supplies MongoDB passwords, image references, provider-file paths and disabled-by-default feature flags. Provision it through Ansible Vault or the existing Futuresens secret process, never through this repository.

Example invocation from the central Ansible checkout:

ansible-playbook guestops.yml \
  -l guestops_sandbox \
  -e guestops_release_version=0.2.1 \
  -e guestops_release_commit=FULL_40_CHARACTER_SHA \
  -e guestops_archive=/secure/releases/GuestOps-0.2.1-COMMIT.tar.gz \
  -e guestops_archive_sha256=LOWERCASE_SHA256 \
  -e guestops_source_record=/secure/releases/GuestOps-0.2.1-COMMIT.source.json \
  -e guestops_evidence_directory=/secure/evidence/guestops/0.2.1

The controller verifies the source package before transfer. The host independently checks the transferred archive checksum, extracts into a commit-specific directory, verifies the package again, selects the commit-tagged images and disabled send/FAQ defaults in the private environment, builds the API and worker images, records immutable image IDs, runs the offline preflight, validates Compose without printing expanded secrets, starts with --no-build, and waits for loopback readiness. It then enables Docker and Nginx at boot, validates and installs the reviewed proxy site, rejects public API or MongoDB listeners, and checks the public redirect and certificate-backed HTTPS readiness before changing the current symlink. The source archive remains in the restricted controller store; the temporary host copy is removed after success.

This playbook does not provision DNS, TLS, Nginx, firewall rules, backup keys, monitoring, or the private environment. Those remain explicit Milestone 10 and 11 acceptance activities.

2.8 KiB Raw Blame History

GuestOps Ansible handoff

2.8 KiB

Raw Blame History