fiwdev/Nereus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: reflect the sealed database cutover

Browse source
This commit is contained in:
Alex 2026-08-28 00:59:51 +02:00
parent 80bcead168
commit bb8fc13f17
1 changed files with 13 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
README.md
View file

@ -251,9 +251,12 @@ scans both the working tree and the committed history on every push and a hit
fails the build. Trivy scans the release configuration and the built images for
HIGH and CRITICAL findings.
The `nereus-db` Secret holds the PostgreSQL password and the DSN, and it is
created out of band rather than living in `base/kustomization.yaml`. See
`deploy/secrets/README.md` for how it is created in each environment.
The `nereus-db` Secret holds the PostgreSQL password and DSN. Production gets
it from the encrypted `deploy/secrets/nereus-db-sealed.yaml`; the Sealed Secrets
controller is the only component that can decrypt it. The current Fedora
cluster was reset onto a fresh PVC and verified with that committed resource.
Development can still create an ephemeral Secret directly. See
`deploy/secrets/README.md` for both workflows.
The CI pipeline never uses a cluster-admin kubeconfig. It authenticates as a
`deployer` ServiceAccount with RBAC scoped to the `nereus` namespace, supplied
@ -325,10 +328,10 @@ pre-promotion analysis fails the pipeline.
| Docker Compose | `compose.yaml`, plus `observability/compose.yaml` and `build/compose.mini.yaml` |
| Kubernetes orchestration | k3s, two Fedora 44 nodes; k3d for a portable equivalent |
| Deployments, Services, Ingress, ConfigMaps, Secrets | `deploy/base/`, composed with kustomize overlays |
| Infrastructure as code | `scripts/provision/`, Ansible roles plus an idempotent bootstrap |
| Infrastructure as code | `terraform/infra/` for libvirt machines, `terraform/platform/` for cluster controllers, and `scripts/provision/` for host configuration |
| CI/CD pipeline | `.forgejo/workflows/pipeline.yml`, self-hosted runner |
| Container registry | Forgejo registry at `git.fiwlabs.dev`, TLS from Traefik |
| Secure credential handling | Gitleaks, Trivy, namespace-scoped `deployer` kubeconfig, out-of-band `nereus-db` |
| Secure credential handling | Gitleaks, Trivy, namespace-scoped `deployer` kubeconfig, and a committed encrypted `nereus-db` SealedSecret |
| Blue-green deployment | Argo Rollouts, `deploy/rollouts/rollout.yaml` |
| Automated rollback | `deploy/rollouts/analysistemplate.yaml`, Prometheus-driven abort |
| OpenTelemetry Collector | `deploy/observability/otel-collector.yaml` for traces, `otel-log-collector.yaml` for logs |
@ -342,21 +345,14 @@ pre-promotion analysis fails the pipeline.
Stated plainly so it does not have to be discovered.
`terraform/infra/` creates the two Fedora 44 libvirt machines and emits the
inventory consumed by Ansible. `terraform/platform/` installs Argo Rollouts,
Sealed Secrets and kube-prometheus-stack. The separation is deliberate:
Terraform owns machines and cluster-wide controllers, Ansible owns the hosts,
and Kustomize owns the application.
Sealed Secrets and Discord alert routing are configured. The database
`SealedSecret` is committed for fresh deployments; the Discord resource still
awaits its owner-provided webhook. `deploy/secrets/README.md` keeps plaintext
values in local pipelines and commits only encrypted resources. The controller
key must be backed up outside this repository before it becomes the recovery
path.
Discord routing is configured but disabled until an owner-provided webhook is
sealed. The Sealed Secrets controller key also needs an off-repository backup;
without it, a rebuilt cluster cannot decrypt the committed database resource.
The remaining acceptance gap is environmental: the reproducible fresh-VM path
has not been rerun on a second workstation with no dependencies installed.
After final sign-off, the local QEMU lab and packages installed only for it can
be removed.
## Fedora traps worth knowing