From 6411c1dd35a255cc33f028f21b5be3e4aff4bf9e Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sat, 15 Aug 2026 20:55:20 +0200 Subject: [PATCH] docs: move Subactor SSOT to subactor/deployment Keep only pointers here; redeploy remains the ADOPT toolkit, not HOME for Subactor topology or fleet wrappers. Co-authored-by: Cursor --- docs/README.md | 2 +- docs/subactor-deployment.md | 216 +----------------- examples/README.md | 7 +- .../01-plesk-edge-verify/migration.yaml | 58 ----- .../01-plesk-edge-verify/redeploy.yaml | 5 - .../02-founder-origin-verify/migration.yaml | 67 ------ .../02-founder-origin-verify/redeploy.yaml | 5 - .../03-docker-vps-platform/migration.yaml | 75 ------ .../03-docker-vps-platform/redeploy.yaml | 5 - examples/subactor/README.md | 31 +-- examples/subactor/fleet.yaml | 77 ------- 11 files changed, 20 insertions(+), 528 deletions(-) delete mode 100644 examples/subactor/01-plesk-edge-verify/migration.yaml delete mode 100644 examples/subactor/01-plesk-edge-verify/redeploy.yaml delete mode 100644 examples/subactor/02-founder-origin-verify/migration.yaml delete mode 100644 examples/subactor/02-founder-origin-verify/redeploy.yaml delete mode 100644 examples/subactor/03-docker-vps-platform/migration.yaml delete mode 100644 examples/subactor/03-docker-vps-platform/redeploy.yaml delete mode 100644 examples/subactor/fleet.yaml diff --git a/docs/README.md b/docs/README.md index f8a275a..645f57e 100644 --- a/docs/README.md +++ b/docs/README.md @@ -2,7 +2,7 @@ | Doc | Topic | | --- | --- | -| [subactor-deployment.md](subactor-deployment.md) | Subactor / sub.actor / `*.subactor.com` topology via redeploy | +| [subactor-deployment.md](subactor-deployment.md) | Pointer → SSOT `subactor/deployment` (not HOME here) | | [fleet.md](fleet.md) | Fleet & device registry | | [patterns.md](patterns.md) | Common migration patterns | | [observe.md](observe.md) | Observe mode | diff --git a/docs/subactor-deployment.md b/docs/subactor-deployment.md index 68bb5e1..cde7ac6 100644 --- a/docs/subactor-deployment.md +++ b/docs/subactor-deployment.md @@ -1,211 +1,17 @@ -# Subactor deployment through `semcod/redeploy` +# Subactor deployment docs moved -HOME: `semcod` (`redeploy`, toolkit). -Runtime facts and authority: **ADOPT** from Subactor -(`platform/config/deployment-bindings`, `www-sub-actor/docs/deployment.md`, -knowledge entries). Host fitness: **ADOPT** `wellmanifest/policy-dsl` -(`subactor.host/production-server/v1`, `subactor.host/rpi5/v1`). +**SSOT is `subactor/deployment` (HOME=`subactor`), not this repository.** -This document answers: **how Subactor is deployed today**, and **how operators -drive that topology with `redeploy`** (detect → plan → apply / fleet). +- https://github.com/subactor/deployment +- Topology / procedures / fleet wrappers: that repo’s `docs/` and `redeploy/` -> Status observed: **2026-08-15**. Live public `*.subactor.com` and current -> `sub.actor` publish path are **Plesk**. Full Docker VPS + Traefik for -> Platform/`control.sub.actor` is the **documented target** in -> `www-sub-actor/docs/deployment.md`, not yet the live Founder Control host. - ---- - -## 1. Topology (as-is vs target) - -```text - ┌─────────────────────────────────────┐ - │ Plesk 217.160.250.222 (edge) │ - Internet ──────────────►│ DNS / TLS / mail / static / PHP │ - │ Node Toolkit (founder origin) │ - └──────────────┬──────────────────────┘ - │ - ┌─────────────────────────────┼─────────────────────────────┐ - │ │ │ - *.subactor.com founder.subactor.com sub.actor - static / PHP sites Node proxy → :19081 Plesk httpdocs - (SFTP plesk:// sync) SSH -R from Lenovo (binding: - → Caddy :18081 → Control deployment:sub-actor:production) - -TARGET (policy-aligned Docker VPS — FORBID Compose inside Plesk): - - Internet ──► Docker VPS (Traefik ACME DNS-01) - ├─ https://sub.actor / *.sub.actor (portal image sha-*) - └─ https://control.sub.actor (Platform Control router) - Plesk remains DNS/TLS/mail/WWW edge only -``` - -### Domain map (SSOT) - -Source of truth: `subactor/platform/config/deployment-bindings/registry.v1.json` -and `public-pages.json`. Provider for listed sites today: **`plesk`**. - -| Domain | Role today | Deploy mechanism | -| --- | --- | --- | -| `subactor.com` | Marketing / main site | Plesk SFTP sync | -| `www.subactor.com`, `docs.subactor.com`, `docs-stage.subactor.com` | Docs / www | Plesk SFTP | -| `logo.subactor.com`, `status.subactor.com`, `contracts.subactor.com`, … | Brand / status | Plesk SFTP | -| `identity.subactor.com`, `chat.subactor.com` | Surface placeholders | Plesk SFTP | -| `auth.subactor.com` | Auth **bootstrap** static site (not full IdP yet) | Plesk SFTP; project `projekty/auth-subactor-com` | -| `founder.subactor.com` | Public Founder Control origin | Plesk Node `plesk-origin` + SSH reverse tunnel | -| `sub.actor` | SaaS portal publish | Plesk webspace `sub.actor/httpdocs` (live); Docker Traefik path documented | -| `control.sub.actor` | Authenticated Control | Documented on Docker VPS; live Founder still via `founder.subactor.com` | -| `*.sub.actor` tenants | Tenant vhosts | Documented Traefik wildcard; live depends on portal stack | - -`control.subactor.com` is **not** in the bindings registry. - ---- - -## 2. Current procedures (canonical scripts) - -### A. Static / PHP public pages (`*.subactor.com`, often `sub.actor`) - -1. Exact deployment binding + plan hash (Digital Twin / Control). -2. `plesk://host/site/command/sync` (SFTP) — credentials from Vault scopes, not - in Git. -3. HTTP/hash read-back on the bound URL. -4. Entry points: Planfile tickets, `platform/scripts/deploy-public-pages.mjs`, - project reconciliation. - -**redeploy role:** inventory in `examples/subactor/fleet.yaml`; verify steps in -`01-plesk-edge-verify` (curl EQL). Publish mutate stays Subactor `plesk://` -(authority + binding), not a free-form rsync from redeploy. - -### B. Founder public Control (`founder.subactor.com`) - -1. Publish `projekty/founder-subactor-com/plesk-origin/{app.js,package.json}` to - Plesk docroot `founder.subactor.com/`. -2. Keep `founder-plesk-tunnel.service` on Lenovo - (`platform/scripts/founder-plesk-tunnel.sh`) → `prototypowanie.pl:19081`. -3. Doctor: `platform/scripts/founder-public-origin-doctor.sh`. -4. EQL: `/` → 401 Basic; `/founder/form` → 200; `/__origin_health` → 200. - -**redeploy role:** `02-founder-origin-verify` migration (health probes only). - -### C. Platform Compose (lab / future VPS) - -```bash -cd /opt/subactor/src/platform # or sibling checkout -./scripts/deploy-stack.sh deploy -``` - -Posture from host `.env` (`SUBACTOR_DEPLOYMENT_TOPOLOGY`, -`CONTROL_DEPLOYMENT_POSTURE`). Never `compose down -v` in deploy procedures. - -### D. Documented full portal + Platform (Docker VPS target) - -From `www-sub-actor/docs/deployment.md`: - -1. Host fit per Policy DSL (16 GiB min / 32 GiB recommended). -2. `capture-platform-lock.sh` → `sync-platform.sh` (exact SHAs). -3. Secrets on host only; GHCR image `ghcr.io/subactor/www-sub-actor:sha-*`. -4. `deploy-all.sh docker ` → Platform then portal. -5. Health: `https://sub.actor/readyz`, tenant resolve smoke. -6. GitHub Environments `staging` / `production` + `release.sh` over SSH. - -**redeploy role:** `03-docker-vps-platform` migration wraps the same SSH command -surface for detect/plan/apply and fleet targeting. - -### E. auth.subactor.com - -Static bootstrap only. Full SSO/OIDC federation is **not** the current runtime. -Do not treat `auth.subactor.com` as the production IdP until a binding + provider -say so. - ---- - -## 3. Using `redeploy` for Subactor - -Install: `pipx install redeploy` (see root README). +This toolkit (`semcod/redeploy`) remains generic: `detect` → `plan` → `apply` / +`fleet`. Subactor operators **ADOPT** it from `subactor/deployment`; they do not +treat `examples/subactor/` here as source of truth. ```bash -cd examples/subactor - -# Fleet inventory (roles / tags — no secrets) -redeploy fleet --file fleet.yaml - -# Plan only (no SSH) -redeploy run 03-docker-vps-platform/migration.yaml --plan-only - -# Dry-run against a configured host (set SUBACTOR_VPS_SSH in env / edit host) -redeploy run 03-docker-vps-platform/migration.yaml --dry-run - -# Verify-only edge probes (read-only) -redeploy run 01-plesk-edge-verify/migration.yaml --plan-only -redeploy run 02-founder-origin-verify/migration.yaml --plan-only -``` - -### Safety rules (fail closed) - -| Rule | Why | -| --- | --- | -| No Compose stack inside Plesk | Policy `FORBID RUN_COMPOSE_STACK_INSIDE_PLESK` | -| No Control port 8181 on public host | Policy `FORBID BIND_CONTROL_PORT_8181_PUBLIC` | -| No mutable `main` multi-repo deploy | Use `components.lock` / `sha-*` images | -| No secrets in `migration.yaml` / Git | Host files + Vault; placeholders only here | -| `redeploy apply` ≠ production authority | Subactor grant / binding still required for mutate | -| Validator merge ≠ production apply | Separate POA / Planfile / SSH release | - ---- - -## 4. Example package layout - -```text -examples/subactor/ -├── README.md -├── fleet.yaml # roles: plesk-edge, founder-origin, docker-vps, rpi5-edge -├── 01-plesk-edge-verify/ -│ ├── migration.yaml # curl EQL for public pages -│ └── redeploy.yaml -├── 02-founder-origin-verify/ -│ ├── migration.yaml # founder EQL + tunnel hint -│ └── redeploy.yaml -└── 03-docker-vps-platform/ - ├── migration.yaml # deploy-all.sh / release surface - └── redeploy.yaml +git clone git@github.com:subactor/deployment.git +cd deployment +redeploy fleet --file redeploy/fleet.yaml +redeploy run redeploy/03-docker-vps-platform/migration.yaml --plan-only ``` - -Hosts in examples use placeholders: - -- `deploy@SUBACTOR_VPS_IP` — Docker production VPS -- `operator@LENOVO_LAB` — tunnel / Control lab host -- Plesk verify steps run from the operator machine (no Plesk root required) - -Replace placeholders before `--dry-run` / apply. Prefer environment-specific -copies outside Git for real IPs. - ---- - -## 5. Cross-links (do not duplicate SSOT) - -| Concern | Canonical location | -| --- | --- | -| Host MUST/SHOULD tables | `wellmanifest/policy-dsl` + `www-sub-actor/docs/deployment.md` §1 | -| Portal/PayPal/ACME/GitHub release | `www-sub-actor/docs/deployment.md` | -| Domain → docroot bindings | `subactor/platform/config/deployment-bindings/registry.v1.json` | -| Founder origin ops | `subactor/projekty/founder-subactor-com/README.md` | -| Auth bootstrap | `subactor/projekty/auth-subactor-com/README.md` | -| redeploy CLI mechanics | `semcod/redeploy/README.md`, `docs/fleet.md` | - -When this document disagrees with Subactor registries or live knowledge, **Subactor -SSOT wins**; update this file in the same change set. - ---- - -## 6. Suggested operator sequence (target VPS cutover) - -1. `redeploy run 01-plesk-edge-verify/... --plan-only` — baseline public EQL. -2. Qualify VPS with Policy DSL production-server profile. -3. Bootstrap Docker host (`www-sub-actor/scripts/host-bootstrap.sh`). -4. Pin sources (`capture-platform-lock` / `sync-platform`). -5. `redeploy run 03-docker-vps-platform/... --dry-run` then apply under grant. -6. Point `sub.actor` / `*.sub.actor` A/AAAA at VPS; keep Plesk for `*.subactor.com` - edge until intentionally migrated. -7. Move Founder public URL to `https://control.sub.actor/founder` only after - Control is healthy on Traefik; keep tunnel as rollback until EQL green. -8. Re-run verify migrations; backup Postgres / `acme-data` / secrets. diff --git a/examples/README.md b/examples/README.md index 8d68ac8..4a315ba 100644 --- a/examples/README.md +++ b/examples/README.md @@ -43,12 +43,11 @@ They are not useful as: examples/ ├── yaml/ # supported, tested examples ├── md/ # three supported markdown subset examples plus prototypes -└── subactor/ # Subactor Plesk edge + Docker VPS fleet (docs + verify wrappers) +└── subactor/ # pointer only → https://github.com/subactor/deployment ``` -Subactor operators: start at -[`subactor/README.md`](subactor/README.md) and -[`../docs/subactor-deployment.md`](../docs/subactor-deployment.md). +Subactor operators: use **`subactor/deployment`** (HOME), not this toolkit repo. +See [`../docs/subactor-deployment.md`](../docs/subactor-deployment.md). ## Notes diff --git a/examples/subactor/01-plesk-edge-verify/migration.yaml b/examples/subactor/01-plesk-edge-verify/migration.yaml deleted file mode 100644 index ccbf174..0000000 --- a/examples/subactor/01-plesk-edge-verify/migration.yaml +++ /dev/null @@ -1,58 +0,0 @@ -# 01 — Plesk edge verify (read-only documentation surface) -# Usage: redeploy run examples/subactor/01-plesk-edge-verify/migration.yaml --plan-only -# -# Mutating Plesk publish stays in Subactor (plesk:// + deployment bindings). -# Hosts below are placeholders; verify steps are local curl from the planner. - -name: "subactor plesk-edge verify (public pages)" -description: >- - Read-only EQL probes for live Plesk-hosted Subactor surfaces. - Does not sync docroots. - -source: - strategy: docker_full - host: "operator@localhost" - app: subactor-edge - version: "live" - domain: subactor.com - remote_dir: /tmp/subactor-redeploy-noop - -target: - strategy: docker_full - host: "operator@localhost" - app: subactor-edge - version: "live" - domain: subactor.com - remote_dir: /tmp/subactor-redeploy-noop - verify_url: https://subactor.com/ - verify_version: "live" - -extra_steps: - - id: eql_subactor_com - action: ssh_cmd - description: "EQL marketing root responds" - command: >- - curl -fsS -o /dev/null -w '%{http_code}\n' --max-time 20 https://subactor.com/ - | grep -E '^(200|301|302)$' - risk: low - - - id: eql_auth_bootstrap - action: ssh_cmd - description: "auth.subactor.com bootstrap is reachable (static, not full IdP)" - command: >- - curl -fsS -o /dev/null -w '%{http_code}\n' --max-time 20 https://auth.subactor.com/ - | grep -E '^(200|301|302)$' - risk: low - - - id: eql_sub_actor - action: ssh_cmd - description: "sub.actor responds (live path may still be Plesk httpdocs)" - command: >- - curl -fsS -o /dev/null -w '%{http_code}\n' --max-time 20 https://sub.actor/ - | grep -E '^(200|301|302|401|403)$' - risk: low - -notes: - - "SSOT bindings: subactor/platform/config/deployment-bindings/registry.v1.json" - - "auth.subactor.com is informational bootstrap — not production OIDC yet" - - "Prefer --plan-only until hosts are intentionally set for dry-run" diff --git a/examples/subactor/01-plesk-edge-verify/redeploy.yaml b/examples/subactor/01-plesk-edge-verify/redeploy.yaml deleted file mode 100644 index 87ccc4b..0000000 --- a/examples/subactor/01-plesk-edge-verify/redeploy.yaml +++ /dev/null @@ -1,5 +0,0 @@ -spec: migration.yaml -host: operator@localhost -app: subactor-edge -domain: subactor.com -remote_dir: /tmp/subactor-redeploy-noop diff --git a/examples/subactor/02-founder-origin-verify/migration.yaml b/examples/subactor/02-founder-origin-verify/migration.yaml deleted file mode 100644 index 3387a70..0000000 --- a/examples/subactor/02-founder-origin-verify/migration.yaml +++ /dev/null @@ -1,67 +0,0 @@ -# 02 — Founder public origin verify -# Usage: redeploy run examples/subactor/02-founder-origin-verify/migration.yaml --plan-only -# -# Architecture (live 2026-08-15): -# Internet → founder.subactor.com (Plesk TLS + Node) -# → 127.0.0.1:19081 ← SSH -R from Lenovo -# → Caddy :18081 → hr-control - -name: "subactor founder.subactor.com origin verify" -description: >- - Read-only EQL for Founder public origin. Does not restart the tunnel unit. - -source: - strategy: docker_full - host: "operator@LENOVO_LAB" - app: founder-origin - version: "live" - domain: founder.subactor.com - remote_dir: /tmp/subactor-redeploy-noop - -target: - strategy: docker_full - host: "operator@LENOVO_LAB" - app: founder-origin - version: "live" - domain: founder.subactor.com - remote_dir: /tmp/subactor-redeploy-noop - verify_url: https://founder.subactor.com/__origin_health - verify_version: "live" - -extra_steps: - - id: eql_founder_root_unauthorized - action: ssh_cmd - description: "GET / without credentials must be 401 Basic" - command: >- - code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 20 https://founder.subactor.com/); - test "$code" = "401" && echo founder-root-401-ok - risk: low - - - id: eql_founder_form - action: ssh_cmd - description: "GET /founder/form returns Founder HTML" - command: >- - curl -fsS --max-time 20 https://founder.subactor.com/founder/form - | grep -q 'Subactor' && echo founder-form-ok - risk: low - - - id: eql_origin_health - action: ssh_cmd - description: "Origin health JSON endpoint" - command: >- - curl -fsS --max-time 20 https://founder.subactor.com/__origin_health - | grep -qi . && echo origin-health-ok - risk: low - - - id: hint_tunnel_unit - action: ssh_cmd - description: "Remind operator to check user systemd tunnel on Lenovo" - command: >- - echo "Check: systemctl --user status founder-plesk-tunnel.service"; - echo "Script: platform/scripts/founder-plesk-tunnel.sh" - risk: low - -notes: - - "Project docs: subactor/projekty/founder-subactor-com/README.md" - - "Without tunnel, proxied paths return 502" - - "Target cutover: https://control.sub.actor/founder after Docker VPS is live" diff --git a/examples/subactor/02-founder-origin-verify/redeploy.yaml b/examples/subactor/02-founder-origin-verify/redeploy.yaml deleted file mode 100644 index 82d794e..0000000 --- a/examples/subactor/02-founder-origin-verify/redeploy.yaml +++ /dev/null @@ -1,5 +0,0 @@ -spec: migration.yaml -host: operator@LENOVO_LAB -app: founder-origin -domain: founder.subactor.com -remote_dir: /tmp/subactor-redeploy-noop diff --git a/examples/subactor/03-docker-vps-platform/migration.yaml b/examples/subactor/03-docker-vps-platform/migration.yaml deleted file mode 100644 index dc7aff9..0000000 --- a/examples/subactor/03-docker-vps-platform/migration.yaml +++ /dev/null @@ -1,75 +0,0 @@ -# 03 — Docker VPS Platform + portal (documented target topology) -# Usage: -# export SUBACTOR_VPS_SSH=deploy@YOUR_IP -# # edit host below or substitute -# redeploy run examples/subactor/03-docker-vps-platform/migration.yaml --plan-only -# redeploy run examples/subactor/03-docker-vps-platform/migration.yaml --dry-run -# -# Canonical Subactor scripts (authority remains there): -# www-sub-actor/scripts/deploy-all.sh -# www-sub-actor/scripts/release.sh -# platform/scripts/deploy-stack.sh -# -# Preconditions: host fits subactor.host/production-server/v1; -# pinned components.lock; secrets on host; PORTAL_IMAGE=ghcr.io/...:sha-* - -name: "subactor docker VPS — platform + portal (pinned)" -description: >- - SSH surface for pinned deploy-all.sh. Placeholders only — set host and image - before dry-run/apply. - -source: - strategy: docker_full - host: "deploy@SUBACTOR_VPS_IP" - app: www-sub-actor - version: "sha-PREVIOUS" - domain: sub.actor - remote_dir: /opt/subactor - -target: - strategy: docker_full - host: "deploy@SUBACTOR_VPS_IP" - app: www-sub-actor - version: "sha-COMMIT" - domain: sub.actor - remote_dir: /opt/subactor - # compose_files / env_file live only on the VPS after sync-platform; - # keep them out of the example so `redeploy run --plan-only` lints cleanly. - verify_url: https://sub.actor/readyz - verify_version: "sha-COMMIT" - -extra_steps: - - id: forbid_plesk_compose_reminder - action: ssh_cmd - description: "Assert operator intent — Compose must not run inside shared Plesk" - command: >- - echo "POLICY: FORBID RUN_COMPOSE_STACK_INSIDE_PLESK"; - echo "POLICY: FORBID BIND_CONTROL_PORT_8181_PUBLIC"; - echo "Control only via https://control.sub.actor" - risk: low - insert_before: sync_env - - - id: deploy_all_pinned - action: ssh_cmd - description: "Run canonical deploy-all.sh with pinned portal image" - command: >- - test -n "${PORTAL_IMAGE:-}" || { echo "Set PORTAL_IMAGE=ghcr.io/subactor/www-sub-actor:sha-COMMIT"; exit 2; }; - cd /opt/subactor/www-sub-actor && - CONTAINER_ENGINE=docker PORTAL_IMAGE="$PORTAL_IMAGE" - ./scripts/deploy-all.sh docker "$PORTAL_IMAGE" - risk: high - timeout: 3600 - - - id: smoke_readyz - action: ssh_cmd - description: "Portal readyz" - command: >- - curl -fsS --max-time 30 https://sub.actor/readyz && echo readyz-ok - risk: low - rollback_on_failure: false - -notes: - - "Do not copy developer .env to production without audit" - - "GitHub release path: release.sh over SSH — secrets stay on host" - - "Backup Postgres, acme-data, Platform volumes before apply" - - "RPi5 is a different fleet device — never use this migration for full Platform on Pi" diff --git a/examples/subactor/03-docker-vps-platform/redeploy.yaml b/examples/subactor/03-docker-vps-platform/redeploy.yaml deleted file mode 100644 index 233bf30..0000000 --- a/examples/subactor/03-docker-vps-platform/redeploy.yaml +++ /dev/null @@ -1,5 +0,0 @@ -spec: migration.yaml -host: deploy@SUBACTOR_VPS_IP -app: www-sub-actor -domain: sub.actor -remote_dir: /opt/subactor diff --git a/examples/subactor/README.md b/examples/subactor/README.md index 364067e..768eeae 100644 --- a/examples/subactor/README.md +++ b/examples/subactor/README.md @@ -1,29 +1,8 @@ -# Subactor examples for `redeploy` +# Moved: Subactor examples -Operational package for Subactor edge + Docker VPS topology. +Subactor fleet + migration wrappers live in **`subactor/deployment`**: -Narrative: [`../../docs/subactor-deployment.md`](../../docs/subactor-deployment.md). +https://github.com/subactor/deployment/tree/main/redeploy -## Commands - -```bash -# From repo root -redeploy fleet --file examples/subactor/fleet.yaml - -redeploy run examples/subactor/01-plesk-edge-verify/migration.yaml --plan-only -redeploy run examples/subactor/02-founder-origin-verify/migration.yaml --plan-only -redeploy run examples/subactor/03-docker-vps-platform/migration.yaml --plan-only - -# After editing host placeholders: -redeploy run examples/subactor/03-docker-vps-platform/migration.yaml --dry-run -``` - -## What these examples do / do not do - -| Example | Does | Does not | -| --- | --- | --- | -| `01-plesk-edge-verify` | Document curl EQL for public pages | Mutate Plesk docroots | -| `02-founder-origin-verify` | Document Founder origin probes | Start/stop the SSH tunnel | -| `03-docker-vps-platform` | Wrap documented `deploy-all.sh` surface | Invent secrets or unpinned `main` | - -Publish to Plesk remains Subactor `plesk://` + deployment bindings. +This directory is intentionally empty of Subactor SSOT so operators are not +misled into treating `semcod/redeploy` as HOME for Subactor deployment. diff --git a/examples/subactor/fleet.yaml b/examples/subactor/fleet.yaml deleted file mode 100644 index ea9a8d6..0000000 --- a/examples/subactor/fleet.yaml +++ /dev/null @@ -1,77 +0,0 @@ -# Subactor fleet inventory (roles only — no secrets) -# Usage: redeploy fleet --file examples/subactor/fleet.yaml -# -# Replace ssh_host placeholders before targeting a live device. -# Plesk edge is verify-only from the operator workstation (ssh_host empty). - -devices: - - id: plesk-edge-subactor - name: "Plesk edge — *.subactor.com + current sub.actor publish" - arch: amd64 - strategy: docker_full - ssh_host: "" - remote_dir: "" - version: "edge-live" - domain: "subactor.com" - stage: prod - tags: [prod, plesk, edge, subactor, verify-only] - expectations: - - https_reachable - color: "#64748b" - notes: "Provider=plesk via Subactor deployment-bindings; redeploy does not SFTP here." - - - id: founder-origin-tunnel - name: "Founder public origin (Plesk Node + Lenovo tunnel)" - arch: amd64 - strategy: docker_full - ssh_host: "operator@LENOVO_LAB" - remote_dir: "" - version: "founder-live" - domain: "founder.subactor.com" - stage: prod - tags: [prod, founder, tunnel, subactor, verify-only] - expectations: - - ssh_reachable - - https_reachable - color: "#f59e0b" - notes: "systemd --user founder-plesk-tunnel.service on Lenovo." - - - id: docker-vps-platform - name: "Docker VPS — Platform + www-sub-actor (target topology)" - arch: amd64 - strategy: docker_full - ssh_host: "deploy@SUBACTOR_VPS_IP" - remote_dir: "/opt/subactor" - version: "sha-PINNED" - env_file: "envs/subactor-vps.env" - domain: "sub.actor" - compose_files: - - "src/platform/docker-compose.yml" - - "src/platform/docker-compose.production.yml" - apps: [platform, www-sub-actor] - stage: prod - tags: [prod, vps, docker, platform, portal, subactor] - expectations: - - has_docker - - has_docker_compose - - ssh_reachable - - https_reachable - - no_k3s - color: "#10b981" - notes: "FORBID shared Plesk Docker; Control only via control.sub.actor router." - - - id: rpi5-portal-edge - name: "RPi5 portal edge / lab (not full Platform)" - arch: arm64 - strategy: docker_full - ssh_host: "pi@RPI5_IP" - remote_dir: "/opt/www-sub-actor" - version: "sha-PINNED" - domain: "portal.edge.example" - stage: lab - tags: [lab, rpi5, arm64, portal, subactor] - expectations: - - has_docker - - ssh_reachable - color: "#3b82f6" - notes: "Policy subactor.host/rpi5/v1 — FORBID full Platform production."