protuberanets
f436b2528c
Two nodes on exch and one on infra-gamma, plain Compose per server, ports on the private addresses only. Nodes unseal through the transit seal on the platform Vault; the transit token reaches only the server process. make prod-images resolves the latest stable Vault release once and pins its digest in ignored .local/prod/images.env, so every node runs the same build. infra/prod/README.md records the layout, the first rollout, node replacement and recovery when the platform Vault is lost (#74).
17 lines
762 B
Bash
17 lines
762 B
Bash
#!/bin/sh
|
|
set -eu
|
|
set -o pipefail
|
|
. infra/local/scripts/common.sh
|
|
. infra/local/scripts/secrets.sh
|
|
case "${1:-}" in
|
|
images) . infra/local/scripts/images.sh; images;;
|
|
prod-images) TOOL_STATE="$PWD/.local"; . infra/local/scripts/images.sh; prod_images;;
|
|
up) . infra/local/scripts/bootstrap.sh; up;;
|
|
email) . infra/local/scripts/bootstrap.sh; email;;
|
|
sendico) . infra/local/scripts/bootstrap.sh; . infra/local/scripts/sendico.sh; configure_sendico;;
|
|
verify|verify-infra) . infra/local/scripts/verify.sh; existing; infrastructure; if [ "$1" = verify ]; then product; fi;;
|
|
rotation) . infra/local/scripts/verify.sh; . infra/local/scripts/rotation.sh; existing; rotation;;
|
|
test) sh infra/local/scripts/test.sh;;
|
|
*) fail 'Unknown local tooling command';;
|
|
esac
|