Run from the jump host: on each validator it updates the git clone in
/opt/cloud-ip-validator, builds the image there, stops and removes the
current container and starts a new one from the new image. Run
parameters live in an env file (deploy/ansible/env/validator-agent.env,
git-ignored, template committed).
The image is built before the running container is touched, so a failed
build leaves the old container running. Hosts are updated in waves
(1, 4, rest) and any failure stops the run. validator_id comes from the
inventory and is checked against the running container before it is
replaced. Only ansible.builtin modules are used, so the validators need
no extra packages.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
control-api.yaml is the actual bootstrap config the rxprod-compose stack's
control-api container mounts (per its docker-compose.yml), previously
undocumented/uncommitted — credentials stay out of it entirely (only the
env var names to read them from, per its own header comment).
.gitignore now also excludes rxprod-compose/capi-db/ (the stack's live
SQLite database — runtime state, not source) and graphify-out/ (this
session's /graphify knowledge-graph output — regenerable, not source).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The existing deploy/docker/docker-compose.yml (+ override/prod, Compose
profiles) is flexible but requires understanding profiles and file
layering. For a server that only ever runs these three fixed roles
against a real OpenStack (VK Cloud) deployment, rxprod-compose/ adds a
single flat docker-compose.yml with no profiles — control-api,
admin-dashboard and prober wired together directly, both ports published
on the host (control-api needs to be reachable by validator-agent running
separately on real cloud VMs). OpenStack credentials and the prober's
site_id come from a local .env (gitignored; .env.example is the
template).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NeVbMVEiE7XQAkBd7HQgj6
control-api was the only component deployable via a bare Dockerfile alone
(no entrypoint/template, no default mountable config), and there was no
compose file wiring the four services' network, healthcheck ordering, or
DB volume together. Adds a base docker-compose.yml plus dev (override,
auto-loaded) and prod overlays, split by Compose profiles matching the
real deployment topology (control-plane/dashboard/prober/validator), a
ready-to-copy mock config for control-api so `docker compose up` works
out of the box, and the repo's first .gitignore for the local env/config
copies developers create from the committed examples.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NeVbMVEiE7XQAkBd7HQgj6
ayurishchevandClaude Sonnet 5.5