Ilia Denisov
f5f45e7afb
Idempotent playbooks under deploy/ansible/ prepare both production hosts: docker-ce + compose plugin, a non-sudo deploy service account holding the CI deploy key, key-only sshd, default-deny ufw, fail2ban, unattended upgrades and chrony. The main host also opens 80/443/9443 and creates the external edge network; the tg host verifies direct Bot API egress (the no-VPN assumption). The application is deployed separately by the prod-deploy workflow (later phase), running as the deploy account this playbook provisions.
20 lines
460 B
INI
20 lines
460 B
INI
# Production inventory for Stage 18.
|
|
#
|
|
# Hosts resolve through the operator's ~/.ssh/config aliases, so HostName (public
|
|
# IP), User and IdentityFile live there — no IPs or key paths are committed here.
|
|
# scrabble-main-ops -> main stack host (public IP, domain erudit-game.ru)
|
|
# scrabble-tg-ops -> Telegram bot host (direct Bot API egress, no VPN)
|
|
|
|
[main]
|
|
scrabble-main-ops
|
|
|
|
[tg]
|
|
scrabble-tg-ops
|
|
|
|
[prod:children]
|
|
main
|
|
tg
|
|
|
|
[prod:vars]
|
|
ansible_user=root
|