diff --git a/AGENTS.md b/AGENTS.md index 340306a..99761d9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -225,6 +225,41 @@ scheduled retention prune and monthly scrub remain runtime checks. after the storage and backup layers are validated; do not make either a dependency of the Atlas baseline. +## Cerberus Management Node (Deferred) +`cerberus` is postponed until the office in the new house is physically set up. It is not an inventory +host and this section is a design and implementation backlog, not authorization to provision it early. + +The planned node is a Lenovo ThinkCentre M700 Tiny with an Intel Core i3-6100T, 8 GB RAM, a 256 GB SSD, +and native 1 Gbps Ethernet. It will connect to a multi-input KVM switch using a passive DisplayPort-to-HDMI +cable, sharing the monitor and peripherals with Ikaros. Fedora Sericea (immutable Fedora with the Sway +Wayland compositor) is the intended OS. Cerberus is an isolated management plane: a dedicated Toolbox +environment will run Ansible for future `uranus` cluster provisioning. Rootless Podman will host Grafana, +Prometheus, and Loki. The 256 GB local SSD is the hot tier retaining metrics and logs for 30 days; scheduled, +validated exports of older historical data will use a dedicated Atlas NFS dataset as cold storage. + +### Implementation plan +- [ ] Confirm the office, KVM switch, passive DisplayPort-to-HDMI path, shared monitor/peripherals, and native + 1 Gbps Ethernet are physically operational before adding Cerberus to inventory. +- [ ] Install and update Fedora Sericea with Sway; document the immutable-host lifecycle and keep host changes + declarative rather than treating the base OS as a mutable workstation. +- [ ] Model Cerberus as its own host with independent platform, role, desktop, network, and storage inputs; + do not repurpose Ikaros variables or make it a Uranus cluster member. +- [ ] Provision an isolated Toolbox-based Ansible controller with the required collections and a reproducible + project checkout; define its least-privilege SSH access, known-host handling, and Vault workflow without + storing secrets in the image or repository. +- [ ] Define the explicit Uranus provisioning workflow from Cerberus, including inventory boundaries, + validation-only runs, and separate approval for any destructive cluster operation. +- [ ] Design rootless Podman/Quadlet services for Grafana, Prometheus, and Loki, including persistent local + state, service ownership, LAN exposure/authentication, resource limits, updates, and backups. +- [ ] Size and enforce a 30-day local hot-retention policy for metrics and logs on the 256 GB SSD; validate + actual disk growth and alert before capacity exhaustion. +- [ ] Create and validate a dedicated Atlas NFS cold-storage dataset and least-privilege export for Cerberus; + do not use a broad existing share or couple it to unrelated Atlas application state. +- [ ] Implement scheduled, idempotent exports of data older than 30 days to the Atlas NFS cold tier, with + locking, capacity checks, integrity verification, retention rules, failure monitoring, and a tested restore. +- [ ] Validate management-plane recovery: rebuild Cerberus, restore observability history from Atlas, and + confirm that Uranus provisioning can resume without depending on unreproducible local state. + ## Coding Agent Notes - Shared agent definitions and lifecycle flags live in `ai_agents` in `ansible/inventory/group_vars/all.yml`. - Shared agent dotfiles live in `ai_agents_dotfiles`; rendered configs live in `ai_agents_templates`. diff --git a/README.it.md b/README.it.md index 1022b4f..806be92 100644 --- a/README.it.md +++ b/README.it.md @@ -95,6 +95,27 @@ Nota sullo stato attuale del playbook principale: - `ansible/site.yml` applica il profilo server Rocky a `prometheus` con DNF, systemd, dotfiles server e firewalld - `ansible/site.yml` applica il profilo NAS Rocky su `atlas` tramite SSH remoto +## Nodo pianificato e posticipato: Cerberus + +`cerberus` e un nodo di management **posticipato**, in attesa dell'allestimento +fisico dell'ufficio nella nuova casa. Non e ancora presente nell'inventory e non +esistono ruoli o playbook che lo prendano come target. + +L'hardware previsto e un Lenovo ThinkCentre M700 Tiny (Intel Core i3-6100T, +8 GB di RAM e SSD da 256 GB) con Ethernet nativa a 1 Gbps. Condividera monitor +e periferiche di Ikaros tramite uno switch KVM a ingressi multipli, usando un +cavo passivo DisplayPort-HDMI per il collegamento video. Il sistema operativo +previsto e Fedora Sericea, la variante Fedora immutabile con compositor Wayland +Sway. + +Cerberus sara un management plane isolato: Ansible verra eseguito in un ambiente +Toolbox dedicato per il provisioning del futuro cluster `uranus`, anziche da +Ikaros o da un host non gestito. Lo stack di osservabilita rootless Podman +eseguira Grafana, Prometheus e Loki. L'SSD locale sara l'hot storage, con +metriche e log conservati per 30 giorni; esportazioni programmate trasferiranno +i dati storici piu vecchi su un dataset Atlas montato via NFS come cold storage. +Il piano di implementazione, con prerequisiti espliciti, e in `AGENTS.md`. + ## Desktop Target operativi: diff --git a/README.md b/README.md index a4f6ead..32e07c3 100644 --- a/README.md +++ b/README.md @@ -67,6 +67,27 @@ The official ChatGPT desktop RPM is enabled only on `ikaros` and `nymph`. The playbook configures OpenAI's signed RPM repository and imports its pinned RPM signing key before installation; subsequent updates are handled by DNF. +## Deferred planned node: Cerberus + +`cerberus` is a **postponed** management-plane node, pending the physical setup +of the office in the new house. It is not yet an inventory host and no role or +playbook targets it. + +The planned hardware is a Lenovo ThinkCentre M700 Tiny (Intel Core i3-6100T, +8 GB RAM, and a 256 GB SSD) with native 1 Gbps Ethernet. It will share Ikaros' +monitor and peripherals through a multi-input KVM switch, using a passive +DisplayPort-to-HDMI cable for its video connection. Fedora Sericea, the +immutable Fedora variant with the Sway Wayland compositor, is the intended +operating system. + +Cerberus will be an isolated management plane: Ansible will run from a +dedicated Toolbox environment to provision the future `uranus` cluster, rather +than from Ikaros or an unmanaged host. Its rootless Podman observability stack +will run Grafana, Prometheus, and Loki. The local SSD is the hot tier and +retains metrics and logs for 30 days; scheduled exports will place older +historical data on an NFS-mounted Atlas dataset as the cold tier. The detailed, +implementation-gated plan is maintained in `AGENTS.md`. + ## Desktop profiles - `ikaros`: stable Fedora Workstation + GNOME desktop.