0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5 c55f508e05 feat(readme): draw mandatory and disabled service relations

The cosmos generator linked a consumer to its provider only through an
'<role>' in group_names reference or an explicit provides: name. A hard
dependency has neither -- pinning the provider on unconditionally is
exactly what removes the Jinja reference the generator was reading -- so
web-svc-asset's bond to web-svc-file vanished from the diagram the moment
it became binding. Match a service key against the provider's own primary
key from the registry, in both directions.

Services the role turns off drew a solid 1:1 edge, claiming a mandatory
relationship for something that carries nothing at deploy time. They now
render as a red 0..0 edge; edge merging gained a real precedence so a
provider consumed through two keys stays live when only one is off.

Named colour, not hex: a '#' opens an entity code in the mermaid lexer and
turns the whole diagram into a parse error on GitHub.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-17 18:02:31 +02:00

2.5 KiB

Raw Permalink Blame History

sys-ca-selfsigned

Description

Creates (once) a local Root CA (self-signed) for the Infinito.Nexus environment.

This role provisions:

Root CA private key: {{ CA_ROOT.key_host }}
Root CA certificate: {{ CA_ROOT.cert_host }}

The generated Root CA certificate can be injected into containers (e.g. via sys-svc-compose-ca) so that containers trust your internal TLS endpoints.

Overview

This role provisions a local Root CA (self-signed, CA:TRUE) for trusting internal TLS endpoints. Produces /etc/infinito.nexus/ca/root-ca.crt for sys-svc-compose-ca injection.

Cosmos

The diagram places sys-ca-selfsigned in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).

flowchart LR
    subgraph role [sys-ca-selfsigned 💻]
        svc_ca_selfsigned["ca-selfsigned"]
    end

Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.

Features

Automated provisioning: Configured by Ansible without manual steps.

Outputs

CA_ROOT.cert_host (default: /etc/infinito.nexus/ca/root-ca.crt)
CA_ROOT.key_host (default: /etc/infinito.nexus/ca/root-ca.key)

Inputs

CA_ROOT (mapping)
- base_dir (string): base directory for CA files
- cert_host (string): host path to Root CA certificate
- key_host (string): host path to Root CA private key
- openssl_conf_host (string): host path for generated openssl.cnf
- days (int): certificate validity
- key_bits (int): RSA key size
- subject (mapping): DN fields (C/O/OU/CN)
- force_regen (bool): if true, remove and regenerate key/cert

Notes

The Root CA private key is generated unencrypted (automation-friendly). Protect file permissions.
This role does not sign leaf certificates. It only provisions the Root CA.

Credits

Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).

2.5 KiB Raw Permalink Blame History