Commit Graph

4 Commits

Author SHA1 Message Date
Maarten a526c4ea9f Add AWX showcase blueprints: webapp, staticsite, k3scluster
Three end-to-end blueprint examples demonstrating AWX configuring real
applications via Aether lifecycle hooks:

- webapp: nginx+PHP web tier + MariaDB with cross-instance service
  discovery, credential sharing, and OVN ACL management
- staticsite: horizontally scaled nginx with per-instance branding
- k3scluster: K3s control plane + workers with automatic token
  discovery and cluster join (fixes Incus files API symlink issue
  where node-token symlink returns target path instead of content)

Includes dispatcher playbooks, shared helpers (sibling discovery,
temporary internet NIC), decommission handlers, and deploy-awx
changes to push showcase playbooks and create AWX templates.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 15:16:49 +01:00
Maarten 0100182dd8 Validate AWX guide, document Aether API, enforce API-first policy
- AWX guide: fix wrong project ID (6→9), add dynamic ID lookups,
  add missing Step 5 push commands, add migration pod to expected
  output, replace PostgreSQL workaround with Aether UI instructions,
  reference deploy-awx as automated path
- Aether guide: document JWT REST API (auth, clusters, ACLs),
  swagger UI at /api/docs, rate limits, coverage vs UI-only features
- CLAUDE.md: add Aether API capability, add interaction hierarchy
  (API first → UI fallback → never root/DB in guides)
- deploy-awx: fix PLAYBOOK_DIR from "ansible/playbooks" to "playbooks"
- post-deploy.yml: clarify cert push path vs EE runtime mount path

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-24 10:33:46 +01:00
Maarten 0b82b9ce3b Validate AWX guide against real infrastructure, fix all bugs
End-to-end tested: Aether deploy triggers AWX post-deploy job,
container gets configured (hostname, packages, timezone, deploy-info),
decommission job runs on delete. All playbooks validated working.

Key fixes from testing:
- Playbooks: use Incus REST API (not SSH) — bridge subnet not routable
  from management VLAN, nftables blocks inbound forwarding
- Aether vars: ffsdn_* prefix (not vm_name/vm_ip/environment/owner)
- AWX EE paths: /runner/project/ (not /var/lib/awx/projects/)
- AWX access: NodePort 30080 (not Traefik ingress — 404 for IP access)
- deploy-awx: systemd-networkd (not netplan), manual project (not git
  SCM — EE can't reach private repo), Incus cert push, prereq install
- Remove unused base-config role (tasks inlined as setup script)
- Simplify ansible.cfg (no SSH settings needed)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-24 01:53:54 +01:00
Maarten 6a74925fc4 WIP: Add AWX deployment, Ansible playbooks, and Aether integration
Work-in-progress commit to enable AWX project sync from git.
Files will be updated with validated output from real deployment.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-24 00:04:28 +01:00