init rig

rig/ctrl/env.d/client.env

@@ -0,0 +1,30 @@
+# client — the regulated-estate shape. Multi-node so taints, affinity and
+# topology are real; apiserver audit on; images through a pull-through cache of
+# the corporate registry.
+#
+# Costs roughly 4-6 GB. Check `make cluster list` before starting this alongside
+# other work — see the memory note in the README.
+
+PROFILE_NAME=client
+K8S_VERSION=v1_36
+KIND_CONFIG=kind-config.client.yaml.tpl
+ADDONS="metallb cert-manager metrics-server"
+REGISTRY_MODE=mirror
+INGRESS_MODE=hostport
+DNS_MODE=hosts
+
+# Ports derive from the directory name by default (see ctrl/ports.sh), so
+# several environments run side by side.
+#
+# Opt in to the real ports below only when this is the ONLY environment and
+# nothing else owns :80. They fail to bind otherwise, and docker reports it as an
+# opaque "failed to bind host port 0.0.0.0:80/tcp: address already in use"
+# halfway through cluster creation. `make station` checks before you spend the
+# time. Uncommenting also means only one environment can exist at a time.
+# HTTP_PORT=80
+# HTTPS_PORT=443
+
+# Set these in ctrl/.env (gitignored), not here:
+#   REGISTRY_REMOTE_URL=https://artifactory.corp.example/artifactory/api/docker/docker-virtual
+#   REGISTRY_USER / REGISTRY_PASSWORD
+#   REGISTRY_CA_FILE=/path/to/corp-root-ca.crt

rig/ctrl/env.d/data.env

@@ -0,0 +1,42 @@
+# data — a cluster with the dependency containers a soleprint room asks for.
+#
+# The point of this profile is that a room declares what it needs once, in
+# cfg/<room>/data/cabinets.json, and gets it on either target: `build.py`
+# composes those services into docker-compose.yml for a laptop, and the addons
+# below install the same ones here. The names match deliberately —
+# soleprint/station/cabinets/<name>/cabinet.json carries a `rig_addon` field
+# pointing at ctrl/addons/<name>.sh.
+#
+# Everything lands in the `data` namespace (DATA_NAMESPACE to move it), so
+# `make cluster reset` on the app namespace leaves the databases alone.
+#
+# Costs roughly 2-3 GB with airflow, under 1 without. Airflow's first boot runs
+# the whole metadata migration, so expect a few minutes before it is ready.
+
+PROFILE_NAME=data
+K8S_VERSION=v1_36
+KIND_CONFIG=kind-config.yaml.tpl
+# Order matters: addons.sh installs in the order listed, and airflow refuses to
+# start without a metadata database, so postgres comes first.
+ADDONS="metallb postgres redis airflow"
+# local, not none — see minimal.env: `none` has no outward-push guard.
+REGISTRY_MODE=local
+INGRESS_MODE=hostport
+DNS_MODE=hosts
+
+# Namespace for the dependency containers.
+DATA_NAMESPACE=data
+
+# Postgres identity. The password is not here: postgres.sh generates one on
+# first install and keeps it across re-runs, so re-running the addon never
+# rotates the credential out from under whatever is already connected.
+POSTGRES_DB=soleprint
+POSTGRES_USER=soleprint
+POSTGRES_STORAGE=2Gi
+
+AIRFLOW_ADMIN_USER=admin
+
+# Ports derive from the directory name by default — see ctrl/ports.sh. Reach
+# the databases with port-forward rather than binding more host ports:
+#   kubectl -n data port-forward svc/postgres 5432:5432
+#   kubectl -n data port-forward svc/airflow 8080:8080

rig/ctrl/env.d/minimal.env

@@ -0,0 +1,21 @@
+# minimal — the default. One node, no addons, no registry.
+# Assumes nothing and boots fast. Start here; move to client.env when you need
+# the regulated behaviours.
+#
+
+PROFILE_NAME=minimal
+K8S_VERSION=v1_36
+KIND_CONFIG=kind-config.yaml.tpl
+ADDONS=""
+# local, not none: `none` leaves the cluster with no registry to push to, and an
+# unqualified image name then means docker.io/library/<name>. In a regulated
+# estate that is a disclosure risk, not a convenience trade — so the default
+# carries the guard even though it costs one container.
+REGISTRY_MODE=local
+INGRESS_MODE=hostport
+DNS_MODE=hosts
+
+# Ports are deliberately NOT set here. They derive from the directory name so
+# several environments coexist — see ctrl/ports.sh, and `make ports` to see the
+# block this one gets. A fixed default here would collide with whatever else the
+# machine happens to be running; 8080 in particular is rarely free.

rig/ctrl/env.d/offline.env

@@ -0,0 +1,18 @@
+# offline — air-gapped. Everything comes from a local registry that was loaded
+# ahead of time; nothing reaches the internet. Pair with the wizard-full image
+# (DEPS_SOURCE=baked) so the toolchain install is offline too.
+#
+# The heavier addons are left out to keep first boot viable.
+
+PROFILE_NAME=offline
+K8S_VERSION=v1_36
+KIND_CONFIG=kind-config.audit.yaml.tpl
+ADDONS="metallb"
+REGISTRY_MODE=local
+INGRESS_MODE=hostport
+DNS_MODE=hosts
+
+# Derived from the directory name by default — see ctrl/ports.sh.
+# Uncomment for the real ports, but only if this is the only environment.
+# HTTP_PORT=80
+# HTTPS_PORT=443