2026-10-09 02:35:14 +07:00
|
|
|
# =============================================================================
|
|
|
|
|
# cluster.example.yml — inventory multi-host SiCABE (CONTOH; salin ke cluster.yml)
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
|
|
|
# Fase 1 R10 §4.3/§4.5 + taksonomi 7-tier R11.
|
|
|
|
|
#
|
|
|
|
|
# CARA PAKAI
|
|
|
|
|
# cp cluster.example.yml cluster.yml # lalu sesuaikan address
|
|
|
|
|
# ./install.sh --generate # hasil ke generated/host-<x>/
|
|
|
|
|
#
|
|
|
|
|
# Penting: berkas `cluster.yml` bersifat OPSIONAL. Bila TIDAK ADA, installer
|
|
|
|
|
# berjalan seperti sekarang (single-host) — `docker-compose.yml` dipakai langsung
|
|
|
|
|
# dan tidak ada berkas di `generated/` yang dibuat.
|
|
|
|
|
#
|
|
|
|
|
# PRECEDENCE (tertinggi → terendah)
|
|
|
|
|
# 1. components.<nama>.host (override eksplisit)
|
|
|
|
|
# 2. hosts.<host>.tiers (tier → host)
|
|
|
|
|
# 3. preset (a3 | b5) — hanya mengisi default tiers
|
|
|
|
|
# =============================================================================
|
|
|
|
|
|
|
|
|
|
version: 1
|
|
|
|
|
cluster:
|
|
|
|
|
name: sicabe-prod
|
|
|
|
|
env: production
|
|
|
|
|
# domain = basis nama BROWSER-FACING (lihat blok `tls` di bawah). Isi nama domain
|
|
|
|
|
# saja — tanpa skema, tanpa garis miring. Untuk mode `none` nilainya tidak dipakai.
|
|
|
|
|
domain: sicabe.com
|
|
|
|
|
|
|
|
|
|
# ─── TLS (langkah 1: baru SKEMA; Traefik + sertifikat menyusul di step 2) ─────
|
|
|
|
|
# none (DEFAULT) — perilaku sekarang: http, IP + port 12xxx. Bidang internal
|
|
|
|
|
# plaintext. Cocok untuk lab/uji tertutup.
|
|
|
|
|
# edge — browser memakai https://<nama>.<domain> lewat ingress;
|
|
|
|
|
# bidang internal (container↔container) TETAP plaintext.
|
|
|
|
|
# Pilihan paling murah untuk pilot: satu sertifikat wildcard,
|
|
|
|
|
# dan naik ke `full` nanti TIDAK mengubah URL/issuer.
|
|
|
|
|
# full — seluruh segmen TLS (butuh kepercayaan CA di semua klien).
|
|
|
|
|
# tls:
|
|
|
|
|
# mode: edge # contoh: aktifkan ingress berbasis nama
|
|
|
|
|
tls:
|
|
|
|
|
mode: none
|
|
|
|
|
|
|
|
|
|
# a3 = 3 host (default) · b5 = 5 host (coord terpisah + 2 engine)
|
|
|
|
|
preset: a3
|
|
|
|
|
|
|
|
|
|
hosts:
|
|
|
|
|
control:
|
|
|
|
|
address: 10.20.0.10
|
|
|
|
|
# tier = kelompok peran (R11 §3.1). Preset a3 sudah mengisi ini; ditulis
|
|
|
|
|
# eksplisit agar terbaca. `control` mengelompokkan komponen ringan.
|
|
|
|
|
tiers: [identity, policy, pipeline, governance]
|
|
|
|
|
compute:
|
|
|
|
|
address: 10.20.0.11
|
|
|
|
|
# coord = trino-coordinator + starrocks-fe · engine = trino-worker + starrocks-cn
|
|
|
|
|
tiers: [coord, engine]
|
|
|
|
|
state:
|
|
|
|
|
address: 10.20.0.12
|
|
|
|
|
# state WAJIB tepat satu host dan tidak boleh digabung dengan `engine`.
|
|
|
|
|
# Berisi: postgres, minio (+minio-init), openmetadata-opensearch.
|
|
|
|
|
tiers: [state]
|
|
|
|
|
|
|
|
|
|
components:
|
|
|
|
|
# Override penempatan per komponen (prioritas tertinggi). Contoh: pindahkan
|
|
|
|
|
# StarRocks FE ke host control bila compute sudah terlalu padat.
|
|
|
|
|
# starrocks-fe: { host: control }
|
|
|
|
|
|
2026-10-11 18:13:03 +07:00
|
|
|
# ── Komponen EKSTERNAL (dikelola sistem lain) ───────────────────────────────
|
|
|
|
|
# Tandai dengan `address` — maka komponen TIDAK dijalankan di cluster ini dan
|
|
|
|
|
# koneksi diarahkan ke alamat itu. Host = alamat IP/hostname biasa:
|
|
|
|
|
# keycloak: { address: 100.93.54.108 }
|
|
|
|
|
# URL boleh berupa **URL PENUH** (skema + host + port). Skema & port dihormati
|
|
|
|
|
# apa adanya (port default per skema, mis. https→443, boleh dihilangkan):
|
|
|
|
|
# keycloak: { address: https://sso.example.com }
|
|
|
|
|
# minio: { address: https://minio.corp:9000 }
|
|
|
|
|
# nessie: { address: https://nessie.corp }
|
|
|
|
|
# openldap: { address: ldaps://ldap.corp:636 }
|
|
|
|
|
# opa: { address: https://opa.corp }
|
|
|
|
|
# Efek URL penuh: `*_HOST` = host saja; `*_URL`/`*_PUBLIC_URL` = URL itu;
|
|
|
|
|
# server→server OIDC diarahkan lewat KEYCLOAK_INTERNAL_URL (Trino/Grafana);
|
|
|
|
|
# `https://…` ⇒ KEYCLOAK_SSL_REQUIRED=external. `host` dan `address` tak boleh
|
|
|
|
|
# bersamaan (host = dijalankan cluster; address = dikelola pihak lain).
|
|
|
|
|
|
2026-10-09 02:35:14 +07:00
|
|
|
# Dremio default NONAKTIF. Bila diaktifkan: taruh di host bertier `engine`
|
|
|
|
|
# (butuh RAM ~4 GB lebih — cek kapasitas host).
|
|
|
|
|
dremio: { enabled: false }
|
|
|
|
|
|
|
|
|
|
# Contoh blueprint b5 (5 host): hapus komentar dan GANTI `preset` di atas.
|
|
|
|
|
# preset: b5
|
|
|
|
|
# hosts:
|
|
|
|
|
# control: { address: 10.20.0.10, tiers: [identity, policy, pipeline, governance] }
|
|
|
|
|
# coord: { address: 10.20.0.11, tiers: [coord] }
|
|
|
|
|
# engine-1: { address: 10.20.0.12, tiers: [engine] }
|
|
|
|
|
# engine-2: { address: 10.20.0.13, tiers: [engine] }
|
|
|
|
|
# state: { address: 10.20.0.14, tiers: [state] }
|
|
|
|
|
# Catatan b5: dua host `engine` menjalankan service `trino-worker` dan
|
|
|
|
|
# `starrocks-cn` masing-masing satu — jadi tiap host engine punya node sendiri.
|
