sync dari sicabe-doc/deploy @ bc1a6e6

2026-10-11 13:59:47 +07:00
parent 4ca7a9a58e
commit cbabe96061
29 changed files with 1210 additions and 650 deletions
@@ -0,0 +1,62 @@
+# =============================================================================
+# cluster.p3.yml — Skenario P3: komponen EXISTING milik PIHAK LAIN (host/IP sendiri)
+#                 + DUA OpenLDAP independen (existing utk keycloak, cluster utk trino/starrocks).
+# -----------------------------------------------------------------------------
+# Kondisi client (nyata):
+#   - keycloak, minio, nessie  : EXISTING, dikelola pihak lain — masing-masing bisa di
+#                                host/IP SENDIRI (di sini ditandai `components.<c>.address`).
+#   - openldap                 : DUA instance independen (analog postgres):
+#                                  · sisi existing : openldap LOKAL (untuk Keycloak) — DI LUAR
+#                                    inventory ini (setup single-host existing; JANGAN set LDAP_URL).
+#                                  · cluster       : openldap di `control` (tier identity) →
+#                                    group-provider Trino/StarRocks.
+#   - postgres (utk keycloak/nessie): sisi existing, BUKAN milik cluster → tak di inventory.
+#   - postgres cluster         : milik sendiri di `state`.
+#
+# Perbedaan dari P1: di P1 identity (keycloak+openldap+nessie) ada di host existing; di P3
+# `keycloak`+`nessie` eksternal (per-host) sementara `openldap` ada di KEDUA sisi (independen).
+# Penanda eksternal kini `components.<c>.address` (tanpa entri host) → tak dijalankan cluster.
+#
+# SIMULASI: ketiga komponen existing boleh dijalankan di SATU host (docker compose +
+# network sendiri) → isi `address` sama (mis. 100.93.54.108). REAL: isi alamat berbeda.
+#
+# .env cluster — override `*_INTERNAL_PORT` HANYA untuk komponen EKSTERNAL:
+#   KEYCLOAK_INTERNAL_PORT=12080   MINIO_INTERNAL_PORT=12900   NESSIE_INTERNAL_PORT=12120
+# JANGAN override OPENLDAP_INTERNAL_PORT — openldap cluster LOKAL (di `control`), port 389.
+# (Plus: samakan secret existing — 5× *_CLIENT_SECRET, MINIO_ROOT_*; LDAP_ADMIN_PASSWORD
+#  per-sisi, TIDAK perlu disamakan.)
+#
+# Langkah lengkap simulasi: docs/sicabe-p3-simulation-runbook.md
+#
+# Verifikasi (tanpa akses admin): hanya memeriksa apakah keycloak/minio/nessie memenuhi
+# kebutuhan (issuer, TLS, S3, secret) — lihat docs/sicabe-p1-existing-runbook.md §7.
+# =============================================================================
+
+version: 1
+cluster:
+  name: sicabe-p3
+  env: simulation
+
+tls:
+  mode: none
+
+preset: a3
+
+hosts:
+  # control mengelola OPENLDAP cluster (tier identity) — keycloak/nessie di-override eksternal.
+  control:
+    address: 100.112.76.124
+    tiers: [identity, policy, pipeline, governance]
+  compute:
+    address: 100.123.123.71
+    tiers: [coord, engine]
+  state:
+    address: 100.73.229.107
+    tiers: [state]
+
+components:
+  # EXISTING (pihak lain) — TANPA host; endpoint = alamat ini di semua host.
+  keycloak:  { address: 100.93.54.108 }
+  minio:     { address: 100.93.54.108 }
+  nessie:    { address: 100.93.54.108 }
+  dremio:    { enabled: false }