feat(ansible): decdn_origin_nodes and the node.yml / publisher.yml entry points

[thiras]

Summary

Stacked on #130. Merge that first; this PR's base then moves to main.

deCDN has two kinds of operators: node operators, who run nodes, and publishers, who run origin nodes and the services around them. This PR gives each its own entry point:

Playbook	Make target	Runs
node.yml (new)	make deploy-node	cache nodes: decdn_nodes:!decdn_origin_nodes
publisher.yml (new)	make deploy-publisher	origin.yml → sponsord.yml → iroh_relay.yml → iroh_dns_server.yml
origin.yml (new)	make deploy-origin	decdn_origin_nodes
site.yml	make deploy (unchanged)	node.yml then publisher.yml

• decdn_origin_nodes is a child of decdn_nodes. Origins therefore keep the node's udp/4433 hole, backup, decommission, relay allowlist and Alloy scrape. Each node is deployed once under site.yml.
  • origin.yml's pre_tasks refuse an origin outside decdn_nodes or without an origin backend.
  • node.yml warns about a backend on a host outside the group.
  • The group checks live in the playbooks, not the role, like sponsord.yml's.
• baseline-plays.awk now counts a play for the positive terms of its host pattern only. Without that, cloud-init's baseline guard would see no decdn_nodes play.
• Inventory examples. hosts.yml.example splits into hosts-node.yml.example (decdn-node-1, now a pure cache) and hosts-publisher.yml.example (origin-1 plus the sponsord, relay and DNS blocks). New files: inventory/group_vars/decdn_origin_nodes.yml, host_vars/origin-1/, and playbooks/group_vars/decdn_origin_nodes.yml.
• Doc correction. The decdn_node docs and assert message no longer say "a serving node needs an origin". ADR 001 has origin-backed nodes and pure caches. The role already derives node-to-node pull-through for a node without an origin.

Test plan

• make test-scripts. New cases:
  • the Makefile guards for check/deploy-{node,origin,publisher};
  • the origin guards (accepts decdn_cache_origin_kind or decdn_cache_origins; refuses an orphan or a missing backend);
  • node.yml's warning, and that its play skips origins;
  • the firewall holes for three origin shapes;
  • baseline-plays.awk fixtures with an exclusion pattern;
  • the baseline contract over node.yml, origin.yml and sponsord.yml.
• make lint, make lint-ansible
• make molecule SCENARIOS='cloud-init cloud-init-sponsord' (real boots through the new site.yml)

Downstream (internal-devops)

Re-sync:

• playbooks/{node,origin,publisher,site}.yml and playbooks/group_vars/{all,decdn_origin_nodes}.yml;
• the ansible/Makefile targets and their guard lists;
• cloud-init/baseline-plays.awk.

Then move origin-configured hosts under decdn_origin_nodes. Until then node.yml warns about them and publisher.yml skips them.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The publisher option in both setup guides still leads into commands hard-coded for the node-only inventory.

2 open findings

• Publisher alternative uses inconsistent host names · New
• Inventory-secret commands target a nonexistent host file · New

What changed in this PR

Adds distinct Ansible entry points for cache-node operators and publishers while preserving shared deployment behavior.

Changes:

• Adds node.yml, origin.yml, and publisher.yml with matching Make targets.
• Introduces origin inventory groups, examples, and documentation.
• Extends baseline, firewall, and playbook-guard tests.

File	Description
tests/​scripts-test.sh	Tests new entry points and origin guards.
README.md	Updates Ansible quickstart.
docs/​requirements.md	Updates inventory reference.
cloud-init/​baseline-plays.awk	Handles excluded host-pattern terms.
ansible/​tests/​playbook-guards/​inventory.yml	Adds origin guard fixtures.
ansible/​tests/​firewall-holes/​inventory.yml	Adds origin host shapes.
ansible/​tests/​firewall-holes/​expected.json	Defines expected origin firewall holes.
ansible/​tests/​firewall-holes/​check.sh	Documents origin firewall coverage.
ansible/​roles/​decdn_node/​tasks/​main.yml	Corrects cache-origin messaging.
ansible/​roles/​decdn_node/​README.md	Documents cache and origin behavior.
ansible/​roles/​decdn_node/​defaults/​main.yml	Clarifies origin defaults.
ansible/​roles/​baseline/​README.md	Updates inventory reference.
ansible/​README.md	Documents persona entry points.
ansible/​playbooks/​site.yml	Composes node and publisher playbooks.
ansible/​playbooks/​publisher.yml	Adds publisher orchestration.
ansible/​playbooks/​origin.yml	Adds guarded origin deployment.
ansible/​playbooks/​node.yml	Adds cache-node deployment.
ansible/​playbooks/​group_vars/​decdn_origin_nodes.yml	Applies shared firewall rules to origins.
ansible/​playbooks/​group_vars/​all.yml	Documents origin firewall inheritance.
ansible/​Makefile	Adds persona deployment targets.
ansible/​inventory/​hosts-publisher.yml.example	Adds publisher inventory template.
ansible/​inventory/​hosts-node.yml.example	Narrows node inventory template.
ansible/​inventory/​host_vars/​origin-1/​secret.yml.example	Adds origin secret template.
ansible/​inventory/​host_vars/​origin-1/​main.yml	Adds origin host configuration.
ansible/​inventory/​host_vars/​decdn-node-1/​main.yml	Converts example to a pure cache.
ansible/​inventory/​group_vars/​iroh_relay_hosts.yml	Updates publisher inventory reference.
ansible/​inventory/​group_vars/​iroh_dns_server_hosts.yml	Updates publisher inventory reference.
ansible/​inventory/​group_vars/​decdn_origin_nodes.yml	Documents shared origin configuration.
ansible/​inventory/​group_vars/​decdn_nodes.yml	Clarifies cache/origin inheritance.
ansible/​galaxy/​node/​CHANGELOG.md	Records corrected origin semantics.
ansible/​.gitignore	Documents split inventory templates.
AGENTS.md	Records the new deployment architecture.
.github/​workflows/​ci.yml	Updates inventory-template commentary.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.