[abtreece]

Closes #55.

Summary

Refreshes the infra docs to describe the current infrastructure: a single Hetzner VM running Caddy and the Sinatra/Puma API server, configured by Ansible. The old docs described the pre-July-2024 architecture (GKE Autopilot, Nginx Ingress, Cloud Run apiserver). Text is written for readers who only know the current setup, and avoids repeating details that live in Terraform/Ansible (expiry periods, hardening specifics) so it doesn't drift from the code.

Files changed

• docs/infrastructure-overview.md: rewritten section by section against current IaC.
  • Google Cloud project: a single project (fsruby-server-edition2); the project resource lives in terraform-hisec/, resources inside it in terraform/.
  • CI/CD authentication: replaces the two old GCP service-account sections, split per caller:
    • server-edition → Google Cloud via Workload Identity Federation.
    • server-edition → Azure via Federated Identity Credentials.
    • infra → API server via a GitHub OIDC JWT (audience backend.fullstaqruby.org) sent to POST /admin/upgrade_apiserver. The infra workflows don't authenticate to GCP or Azure.
  • API server: runs under systemd on the VM. Releases are built by the "Test and build" workflow and published by the "Deploy" workflow, which calls /admin/upgrade_apiserver. The separate deployer exists both so the server can be replaced without a gap and for security (the API server can't modify its own code).
  • Caddy: apt. and yum. vhosts only; both proxy /admin/* to the API server socket. Links the server-edition APT/YUM repo design doc for latest_version.txt.
  • VM (Hetzner): runs Caddy and the API server, configured entirely by Ansible. Forward DNS is Terraform-managed; the PTR record is set manually.
  • CI artifacts / cache: artifacts go to the GCS bucket. The Azure artifacts container is provisioned for a future migration but not in use. The Azure cache container is in use and expires on last access time.
  • GPG private key: stored in fsruby2infraowners; CI reads it via GitHub OIDC.
  • Container registry: section dropped (no registry resources are managed in this repo).
• apiserver/README.md: rewritten. It previously described Google Cloud hosting. Now covers hosting on the VM behind Caddy, the three endpoints, GitHub OIDC auth, and the Test and build → Deploy → apiserver-deployer flow.
• docs/infrastructure-bootstrapping.md: intro mentions Terraform + Ansible instead of Kubernetes. New Step 12: Deploy the API server (later steps renumbered), and Step 11 notes that at least one apiserver-* release must exist.
• docs/deploy.md: replaces the gcloud container clusters get-credentials + kubectl apply steps with an ansible-playbook step, and notes that API server changes deploy via .github/workflows/.
• docs/infrastructure-as-code.md: drops Kustomize and kubernetes/; adds Ansible and ansible/; references .github/workflows/.
• .editorconfig: removes the duplicate [config.ru] block (the tab/4 one).

Diagram (pending)

Per review, the hand-drawn diagram is kept. The earlier Mermaid replacement has been reverted, so docs/infrastructure-overview.drawio.svg, docs/editing-diagrams.md, and their links in README.md and docs/pull_request_template.md are unchanged from main. The drawio itself still depicts the pre-Hetzner architecture; updating it is pending.

Verification

• eclint check $(git ls-files) passes.
• Claims were checked against current IaC: terraform/{dns,gcloud_auth,repo_buckets,ci_storage,variables}.tf, terraform-hisec/{gcloud_project,key_vault}.tf, ansible/main.yml, ansible/files/{Caddyfile,apiserver.service,apiserver-deployer.service,apiserver-deployer.sh,apiserver-sudoers}, apiserver/app.rb, .github/workflows/{test-and-build,deploy}.yml.

Out of scope

• The "Github CI bot account" section still describes the PAT-based bot. Converting it is tracked in Change fullstaq-ruby-ci-bot account into a Github app #18.
• Docs for the archive repos from feat: add archive infrastructure for EOL distribution packages #47 ship with feat: add archive infrastructure for EOL distribution packages #47 itself.

[FooBarWidget]

I'll have a good look. So far my first impression is that the new diagram lacks a lot of detail that was in the older diagram. I'm also not sure whether a detailed but automatically rendered diagram is still readable compared to a manually drawn one.

[FooBarWidget]

I rendered the Mermaid diagram but I don't think it's easier to read (nor better-looking) than a hand-drawn one, so I prefer an update based on the hand-drawn diagram.