TELEICU/Path A: Ansible Pull - Revision history

Admin: Fix Mermaid diagrams: remove

 wrapping so parser functions execute (via update-page on MediaWiki MCP Server)

2026-07-06T03:18:19Z

Fix Mermaid diagrams: remove <pre> wrapping so parser functions execute (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 08:48, 6 July 2026
Line 12:		Line 12:
	All node configuration is declared in a central git repository. Each hospital PC runs <code>ansible-pull</code> on a cron or systemd timer, checking out the repo and applying the playbook for its host group.		All node configuration is declared in a central git repository. Each hospital PC runs <code>ansible-pull</code> on a cron or systemd timer, checking out the repo and applying the playbook for its host group.

	<pre>
	{{#mermaid:flowchart LR		{{#mermaid:flowchart LR
	REPO["Git Repository<br/>(central playbooks)"]		REPO["Git Repository<br/>(central playbooks)"]
Line 23:		Line 22:
	REPO -->\|"per-agent pull"\| HUB		REPO -->\|"per-agent pull"\| HUB
	}}		}}
	</pre>

	== What Ansible manages ==		== What Ansible manages ==
Line 60:		Line 58:
	== Repository structure ==		== Repository structure ==

	<pre>
	{{#mermaid:flowchart LR		{{#mermaid:flowchart LR
	subgraph Repo["ansible-teleicu/"]		subgraph Repo["ansible-teleicu/"]
Line 70:		Line 67:
	end		end
	}}		}}
	</pre>

	{{Navbox TELEICU}}		{{Navbox TELEICU}}

Admin: Automated edit (via update-page on MediaWiki MCP Server)

2026-07-06T03:09:50Z

Automated edit (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 08:39, 6 July 2026
Line 71:		Line 71:
	}}		}}
	</pre>		</pre>

			{{Navbox TELEICU}}

	{{Related}}		{{Related}}

Admin: Replace ASCII art with Mermaid diagrams (via update-page on MediaWiki MCP Server)

2026-07-06T02:55:10Z

Replace ASCII art with Mermaid diagrams (via update-page on MediaWiki MCP Server)

@@ Line 12: / Line 12: @@
 All node configuration is declared in a central git repository. Each hospital PC runs <code>ansible-pull</code> on a cron or systemd timer, checking out the repo and applying the playbook for its host group.
 == What Ansible manages ==
@@ Line 69: / Line 60: @@
 == Repository structure ==
-ansible-teleicu/
+    subgraph Repo["ansible-teleicu/"]
-├── ansible.cfg
+        ROOT["site.yml<br/>ansible.cfg"]
 {{Related}}

Admin: Create TELEICU Path A: Ansible Pull guide (via create-page on MediaWiki MCP Server)

2026-07-06T02:53:08Z

Create TELEICU Path A: Ansible Pull guide (via create-page on MediaWiki MCP Server)

New page

{{Doc header
|type=guide
|domain=teleicu
|title=Path A: Ansible Pull
|order=7
}}

Full architecture and workflow for the Ansible Pull migration path.

== Architecture ==

All node configuration is declared in a central git repository. Each hospital PC runs <code>ansible-pull</code> on a cron or systemd timer, checking out the repo and applying the playbook for its host group.

syntaxhighlight lang="text"
┌──────────────────────┐
│ Git repository │
│ (central playbooks) │
└──────────┬───────────┘
│ pull (HTTPS / Tailscale)
▼
┌──────────────────────┐
│ CP node(s) │
│ (ansible-pull │
│ also runs here) │
└──────────┬───────────┘
│
▼ (per-agent pull)
┌──────────────────────┐ ┌──────────────────────┐
│ Spoke agent node │ │ Hub agent node │
│ ansible-pull │ │ ansible-pull │
│ → K3s agent │ │ → K3s agent │
│ → middleware │ │ → middleware │
└──────────────────────┘ └──────────────────────┘
syntaxhighlight

== What Ansible manages ==

* OS package state (apt pins to prevent version drift)
* System configuration (ssh, sysctl, ntp, firewall)
* K3s agent install and registration
* Cloudflare tunnel service definition and credentials (from vault)
* Docker/containerd configuration if needed by workloads
* Monitoring agent and log shipper setup
* Tailscale install and configuration

== What K3s manages ==

* Middleware container deployments
* Service discovery and ingress within the cluster
* Workload scaling and updates
* All workloads are declarative Kubernetes manifests, versioned alongside playbooks

== Storage ==

Longhorn on existing filesystems. No disk repartitioning — Longhorn uses a configured directory or dedicated mount point on the existing ext4/xfs partition.

== Rollback ==

# <code>git revert</code> the offending commit in the ansible repo
# <code>ansible-pull</code> runs on next timer — nodes converge to the reverted state
# For urgent rollbacks, trigger an immediate pull: <code>ansible-pull -U <repo></code>

== Constraints ==

* No filesystem immutability — drift can exist between pull intervals (default: every 15–30 minutes)
* Existing OS fragmentation must be handled through conditional Ansible roles
* In-place OS upgrade playbook needed to converge Ubuntu versions before or during migration

== Repository structure ==

syntaxhighlight lang="text"
ansible-teleicu/
├── site.yml # master playbook
├── ansible.cfg
├── requirements.yml
├── inventories/
│ ├── production/
│ │ ├── hosts.ini # grouped by state, role
│ │ └── group_vars/
│ └── staging/
├── roles/
│ ├── common/ # base hardening
│ ├── tailscale/ # tailscale install & bringup
│ ├── k3s-agent/ # join cluster
│ ├── cloudflared/ # tunnel service
│ ├── monitoring-agent/ # vmagent + downtime classifier
│ ├── middleware/ # docker compose or k3s manifest apply
│ └── security-patches/ # unattended-upgrades / apt pinning
├── group_vars/
│ ├── all.yml
│ ├── spokes.yml
│ └── hubs.yml
└── vault/ # encrypted secrets
syntaxhighlight

{{Related}}