TELEICU/Site onboarding flow

flowteleicuCARE 3.0+

TeleICU

Architecture

Architecture overview

Topology Current state

Middleware

Strategy

Migration strategy

Decision matrix Path A: Ansible Path B: NixOS

Canary rollout

Operations

Security baseline

Incident management Monitoring

Backup & restore

Runbooks

Power loss

Node recovery Config drift CP failure Spoke unreachable

OS update SOP

Change & recovery

Change management

Rollback strategy New hospital setup Bulk migration

DR playbook

Flows

Site onboarding

Step-by-step process for adding a new hospital site to the TELEICU K3s cluster.

Pre-requisites

- [ ] Hardware deployed and powered on - [ ] UPS connected and functional - [ ] Internet connectivity verified (minimum bandwidth TBD) - [ ] Tailscale pre-authorization key generated - [ ] Site registered in TeleicuSites table

Path A: Ansible

{{#mermaid:flowchart TB
    OS["Install Ubuntu LTS<br/>(manual or netboot)"]
    TS["Install & configure<br/>Tailscale"]
    REG["Register to Tailscale<br/>mesh"]
    PULL["Configure ansible-pull<br/>timer + cron"]
    K3S["K3s agent joins<br/>control plane"]
    MID["Middleware workloads<br/>deployed via K3s"]
    MON["Monitoring agent<br/>starts reporting"]

    OS --> TS --> REG --> PULL --> K3S --> MID --> MON
}}

1. Install Ubuntu LTS (20.04, 22.04, or 24.04 — target consistent via ansible later)
2. Install Tailscale using the bootstrap script
3. Register the node with the Tailscale mesh using a pre-authentication key
4. Deploy ansible-pull with a systemd timer (every 15 min)
5. ansible-pull applies the K3s agent role → node joins the cluster
6. Middleware workloads are scheduled onto the node by the control plane
7. Monitoring agent starts reporting to VictoriaMetrics

Path B: NixOS

{{#mermaid:flowchart TB
    ISO["Boot nixos-generator ISO<br/>(pre-configured tunnel)"]
    CONNECT["Tunnel connects to<br/>Cloudflare / Tailscale"]
    ANYWHERE["nixos-anywhere<br/>over tunnel"]
    ZFS["ZFS partitions via disko<br/>NixOS installed"]
    REBOOT["Reboot into NixOS"]
    K3S["K3s agent auto-joins<br/>control plane"]
    COMIN["comin starts polling<br/>for updates"]

    ISO --> CONNECT --> ANYWHERE --> ZFS --> REBOOT --> K3S --> COMIN
}}

1. Boot the custom ISO (generated via nixos-generator with pre-configured tunnel credentials)
2. ISO connects to Cloudflare Tunnel and/or Tailscale automatically
3. From the bootstrap environment, run nixos-anywhere over the tunnel to the target disk
4. nixos-anywhere partitions the disk (ZFS via disko), installs NixOS
5. Node reboots into the NixOS generation — Tailscale and K3s agent start automatically
6. K3s agent registers with the control plane
7. comin starts polling the flake repo for configuration updates

Post-onboarding verification

- [ ] Node shows Ready in kubectl get nodes - [ ] Tailscale status shows connected to mesh - [ ] Middleware health endpoints respond - [ ] Metrics flowing to VictoriaMetrics - [ ] Downtime classifier agent reporting - [ ] TeleicuSites entry updated with migration status

Related

Open Healthcare Network's flagship product: an open-source, FHIR-native electronic medical record (EMR) and healthcare operating system.