TELEICU/Site onboarding flow

flowteleicuCARE 3.0+

Step-by-step process for adding a new hospital site to the TELEICU K3s cluster.

Pre-requisites

- [ ] Hardware deployed and powered on - [ ] UPS connected and functional - [ ] Internet connectivity verified (minimum bandwidth TBD) - [ ] Tailscale pre-authorization key generated - [ ] Site registered in TeleicuSites table

Path A: Ansible

{{#mermaid:flowchart TB
    OS["Install Ubuntu LTS<br/>(manual or netboot)"]
    TS["Install & configure<br/>Tailscale"]
    REG["Register to Tailscale<br/>mesh"]
    PULL["Configure ansible-pull<br/>timer + cron"]
    K3S["K3s agent joins<br/>control plane"]
    MID["Middleware workloads<br/>deployed via K3s"]
    MON["Monitoring agent<br/>starts reporting"]

    OS --> TS --> REG --> PULL --> K3S --> MID --> MON
}}

Install Ubuntu LTS (20.04, 22.04, or 24.04 — target consistent via ansible later)
Install Tailscale using the bootstrap script
Register the node with the Tailscale mesh using a pre-authentication key
Deploy ansible-pull with a systemd timer (every 15 min)
ansible-pull applies the K3s agent role → node joins the cluster
Middleware workloads are scheduled onto the node by the control plane
Monitoring agent starts reporting to VictoriaMetrics

Path B: NixOS

{{#mermaid:flowchart TB
    ISO["Boot nixos-generator ISO<br/>(pre-configured tunnel)"]
    CONNECT["Tunnel connects to<br/>Cloudflare / Tailscale"]
    ANYWHERE["nixos-anywhere<br/>over tunnel"]
    ZFS["ZFS partitions via disko<br/>NixOS installed"]
    REBOOT["Reboot into NixOS"]
    K3S["K3s agent auto-joins<br/>control plane"]
    COMIN["comin starts polling<br/>for updates"]

    ISO --> CONNECT --> ANYWHERE --> ZFS --> REBOOT --> K3S --> COMIN
}}

Boot the custom ISO (generated via nixos-generator with pre-configured tunnel credentials)
ISO connects to Cloudflare Tunnel and/or Tailscale automatically
From the bootstrap environment, run nixos-anywhere over the tunnel to the target disk
nixos-anywhere partitions the disk (ZFS via disko), installs NixOS
Node reboots into the NixOS generation — Tailscale and K3s agent start automatically
K3s agent registers with the control plane
comin starts polling the flake repo for configuration updates

Post-onboarding verification

- [ ] Node shows Ready in kubectl get nodes - [ ] Tailscale status shows connected to mesh - [ ] Middleware health endpoints respond - [ ] Metrics flowing to VictoriaMetrics - [ ] Downtime classifier agent reporting - [ ] TeleicuSites entry updated with migration status

Pre-requisites

Path A: Ansible

Path B: NixOS

Post-onboarding verification

Related