initial commit

deploy/ansible/README.md

@@ -0,0 +1,23 @@
+# Ansible playbooks
+
+This directory will contain idempotent Ansible automation for game node provisioning.
+
+## Planned playbooks
+
+| Playbook | Purpose |
+|----------|---------|
+| `site.yml` | Full node bootstrap |
+| `docker.yml` | Docker Engine installation |
+| `node-agent.yml` | Agent binary, systemd unit, certificates |
+| `firewall.yml` | UFW/nftables rules for game and management ports |
+| `smoke-test.yml` | Post-install validation |
+
+## Requirements
+
+- Ansible 2.15+
+- Target: Ubuntu 24.04 LTS or Debian 13
+- SSH access with sudo
+
+## Status
+
+Phase 0 placeholder. Node installation procedures are outlined in `docs/operations/installation.md` until playbooks land in Phase 9.

deploy/compose/compose.dev.yml

@@ -0,0 +1,158 @@
+name: hexahost-gamecloud-dev
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-gamecloud}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-gamecloud}
+      POSTGRES_DB: ${POSTGRES_DB:-gamecloud}
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-gamecloud} -d ${POSTGRES_DB:-gamecloud}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    networks:
+      - gamecloud-internal
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes"]
+    ports:
+      - "${REDIS_PORT:-6379}:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - gamecloud-internal
+
+  minio:
+    image: minio/minio:latest
+    restart: unless-stopped
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: ${S3_ACCESS_KEY:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${S3_SECRET_KEY:-minioadmin}
+    ports:
+      - "${MINIO_API_PORT:-9000}:9000"
+      - "${MINIO_CONSOLE_PORT:-9001}:9001"
+    volumes:
+      - minio_data:/data
+    healthcheck:
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+    networks:
+      - gamecloud-internal
+
+  minio-init:
+    image: minio/mc:latest
+    depends_on:
+      minio:
+        condition: service_healthy
+    entrypoint: >
+      /bin/sh -c "
+      mc alias set local http://minio:9000 $${MINIO_ROOT_USER:-minioadmin} $${MINIO_ROOT_PASSWORD:-minioadmin};
+      mc mb --ignore-existing local/$${S3_BUCKET:-gamecloud};
+      exit 0;
+      "
+    environment:
+      MINIO_ROOT_USER: ${S3_ACCESS_KEY:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${S3_SECRET_KEY:-minioadmin}
+      S3_BUCKET: ${S3_BUCKET:-gamecloud}
+    networks:
+      - gamecloud-internal
+
+  mailpit:
+    image: axllent/mailpit:latest
+    restart: unless-stopped
+    ports:
+      - "${SMTP_PORT:-1025}:1025"
+      - "${MAILPIT_UI_PORT:-8025}:8025"
+    networks:
+      - gamecloud-internal
+
+  api:
+    build:
+      context: ../..
+      dockerfile: apps/api/Dockerfile
+    restart: unless-stopped
+    env_file:
+      - ../../.env
+    environment:
+      DATABASE_URL: ${DATABASE_URL:-postgresql://gamecloud:gamecloud@postgres:5432/gamecloud}
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
+    ports:
+      - "${API_PORT:-3001}:3001"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3001/healthz"]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - gamecloud-internal
+      - traefik-network
+
+  worker:
+    build:
+      context: ../..
+      dockerfile: apps/worker/Dockerfile
+    restart: unless-stopped
+    env_file:
+      - ../../.env
+    environment:
+      DATABASE_URL: ${DATABASE_URL:-postgresql://gamecloud:gamecloud@postgres:5432/gamecloud}
+      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    networks:
+      - gamecloud-internal
+
+  web:
+    build:
+      context: ../..
+      dockerfile: apps/web/Dockerfile
+    restart: unless-stopped
+    env_file:
+      - ../../.env
+    environment:
+      API_URL: ${API_URL:-http://api:3001}
+    ports:
+      - "${WEB_PORT:-3000}:3000"
+    depends_on:
+      api:
+        condition: service_healthy
+    networks:
+      - gamecloud-internal
+      - traefik-network
+
+volumes:
+  postgres_data:
+  minio_data:
+
+networks:
+  gamecloud-internal:
+    driver: bridge
+  traefik-network:
+    external: true
+    name: ${TRAEFIK_NETWORK:-traefik-network}

deploy/monitoring/prometheus.yml

@@ -0,0 +1,38 @@
+# Prometheus configuration stub — HexaHost GameCloud
+# Mount this file when enabling the optional Prometheus service in production compose.
+
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets: ["localhost:9090"]
+
+  - job_name: api
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["api:3001"]
+    # Requires OpenTelemetry Prometheus exporter in Phase 9
+
+  - job_name: worker
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["worker:3002"]
+
+  - job_name: node-agent
+    metrics_path: /metrics
+    static_configs:
+      - targets: []
+    # Populated per game node; agents expose metrics on management interface
+
+  - job_name: postgres
+    static_configs:
+      - targets: []
+    # Use postgres_exporter sidecar in production
+
+  - job_name: redis
+    static_configs:
+      - targets: []
+    # Use redis_exporter sidecar in production

deploy/systemd/node-agent.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=HexaHost GameCloud Node Agent
+Documentation=https://github.com/hexahost/gamecloud
+After=network-online.target docker.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=simple
+User=hexahost
+Group=hexahost
+EnvironmentFile=/etc/hexahost-gamecloud/node-agent.env
+ExecStart=/usr/local/bin/hexahost-node-agent
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=60
+KillMode=mixed
+
+# Hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ReadWritePaths=/var/lib/hexahost-gamecloud
+AmbientCapabilities=
+
+[Install]
+WantedBy=multi-user.target

deploy/traefik/README.md

@@ -0,0 +1,23 @@
+# Traefik deployment
+
+This directory will contain Traefik static and dynamic configuration for production deployments.
+
+## Planned contents
+
+- `traefik.yml` — entry points, providers, certificate resolvers
+- `dynamic/` — middleware, TLS options, routing labels documentation
+- Integration with external `traefik-network` Docker network
+
+## Status
+
+Phase 0 placeholder. Production routing is documented in `docs/operations/installation.md`.
+
+## External network
+
+Create the shared network once on the host:
+
+```bash
+docker network create traefik-network
+```
+
+Compose services attach to this network when `TRAEFIK_NETWORK=traefik-network` is set.