spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Infra][Architecture] Production deployment & secrets model for real hardware #414

New Issue
Closed
opened 2026-07-05 20:24:41 +00:00 by spikerj · 1 comment
spikerj commented 2026-07-05 20:24:41 +00:00
Owner
Copy Link
Copy Source

Context: Host-pinned Swarm files, the Docker-daemon connection, and volume wiring are intentional dev-environment artifacts that get rewritten on dedicated hardware.

Scope: Design the production deployment model before moving to a datacenter/cloud: a Swarm topology that is not host-locked (unblocked by INF-1), a real secrets-injection path (Swarm secrets / vault, per CR-1), and externalized configuration so the same images deploy to dev, datacenter, and cloud unchanged.

Fix: Pick the production target (datacenter vs cloud); land INF-1 and CR-1 as prerequisites; then rewrite the Swarm stack + volume model onto the object-storage + secrets-injection design.

Acceptance criteria:

  • Production stack files with no host-pinned placement and no committed secrets
  • One image set deploys across dev / datacenter / cloud via configuration only

Effort: M–L · Depends on INF-1 and CR-1 (this batch). Related: #297 / #377 (ops & status surfaces).

**Context:** Host-pinned Swarm files, the Docker-daemon connection, and volume wiring are intentional dev-environment artifacts that get rewritten on dedicated hardware. **Scope:** Design the production deployment model before moving to a datacenter/cloud: a Swarm topology that is not host-locked (unblocked by INF-1), a real secrets-injection path (Swarm secrets / vault, per CR-1), and externalized configuration so the same images deploy to dev, datacenter, and cloud unchanged. **Fix:** Pick the production target (datacenter vs cloud); land INF-1 and CR-1 as prerequisites; then rewrite the Swarm stack + volume model onto the object-storage + secrets-injection design. **Acceptance criteria:** - Production stack files with no host-pinned placement and no committed secrets - One image set deploys across dev / datacenter / cloud via configuration only **Effort:** M–L · Depends on INF-1 and CR-1 (this batch). Related: #297 / #377 (ops & status surfaces).
spikerj added the agentic label 2026-07-05 20:24:41 +00:00
spikerj commented 2026-07-05 20:25:08 +00:00
Author
Owner
Copy Link
Copy Source

Depends on INF-1 #413 (object storage — un-pins Swarm placement) and CR-1 #404 (secrets injection).

Depends on **INF-1 #413** (object storage — un-pins Swarm placement) and **CR-1 #404** (secrets injection).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels agentic
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#414