Platform¶
How the HNS Ticketing system actually runs in the cluster: server topology, the deploy pipeline, environment variables, per-composition preview stacks, TLS, and the cross-service secret contracts.
As-built, not design intent
Pages in Platform describe the system as it is deployed, sourced from the hns-platform repository (Ansible + k3s). The repo is the source of truth — where this section and the code disagree, the code wins, and the page should be corrected.
This is the counterpart to Architecture: Architecture explains how the system is designed and why; Platform explains how it is built, configured, and operated.
Run modes¶
A service runs in several deployment paths. The Platform section documents the cluster (k3s) path; the full-stack local k3d path (Local development) mirrors it on a throwaway cluster. The same code runs in all of them, but the environment source, networking, and hostnames differ — and environment is per-mode, not transitive.
| Mode | Env source | Read by | Hostnames |
|---|---|---|---|
| Local — single service | .env (+ committed .env.example) |
docker-compose |
*.hns.docker.localhost / *.hns.test |
| Local — full stack (k3d) | inventory/local-k3d.vars.yml + components.local.yml |
hns-service role via make local-up |
*.127.0.0.1.sslip.io |
| Nebion preview | .nebion.env + Nebion UI overrides |
Nebion runtime (docker-compose-nebion.yml) |
*.hnst.dev3.wsagency.io |
| Cluster (k3s) | .platform.yml + Ansible inventory + Nebion UI overrides |
hns-service Ansible role |
real domain, driven by DOMAIN |
Env propagation is per-mode
Adding a variable to .env.example does not make it appear in cluster pods — the service's .platform.yml must declare it too. Likewise, a value in .platform.yml does nothing for local dev. See Environment configuration.
Pages¶
| Page | What it answers |
|---|---|
| Cluster topology | What servers exist, what runs where, k3s + the internal registry, how pods reach each other |
| Service inventory | Which services are deployed, their version knobs, their in-cluster URLs |
| Deployment model | What happens on a deploy — the hns-service role pipeline, playbooks, safety guards |
| Local development (k3d) | Run the whole stack locally on k3d over HTTPS — prerequisites, make local-up, and how it mirrors the cluster |
The .platform.yml contract |
The full vocabulary a service declares to be deployable |
| Environment configuration | The inventory → vault → Nebion override chain and the per-composition knobs |
| Compositions & environments | Baseline vs preview stacks — namespace, database, domain isolation |
| TLS & ingress | Traefik routing, the shared multi-SAN certificate, public vs internal paths |
| Secrets & contracts | Where secrets live and the shared-secret wires between services |
Last Updated: June 2026