Move co-located containers onto shared foreman-core-network

development/playbooks/deploy-dev/deploy-dev.yaml

@@ -5,6 +5,12 @@
   vars:
     flavor: katello
     pulp_register_foreman_proxy: false
+    postgresql_publish:
+      - "127.0.0.1:5432:5432"
+    valkey_publish:
+      - "127.0.0.1:6379:6379"
+    candlepin_publish:
+      - "127.0.0.1:23443:23443"
   vars_files:
     - "../../../src/vars/defaults.yml"
     - "../../../src/vars/flavors/{{ flavor }}.yml"
@@ -58,6 +64,7 @@
     - role: pre_install
     - role: systemd_target
     - role: certificates
+    - role: foreman_core_network
     - role: postgresql
     - role: valkey
     - role: candlepin
@@ -68,10 +75,13 @@
         foreman_development_oauth_consumer_key: "{{ foreman_oauth_consumer_key }}"
         foreman_development_oauth_consumer_secret: "{{ foreman_oauth_consumer_secret }}"
         foreman_development_candlepin_oauth_secret: "{{ candlepin_oauth_secret }}"
+        foreman_development_database_password: "{{ foreman_database_password }}"
+
     - role: iop_core
       when:
         - "enabled_features | has_feature('iop')"
       vars:
+        iop_core_gateway_url: "https://localhost:24443"
         iop_core_foreman_oauth_consumer_key: "{{ foreman_oauth_consumer_key }}"
         iop_core_foreman_oauth_consumer_secret: "{{ foreman_oauth_consumer_secret }}"
     - role: cloud_connector

development/playbooks/remote-database/remote-database.yaml

@@ -10,6 +10,9 @@
     certificates_ca_password: "CHANGEME"
     postgresql_ssl_crt: "{{ certificates_ca_directory }}/certs/{{ ansible_facts['fqdn'] }}.crt"
     postgresql_ssl_key: "{{ certificates_ca_directory }}/private/{{ ansible_facts['fqdn'] }}.key"
+    postgresql_networks: []
+    postgresql_publish:
+      - "5432:5432"
   vars_files:
     - "../../../src/vars/defaults.yml"
     - "../../../src/vars/flavors/{{ flavor }}.yml"

development/roles/foreman_development/defaults/main.yaml

@@ -29,11 +29,10 @@ foreman_development_rails_command: "puma -w 2 -p {{ foreman_development_rails_po
 
 foreman_development_url: "http://{{ ansible_facts['fqdn'] }}:{{ foreman_development_rails_port }}"
 
-foreman_development_database_host: "localhost"
+foreman_development_database_host: "127.0.0.1"
 foreman_development_database_port: 5432
 foreman_development_database_name: "foreman_development"
 foreman_development_database_user: "foreman"
-foreman_development_database_password: "foreman" # noqa: no-static-secrets
 
 foreman_development_nodejs_stream: "22"
 

development/roles/foreman_development/templates/database.yml.j2

@@ -4,7 +4,7 @@ development:
   pool: 20
   username: {{ foreman_development_database_user }}
   password: {{ foreman_development_database_password }}
-  host: localhost
+  host: {{ foreman_development_database_host }}
   encoding: UTF8
   template: template0
 
@@ -14,7 +14,7 @@ test:
   pool: 20
   username: {{ foreman_development_database_user }}
   password: {{ foreman_development_database_password }}
-  host: localhost
+  host: {{ foreman_development_database_host }}
   encoding: UTF8
   template: template0
 
@@ -24,6 +24,6 @@ production:
   pool: 20
   username: {{ foreman_development_database_user }}
   password: {{ foreman_development_database_password }}
-  host: localhost
+  host: {{ foreman_development_database_host }}
   encoding: UTF8
   template: template0

docs/architecture/iop.md

@@ -10,36 +10,14 @@ The `iop` feature depends on `rh-cloud`, which installs the `foreman_rh_cloud` p
 
 ## Architecture
 
-IOP runs as a set of containerized services managed via podman quadlets on the `iop-core-network` (bridge, `10.130.0.0/24`). The gateway is registered as a Foreman smart proxy at `https://localhost:24443`.
+IOP runs as a set of containerized services managed via podman quadlets on the shared `foreman-core-network` (bridge, `10.130.0.0/24`), alongside Foreman, Postgres, and other co-located services. See [Network Architecture](network.md) for the host/bridge split, unix sockets, and published ports.
+
+The subnet matches the former `iop-core-network` so the gateway image nginx resolver (`10.130.0.1`) can resolve upstream service names. The gateway is registered as a Foreman smart proxy at `https://iop-core-gateway:8443` (host publish remains `127.0.0.1:24443` for host-side tools and tests).
 
 ```mermaid
 graph TB
     subgraph Host["Host System"]
-        Foreman["Foreman<br/>(foreman_rh_cloud)"]
         Apache["Apache httpd"]
-        PG[(PostgreSQL)]
-
-        subgraph Network["iop-core-network (10.130.0.0/24)"]
-            Kafka[Kafka]
-
-            subgraph Core["Core Pipeline"]
-                Ingress[Ingress]
-                Puptoo[Puptoo]
-                Yuptoo[Yuptoo]
-                Engine[Engine]
-            end
-
-            Gateway["Gateway<br/>:24443"]
-
-            subgraph Services["Application Services"]
-                Inventory["Inventory API<br/>:8081"]
-                Advisor["Advisor API<br/>:8000"]
-                Remediation["Remediation API<br/>:3000"]
-                VMAAS["VMAAS<br/>(reposcan + webapp)"]
-                Vuln["Vulnerability<br/>(8 containers)"]
-            end
-        end
-
         subgraph Frontends["Frontend Assets (/var/www/iop)"]
             InventoryFE[Inventory Frontend]
             AdvisorFE[Advisor Frontend]
@@ -49,6 +27,29 @@ graph TB
         CVEMap["CVE Map Downloader<br/>(systemd timer + path watcher)"]
     end
 
+    subgraph Network["foreman-core-network (10.130.0.0/24)"]
+        Foreman["Foreman<br/>(foreman_rh_cloud)"]
+        PG[(PostgreSQL)]
+        Kafka[Kafka]
+
+        subgraph Core["Core Pipeline"]
+            Ingress[Ingress]
+            Puptoo[Puptoo]
+            Yuptoo[Yuptoo]
+            Engine[Engine]
+        end
+
+        Gateway["Gateway<br/>:24443"]
+
+        subgraph Services["Application Services"]
+            Inventory["Inventory API<br/>:8081"]
+            Advisor["Advisor API<br/>:8000"]
+            Remediation["Remediation API<br/>:3000"]
+            VMAAS["VMAAS<br/>(reposcan + webapp)"]
+            Vuln["Vulnerability<br/>(8 containers)"]
+        end
+    end
+
     Foreman -- "smart proxy<br/>relay" --> Gateway
     Gateway --> Kafka
     Apache -- "Alias" --> Frontends
@@ -113,7 +114,7 @@ Key Kafka topics:
 | gateway | `iop-core-gateway` | 127.0.0.1:24443 | nginx proxy, smart proxy relay to Foreman |
 | inventory | `iop-core-host-inventory-migrate` (oneshot), `iop-core-host-inventory`, `iop-core-host-inventory-api`, `iop-core-host-inventory-cleanup` (timer) | 8081 (internal) | Host inventory with DB migration, MQ consumer, REST API, and periodic cleanup |
 | advisor | `iop-service-advisor-backend-api`, `iop-service-advisor-backend-service` | 8000 (internal) | Advisor recommendations |
-| remediation | `iop-service-remediations-api` | 3000 (host network) | Remediation playbook generation |
+| remediation | `iop-service-remediations-api` | 3000 (internal) | Remediation playbook generation |
 | vmaas | `iop-service-vmaas-reposcan`, `iop-service-vmaas-webapp-go` | - | Vulnerability metadata and advisory sync |
 | vulnerability | 8 containers (see below) | 8443 (internal) | Vulnerability assessment pipeline |
 
@@ -132,11 +133,7 @@ Key Kafka topics:
 
 ### Network
 
-All IOP containers join the `iop-core-network` bridge network (`10.130.0.0/24`, gateway `10.130.0.1`). Containers communicate with each other by container name within this network.
-
-Database connectivity uses `host.containers.internal:5432` to reach the host's PostgreSQL instance. SSL is disabled for these internal connections.
-
-The gateway binds only to `127.0.0.1:24443` so it is not externally accessible.
+All IOP containers join `foreman-core-network` and reach Postgres at `postgresql:5432`. The gateway is published on host loopback as `127.0.0.1:24443` (container port `8443`) so it is not externally accessible; the Foreman container talks to it as `https://iop-core-gateway:8443`. The gateway relays to Foreman via `https://host.containers.internal` (Apache on the host). See [Network Architecture](network.md).
 
 ### Smart Proxy Registration
 
@@ -164,7 +161,8 @@ Timers:
 
 ## Databases
 
-IOP creates five PostgreSQL databases, all accessible to containers via `host.containers.internal:5432`:
+IOP creates five PostgreSQL databases, all accessible to containers via the
+`postgresql` container on `foreman-core-network` (`postgresql:5432`):
 
 | Database | User |
 |----------|------|
@@ -180,6 +178,8 @@ Passwords are auto-generated using Ansible's `password` lookup and stored as pod
 
 Advisor and vulnerability services use PostgreSQL foreign data wrappers (FDW) to query the inventory database directly, avoiding REST API overhead for bulk data access.
 
+IOP app containers still connect as `postgresql:5432` on the bridge. FDW is different: Ansible sets up the foreign server from the host (`login_host: 127.0.0.1`, the published IPv4 port), and `CREATE SERVER` stores `host=127.0.0.1`, which Postgres interprets inside its own container so advisor/vuln stay on-box instead of hairpinning through the bridge. See [PostgreSQL from three vantage points](network.md#postgresql-from-three-vantage-points).
+
 The reusable `iop_fdw` role sets up each FDW connection:
 
 1. Enables the `postgres_fdw` extension on the consuming database
@@ -272,8 +272,8 @@ Gateway and service certificates use the default foremanctl CA infrastructure at
 
 | Certificate | Path |
 |-------------|------|
-| Gateway server cert | `certs/localhost.crt` |
-| Gateway server key | `private/localhost.key` |
+| Gateway server cert | `certs/iop-core-gateway.crt` |
+| Gateway server key | `private/iop-core-gateway.key` |
 | Gateway client cert | `certs/localhost-client.crt` |
 | Gateway client key | `private/localhost-client.key` |
 | CA | `certs/ca.crt` |