meta:
  format: toon
  version: "1.0"
  kind: "deployment_blueprint_template"
  name: "Sovereign Modular Micro-DC — Global Template"
  generated_by: "AI Council OS — 14-seat round table"
  lastUpdated: "2026-01-01"

context:
  objective: >
    Deploy a repeatable, sovereign, eco-efficient micro-data center “module”
    that can be cloned to multiple regions and countries. All infra must be
    reproducible from Git, fully automated (zero manual provisioning), and
    aligned with GDPR/data-sovereignty (where applicable) and local
    sustainability/facility requirements.
  primary_regime:
    jurisdiction: "<REGULATORY_REGION>   # e.g. EU/EEA, Member State: FR"
    privacy: "<PRIMARY_PRIVACY_LAW>      # e.g. GDPR + local data protection law"
    dpia_required_for:
      - "Healthcare data"
      - "Large-scale processing of special categories of personal data"
      - "AI/ML profiling of individuals at scale"
    facility_standards:
      - "EN 50600-oriented design"
      - "<COUNTRY_SPECIFIC_ELECTRICAL_CODE>"
    sustainability_frameworks:
      - "EU Code of Conduct for Data Centres (or local equivalent)"
      - "Energy Efficiency Directive (EED) thresholds where applicable"
  target_use_cases:
    - "AI/ML training and inference with GPUs"
    - "SaaS / line-of-business apps"
    - "Edge compute for public sector / industry"
  design_principles:
    - "Sovereign-by-design: clear mapping of data to jurisdiction and operators"
    - "Modular: small, repeatable 'bricks' instead of bespoke facilities"
    - "Infra-as-code and policy-as-code; no snowflake clusters"
    - "Observability, SLOs, error budgets from day one"
    - "Sustainability KPIs (PUE/WUE/renewables/reuse) are first-class"

assumptions:
  module_scale:
    it_load_kw: 80          # adjust per deployment
    racks_total: 8
    racks_gpu: 2
    racks_compute: 4
    racks_storage: 2
    location_examples:
      - "<CITY_1> region"
      - "<CITY_2> region"
  stack_choice:
    bare_metal: "MAAS (or equivalent) for server discovery/commissioning"
    virtualization: "Proxmox VE or similar on most nodes; bare-metal K8s for GPU nodes optional"
    cloud_layer: "Kubernetes as primary control plane; OpenStack optional add-on"
    storage: "Ceph (NVMe + HDD tiers) + object storage; local NVMe cache on GPU nodes"
  automation_stack:
    iac:
      - "Terraform for network/DCIM/inventory where APIs exist"
      - "Ansible for OS/provisioning/bootstrap"
    gitops:
      - "Argo CD or Flux for K8s/OpenStack configuration"
    policy_as_code:
      - "OPA/Kyverno, CI policy checks, security/compliance gates"
  sovereign_controls:
    residency:
      - "All primary storage and processing located within approved jurisdictions"
      - "Backups replicated only within approved sovereign scope"
    data_classification_levels:
      - "PUBLIC"
      - "INTERNAL"
      - "PERSONAL"
      - "SENSITIVE_PERSONAL"
      - "CRITICAL_SOVEREIGN_<COUNTRY_CODE>"
    cross_border_rules:
      - "CRITICAL_SOVEREIGN_<COUNTRY_CODE>: must not leave the country"
      - "SENSITIVE_PERSONAL: must not leave defined region (e.g., EU/EEA)"
      - "PERSONAL: only with approved transfer mechanism and DPO sign-off"

naming_conventions:
  overview: >
    Canonical naming scheme for sites and devices, used consistently in all
    blueprints, IaC, monitoring, documentation and inventory systems. Pattern
    is designed to be global (multi-continent), sovereign-aware (country),
    location-specific (city) and module/rack/device specific.

  site_code:
    pattern: "<CONTINENT>-<CITY>-<COUNTRY><NN>"
    description: >
      Human- and machine-readable identifier for a physical site/module.
      Always use fixed-width 2-digit numeric suffix <NN> for uniqueness.
    examples:
      - "EU-PAR-FR01  # Paris, France - primary"
      - "EU-PAR-FR02  # Paris, France - secondary"
      - "EU-MAR-FR03  # Marseille, France - third"
      - "EU-FRA-DE01  # Frankfurt, Germany - first DE site"
      - "US-NY-US01   # New York, USA - first US site"
    components:
      continent:
        code_values:
          - "EU  # Europe"
          - "US  # United States"
        notes: "Extend with other continents (AP, AF, SA, OC, AS, etc.) as needed."
      country:
        code_values:
          - "FR  # France"
          - "DE  # Germany"
          - "US  # United States"
        notes: "Use ISO-like 2-letter codes for countries."
      city:
        code_values:
          - "PAR  # Paris"
          - "MAR  # Marseille"
          - "BOR  # Bordeaux"
          - "NAN  # Nantes"
          - "FRA  # Frankfurt"
          - "NY   # New York"
        notes: >
          City codes are stable mnemonics; define centrally (e.g. in a YAML map)
          and reuse. For new cities, extend the map only via PR review.
      index:
        pattern: "NN  # 01-99"
        notes: "Unique per city+country; 01 usually primary, 02 secondary, etc."

  rack_code:
    pattern: "<SITE>-RK<rr>"
    description: >
      Identifies a specific rack within a site. Can be extended with room/zone
      information when necessary while preserving RK<rr> as the rack index.
    examples:
      - "EU-PAR-FR01-RK01"
      - "EU-PAR-FR01-RK02"
      - "EU-FRA-DE01-RK01"
      - "US-NY-US01-RK01"
    extensions:
      room_or_zone:
        description: >
          If racks span multiple rooms/zones, use a suffix or infix such as
          RK01A, RK02B or Z1-RK01 as standardised in the physical model.
        examples:
          - "EU-PAR-FR01-Z1-RK01"
          - "EU-PAR-FR01-RK01A"

  device_code:
    pattern: "<SITE>-RK<rr>-<DEVICE><dd>"
    description: >
      Identifies a specific device in a rack. DEVICE is a short type code;
      <dd> is a 2-digit index, except for devices that traditionally use
      letter suffixes (e.g., PDUs A/B).
    examples:
      firewalls:
        - "EU-PAR-FR01-RK01-FW01"
        - "EU-PAR-FR01-RK01-FW02"
      management_nodes:
        - "EU-PAR-FR01-RK01-mgmt01   # Local management node (e.g. MAAS rack controller)"
        - "EU-PAR-FR01-RK01-mgmt02"
      switches:
        - "EU-PAR-FR01-RK01-tor01    # ToR / L3 switch"
        - "EU-PAR-FR01-RK02-tor02"
        - "EU-PAR-FR01-RK01-lf01     # Leaf switch"
        - "EU-PAR-FR01-RK02-sp02     # Spine switch"
      servers:
        - "EU-PAR-FR01-RK01-srv01"
        - "EU-PAR-FR01-RK01-srv02"
        - "EU-FRA-DE01-RK01-srv01"
        - "US-NY-US01-RK01-srv01"
      storage:
        - "EU-PAR-FR01-RK01-san01    # SAN array"
        - "EU-PAR-FR01-RK01-nas01    # NAS filer"
        - "EU-PAR-FR01-RK01-jbd01    # JBOD / disk shelf"
      monitoring:
        - "EU-PAR-FR01-RK01-mon01"
        - "EU-PAR-FR01-RK01-mon02"
      power:
        - "EU-PAR-FR01-RK01-pduA"
        - "EU-PAR-FR01-RK01-pduB"

    device_type_codes:
      tor:  "Top of Rack switch (often L3 capable)"
      ss:   "Super spine"
      sp:   "Spine"
      blf:  "Border leaf"
      lf:   "Leaf"
      fw:   "Firewall"
      lb:   "Load balancer"
      srv:  "Server (compute/GPU/infra)"
      san:  "SAN storage array"
      nas:  "NAS filer"
      jbd:  "JBOD / disk shelf"
      oob:  "Out-of-band management device"
      mgmt: "Generic management node (e.g., MAAS, jump host)"
      mon:  "Monitoring / logging node"
      pduA: "Rack PDU side A"
      pduB: "Rack PDU side B"

  implementation_notes:
    - "Enforce naming via IaC modules (variables, templates, validation in CI)."
    - "Monitoring, CMDB and inventory tools must use these names as primary identifiers."
    - "No ad-hoc names; new device types must extend the device_type_codes map and be reviewed."
    - "Where external systems impose constraints (e.g. 15-char limits), define deterministic truncation rules."

architecture:
  layers:
    - name: "Facility & Physical Module (Physical Infrastructure & Facility Engineering Lead)"
      description: >
        Physical micro-DC module: room/container, racks, power, cooling,
        structured cabling, environmental monitoring, aligned with local
        building/electrical codes and EN 50600-style principles.
      design:
        form_factor:
          options:
            - "Prefabricated container (2-4 racks) for remote/edge sites"
            - "Dedicated technical room in existing building for 6-10 racks"
        power:
          utility_feeds: "At least 1 primary + 1 secondary where feasible"
          ups_topology: "Modular online UPS, N+1"
          generator:
            presence: true
            autonomy_hours: 8
          redundancy_level: "N+1 for IT load, 2N for critical infra when justified"
          per_rack_pdu:
            type: "Intelligent, metered, switched"
        cooling:
          primary:
            type: "In-row or rear-door cooling units"
          free_cooling:
            enabled: true
          gpu_rack_density_kw: 20
          cpu_rack_density_kw: 8
        monitoring:
          sensors:
            - "Rack inlet temperature"
            - "Rack exhaust temperature"
            - "Room temperature and humidity"
            - "PDU-level power and voltage"
          telemetry_export:
            protocol: "SNMP/Modbus translated to Prometheus metrics"

    - name: "Network & Connectivity (Network Architect)"
      design:
        topology:
          underlay: "Leaf-spine, 2x spine, dual ToR per rack where cost-effective"
          uplinks_per_rack: 2
          routing: "L3 to the top, BGP between ToR and spines"
        segmentation:
          vrfs:
            - name: "INFRA_MGMT"
            - name: "TENANT"
            - name: "STORAGE"
            - name: "OUT_OF_BAND"
        wan:
          connectivity:
            - "Dual ISPs where feasible"
          sovereignty:
            - "All VPN termination in approved jurisdictions; keys managed by sovereign entities"

    - name: "Compute, Storage & Virtualization (Virtualization Architect, Capacity & Performance Engineer)"
      design:
        node_types:
          - name: "compute-standard"
            cpu: "2 x 32-core"
            ram_gb: 512
          - name: "compute-gpu"
            cpu: "2 x 32-core, NUMA-aligned"
            gpus: 4
            ram_gb: 768
          - name: "storage-ceph"
            cpu: "1 x 24-core"
            ram_gb: 256
        hypervisor:
          platform: "Proxmox VE or similar"
        storage:
          ceph:
            pools:
              - name: "k8s-block"
              - name: "gpu-block"
              - name: "object-archive"

    - name: "Platform & Workloads (Principal SRE, Automation & IaC Lead, OpenStack Architect)"
      design:
        provisioning_flow:
          - "Bare metal discovery/commissioning"
          - "Hypervisor or K8s node OS install via Ansible"
          - "GitOps applies cluster and app layer"
        clusters:
          k8s:
            ha_control_plane: 3
          openstack_optional:
            enabled: false
        multi_tenancy:
          k8s:
            namespaces:
              - "<COUNTRY_CODE>-public"
              - "<COUNTRY_CODE>-internal"
              - "<COUNTRY_CODE>-personal"
              - "<COUNTRY_CODE>-sensitive"
              - "<COUNTRY_CODE>-critical-sovereign"

    - name: "Compliance, Sovereignty & Sustainability (Sovereign Compliance & Sustainability Lead, Physical Infrastructure Lead, Security Architect)"
      design:
        data_residency:
          rules:
            - "Critical sovereign namespaces use storage classes bound to local pools only."
            - "Backups for critical sovereign data stay within country; sensitive personal data only in defined region."
        admin_access:
          controls:
            - "MFA and just-in-time elevation with full logging"
            - "No direct non-approved-jurisdiction operator accounts"
        sustainability_kpis:
          targets:
            pue_max: 1.4
            renewable_share_min_percent: 70
            energy_reuse_target: "Heat reuse where feasible"
          measurement:
            - "Facility meters integrated into telemetry"
            - "Sustainability dashboards and reports"

git_structure_and_pipelines:
  repos:
    - name: "infra-foundation"
      contents:
        - "facility/site_manifests/"
        - "facility/rack_layouts/"
        - "facility/power_and_cooling/"
        - "network/terraform/"
        - "hypervisor/ansible/"
        - "baremetal/profiles/"
    - name: "platform-clusters"
      contents:
        - "k8s/clusters/<site_codes>/"
        - "addons/monitoring-logging-security/"
    - name: "policies-and-compliance"
      contents:
        - "data-classification.yaml"
        - "opa-policies/"
        - "sustainability-kpis.yaml"
        - "rbac-and-iam.yaml"
  ci_cd:
    pipeline_stages:
      - name: "lint_and_unit"
      - name: "policy_gates"
      - name: "integration_test"
      - name: "promotion_to_template"
      - name: "site_rollout"

deployment_runbook:
  phases:
    - phase: 0
      name: "Policy & Site Definition"
      owners:
        - "Sovereign Compliance & Sustainability Lead"
        - "Physical Infrastructure & Facility Engineering Lead"
    - phase: 1
      name: "Facility Build-Out"
    - phase: 2
      name: "Network & Out-of-Band Bring-Up"
    - phase: 3
      name: "Bare-Metal & Hypervisor Provisioning"
    - phase: 4
      name: "Platform Bootstrap"
    - phase: 5
      name: "Compliance & Telemetry Validation"
    - phase: 6
      name: "Workload Onboarding"
    - phase: 7
      name: "Scale-Out & Federation"

verification_and_validation:
  automated_checks:
    - "IaC unit/integration tests"
    - "Policy-as-code checks for residency and security"
    - "Post-deploy conformance tests for network, storage, and platform"
  manual_reviews:
    - "DPO/legal review for data protection alignment"
    - "Facility audit for physical security and safety"
    - "Sustainability review vs targets"
  continuous_improvement:
    - "Chaos drills to validate reliability"
    - "Post-incident reviews feeding into blueprint updates"
    - "Versioned evolution with clear change logs"

council_alignment:
  outcome_requirements_satisfied:
    - "zero_manual_provisioning"
    - "zero_snowflake_clusters"
    - "fully_reproducible_infra_from_git"
    - "multi_dc_consistency"
    - "ha_control_planes"
    - "predictable_gpu_performance"
    - "automated_lifecycle_management"
    - "telemetry_and_self_healing"
    - "clear_slo_sli_error_budgets"
    - "security_and_compliance_built_in"
    - "gdpr_and_data_sovereignty_alignment"
    - "eco_efficiency_and_sustainability_kpis"
    - "architecture_must_be_deployable"
    - "all_answers_validated_by_cross_seat_consensus"