Hub install lifecycle

1. Inventory and secrets — bootstrap-hub-inventory.sh copies examples/inventory/hub-only/. Operator sets hub WAN IP, DNS zones (fleet_edge_domain), and encrypts vault.yml.

2. Preflight — playbooks/preflight.yml validates inventory, vault keys, and hub public IP.

3. Host prepare — OS baseline, routing, packages (host-prepare.yml).

4. WireGuard server — Hub wg0; overlay CIDR and hub /32 fixed (wireguard.yml).

5. OCM hub — Single K3s server: Flannel off, Calico CNI, built-in Traefik/servicelb disabled. clusteradm init (ocm.yml).

6. Harbor — Registry on the hub WireGuard IP; harbor_push_fleet builds and pushes all fleet/* images (often 1–2 hours).

7. Fleet platform — OLM and cert-manager on the hub (fleet-platform.yml).

8. Console auth and UI — Helm CRDs, LLDAP (production), fleet-console-auth chart, dashboard NodePort (fleet-console-auth.yml).

9. DCM control plane — Postgres, NATS, fleet/control-plane monolith, Traefik gateway (fleet-dcm.yml). Seeds demo catalog.

10. Hub firewall — nftables / firewalld for WAN SSH, HTTP/S, WireGuard UDP 51820 (hub-firewall.yml).

11. Fleet-site stack — CRDs, controller, seeds management FleetSite, optional ACME/Authelia seed.

12. Fleet-edge stack — FleetAppRoute CRD, controllers, hub Traefik static routes.

Verify with ./scripts/verify-hub-install.sh or ./scripts/verify-fleet.sh --layer 1 --suite hub.