Orbital Setup

Customer-facing Infrastructure-As-Code (IaC) for Call Theory's Orbital AX and Call Center platform.

Handle first-time deployments and version updates using opinionated defaults.

Requirements

• tofu (OpenTofu ≥ 1.7), kubectl, helm, git, curl, jq, openssl — plus ansible for on-prem. ./install.sh checks for all of them first and tells you how to install anything missing.
• An SSH public key, and for Vultr an API key.

No registry account is needed: the chart and images come from Call Theory's public registry, cr.calltheory.com/orbital.

Install

git clone https://git.calltheory.com/calltheory/orbital-setup.git
cd orbital-setup
git checkout "$(curl -fsS https://git.calltheory.com/api/v1/repos/calltheory/orbital-setup/releases/latest | jq -r .tag_name)"
./install.sh

./install.sh deploys to Vultr Kubernetes Engine (VKE), the supported target for now; the K3s targets (Vultr VMs, your own VMs) are behind ORBITAL_EXPERIMENTAL_TARGETS=1 until they get an ingress controller. It asks for your domain, Vultr account and sizing. It checks what it can as you go (the release's chart is published, Vultr API key, available Kubernetes versions), shows a summary, and writes:

File	Holds
terraform/<target>/terraform.tfvars	OpenTofu inputs for that target
.orbital/settings.env	Everything else the install needs, including secrets (git-ignored, mode 0600)
.orbital/values.yaml	Your own helm overrides — empty to start

Then it can preview the infrastructure (tofu plan), run the install, or stop so you can run it later. The install creates the infrastructure, installs Traefik and cert-manager with a Let's Encrypt issuer, creates the app secrets, and installs the Orbital chart. At the end it prints the DNS records to create and how to make your admin login.

Re-run ./install.sh any time: saved answers are the defaults, so pressing Enter through it keeps everything. Secrets already in the cluster (APP_KEY, database passwords) are never regenerated.

./install.sh --configure-only writes the files without installing.

Using your own registry

To pull from a mirror instead (for example after copying a release's images and chart into your own registry), answer yes to "Pull from your own registry" in ./install.sh, or set these when running the install scripts directly:

Variable	Default	Meaning
HARBOR_REGISTRY	cr.calltheory.com	Registry host
HARBOR_PROJECT	orbital	Path holding <image>:<version> and charts/orbital
HARBOR_USERNAME, HARBOR_TOKEN	unset	Only if the registry needs a login; then a pull secret is created

Telephony on VKE is new and not yet proven on a live cluster. Carrier calls route edge → Asterisk over the private network, operator softphones register over wss://<SIP domain>:7443 through the edges, and LiveKit is reachable at livekit.<domain> (TURN at turn.<domain>).

Releases and upgrades

Every release of Orbital tags this repo with the matching version: tag v1.2.3 deploys chart and images 1.2.3 and installs that release's rtpengine .debs. The installer reads the version from the checked-out tag. Releases are listed at https://git.calltheory.com/calltheory/orbital-setup/releases.

To upgrade: git fetch --tags, check out the newer tag, run ./install.sh again.

One commit can carry several tags when this repo didn't change between Orbital releases. The scripts then deploy the highest of them; set ORBITAL_CHART_VERSION=1.2.3 to deploy an older one.

Running the steps yourself

The installer writes the files and then calls one script. You can run that script directly (it reads .orbital/settings.env; environment variables override it):

• Vultr: ./scripts/install-vultr.sh --variant=managed-vke (or self-hosted-k3s)
• On-prem: ./scripts/install-onprem.sh

Add --skip-tofu to only redo the cluster and helm steps. ORBITAL_VALUES_FILES=a.yaml:b.yaml swaps in your own values files in place of .orbital/values.yaml. Each target's terraform.tfvars.example documents every OpenTofu input if you'd rather write tfvars by hand.

Testing

CI runs on every PR (.forgejo/workflows/):

• lint.yml — tofu fmt/validate, tflint, yamllint, ansible-lint, playbook syntax-check
• security.yml — checkov over terraform/
• molecule.yml — full role test for rtpengine on Ubuntu 24.04 in Docker

To test edge-deployment using multipass locally:

./local/multipass-edge.sh

Run lint locally before pushing:

tofu fmt -check -recursive terraform/
yamllint .
cd ansible
ansible-lint
cd ..

Security

Report vulnerabilities privately to security@calltheory.com. Do not open public issues for security findings.

Contributing

Have an environment IaC you'd like to contribute? Open a pull-request!

License

This project is covered under the Apache 2.0 license. You can read the license here.