A single source of truth. Every host, subnet, and service is declared once and generates everything downstream from it: Terraform resources, GitOps manifests, DNS records, reverse-proxy config. Nothing hand-duplicated.

Keeping a physical switch's config honest:

The CBS350 switch's intended configuration is a real Jinja template in this repo, not a config backup nobody ever looks at again. Nautobot's Golden Config app renders it and commits the output back into this same git history, then diffs it against the switch's actual running configuration and reports drift.

Authenticating a user, one real identity for every app:

Every app on this page traces back to the same real Microsoft Entra ID account, not a separate password per service. Authentik federates that identity in through a real OAuth2 source, then fronts every internal app as the single SSO broker: OIDC natively where an app supports it, SAML for the one that only speaks that, and a forward-auth proxy for everything else. Each app's own <service>-read/-edit/-admin Authentik groups gate whether a login reaches it at all, generated automatically the same way the rest of this repo generates things, not hand-provisioned per app. A local emergency-fallback account still exists on a handful of services, kept as a break-glass path, not the way anyone actually logs in day to day.

Reaching an app remotely, with no open inbound ports:

Nothing on the home network ever accepts an inbound connection. A Ziti client dials out to the public controller, which brokers an outbound-only tunnel back through the home router to Traefik: the same reverse proxy every request goes through, local or remote, and it enforces an Authentik SSO gate before most apps are ever reached.

Shipping a change, GitOps-style:

Every change to this repo, including the numbers on this page, flows through the same pipeline: commit, reconcile, apply. No manual kubectl apply and no clicking through a UI to make it real.

Enrolling a new user, without ever hand-provisioning an account:

The intake form is the only thing a not-yet-provisioned person can reach: they have no Ziti identity yet, so it runs over a narrowly-scoped public tunnel instead of the zero-trust overlay above. Approval isn't a rubber stamp on a database write. It's a single human decision that produces a git commit, and Terraform is still the only thing that ever actually creates the account: the same GitOps pipeline as everything else here, just triggered by a Slack click instead of by hand. A symmetric offboarding flow tears the account back down the same way.

Rebuilding from an empty Proxmox cluster:

Everything in this repo except a short, explicit list of local secrets is just... in git. Cloning it and reconnecting Bitwarden Secrets Manager gets most of the way there on its own. Every VM, the Kubernetes cluster, and the app layer on top of it come back from a documented sequence of Terraform applies in real dependency order, not whatever we happened to do last time. It's honestly not a literal single command. Installing the hypervisor OS, creating VLANs on the firewall, and pushing config to two pieces of physical network hardware are genuine manual steps that haven't been scripted away yet, and the runbook calls them out explicitly instead of glossing over them. Everything downstream of that, including the Kubernetes app layer and this page's own live stats, rebuilds itself with zero further manual steps.

terraform/
├── blueprints/            28 reusable modules, one per service or subsystem
│   ├── 04-docker-containers/
│   ├── 09-k8s-secrets/
│   ├── 26-nautobot-sync/
│   └── ...
├── environments/
│   ├── 01-globals/        the single source of truth
│   │   ├── hosts.hcl      every VM and physical host, declared once
│   │   ├── network.hcl    every VLAN and subnet
│   │   ├── services.hcl   every app: routing, auth, hosting tier
│   │   └── variables.hcl  shared type contracts every module validates against
│   ├── core/ · dev/ · prod/  one small terragrunt.hcl per deployed unit
│   └── root.hcl           centralized inputs, wired into every unit above
└── modules/                shared logic reused across many blueprints

Last synced: 2026-09-14T15:55:03Z