olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
olsitec-foundation platform repo
45 commits 1 branch 0 tags 410 KiB
Find a file
Andreas Niemann 44a96d84eb
All checks were successful
CI / preflight (push) Successful in 9s
Details
CI / typecheck (push) Successful in 23s
Details
pulumi-preview / preview (push) Successful in 26s
Details
fix(runners): live-validated the crunchy stack; cutover done 
Fixes found running `pulumi up` live against crunchy01 (foundation-runner-02,
static .16, 8c/32G — the new default sizing):

- network-config matches the NIC by glob (`match: {name: "e*"}`) instead of a
  hardcoded enp1s0 — the libvirt.Domain enumerated it differently, leaving the VM
  with no IP.
- drop `qemuAgent: true` — it blocks the provider on the guest agent (not up on a
  fresh boot) during create; we register over the static IP instead.
- runner-register connection gets `dialErrorLimit: 30` so it waits ~5 min for the
  VM to boot + apply its IP, landing the runner in a single `up`.
- fix the register token passing (the old /tmp/t hop was an ephemeral --rm
  container → empty token); pass it directly (pulumi redacts the secret).
- README: host prep (root SSH + the `images` pool), the exact stack config, and
  the cutover marked DONE — a `runs-on: fenced` job ran green on the Pulumi-managed
  runner-02; the hand-built VM was retired.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-01 03:35:06 +02:00
.forgejo/workflows revert(ci): reusable workflows after all — Forgejo 11 supports them 2026-07-01 01:48:29 +02:00
backup feat(ci): baked CI image + runner config + self-check workflow (T14) 2026-07-01 00:15:01 +02:00
bootstrap chore: re-trigger fenced job after hardening (VM on .15) 2026-07-01 02:59:36 +02:00
ci feat(ci): reusable ecosystem workflows + selftest (999_testing) 2026-07-01 01:03:56 +02:00
containers feat(ci-image): bake ecosystem CI toolchain (lint + release) 2026-07-01 01:03:55 +02:00
documentation docs(session): correct ecosystem-CI architecture to reusable workflows 2026-07-01 01:50:59 +02:00
dr feat(ci): baked CI image + runner config + self-check workflow (T14) 2026-07-01 00:15:01 +02:00
offsite-backup feat(offsite-backup): olsitec-foundation bucket + scoped creds on home MinIO 2026-06-30 20:34:55 +02:00
packages feat(provision): Phase-0 throwaway test VM via vendored @olsitec/pulumi-hetzner 2026-06-30 18:57:54 +02:00
preflight feat(preflight): host/toolchain validation + VERSIONS pin-file — T01 2026-06-30 18:00:26 +02:00
provision feat(backup): age at-rest encryption of bundles (CONTRACT_004 §4.3) 2026-06-30 23:23:38 +02:00
runners fix(runners): live-validated the crunchy stack; cutover done 2026-07-01 03:35:06 +02:00
.gitignore fix(runners): live-validated the crunchy stack; cutover done 2026-07-01 03:35:06 +02:00
bun.lock feat(runners): decoupled Pulumi stack for the fenced runner fleet (R5) 2026-07-01 03:15:39 +02:00
package.json feat(runners): decoupled Pulumi stack for the fenced runner fleet (R5) 2026-07-01 03:15:39 +02:00
README.md chore: scaffold olsitec-foundation mono-repo 2026-06-30 17:10:46 +02:00
VERSIONS feat(ci-image): bake ecosystem CI toolchain (lint + release) 2026-07-01 01:03:55 +02:00

README.md

olsitec-foundation

The self-hosting platform "egg": a single Pulumi project that brings up Forgejo (+ Actions + OCI/npm registry), PostgreSQL, HashiCorp Vault, RustFS (S3), and a reverse proxy as plain OCI containers on one VM — recoverable from {a VM, this repo, the master passphrase}.

This is Layer 0. Kubernetes, ArgoCD and everything else are Layer-1 consumers of this foundation (see ADR-004).

Layout

  • bootstrap/ — the egg Pulumi project (phases, components, config).
  • packages/ — shared, publishable Pulumi modules (@olsitec/pulumi-*).
  • preflight/ — host & toolchain validation (run before any deploy).
  • backup/, dr/ — backup + disaster-recovery automation.
  • .forgejo/workflows/ — CI (preflight, pulumi preview/up, backup-verify).
  • documentation/ — planning, ADRs, contracts, baseline overlay. Read documentation/000_baseline.md and documentation/000_TOPOLOGY.md first.

Status

Planning complete (PLAN-001 vision, PLAN-002 strategy, ADR-004/005 accepted). Implementation not yet started — next step is T00 (contracts) per PLAN-002 §10.

Recovery in one line

git clone this repo → set PULUMI_CONFIG_PASSPHRASE → ./preflight/preflight.sh → pulumi up → restore latest offsite backup. Full procedure: dr/RUNBOOK.md (TBD, task T13).