olsitec/foundation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
olsitec-foundation platform repo
35 commits 1 branch 0 tags 410 KiB
Find a file
Andreas Niemann 8603177096
All checks were successful
CI / preflight (push) Successful in 4s
Details
CI / typecheck (push) Successful in 15s
Details
pulumi-preview / preview (push) Successful in 19s
Details
feat(ci): state-dependent pulumi-preview + backup-verify pipelines (T14) 
Completes T14: the two CI pipelines that need Pulumi stack state, which
bootstrap/state/ is gitignored from. Solves the blocker by publishing a
fresh `pulumi stack export` to RustFS after every `up`, then having CI
pull + import it.

- state-publish.sh: ships the stack export to rfs/foundation-ci-state/
  foundation-stack.json via a throwaway mc container on foundation-net
  (ADR-007), exactly like backup.sh. Secrets inside the export stay
  passphrase-encrypted; config travels in the committed (encrypted)
  Pulumi.foundation.yaml. run.sh invokes it best-effort after `up`.
- rustfs.ts + Pulumi.foundation.yaml: declare the foundation-ci-state
  bucket (created belt-and-suspenders by state-publish on first run).
- pulumi-preview.yml (push/PR): read-only drift/PR check. Pulls + imports
  state, materializes the operator key from the SSH_PRIVATE_KEY secret
  (the provider + index.ts read it), `pulumi preview` — never `up`. A diff
  is informational so the job fails only on a program/preview error.
- backup-verify.yml (weekly + dispatch): reuses backup.sh/restore.sh
  unchanged to produce a bundle and restore-verify it from offsite
  (CONTRACT_004 §4.6). Imports real state so the bundle's pulumi-state.json
  is real, not an empty deployment.

Repo-scoped Actions secrets set via the admin API: PULUMI_CONFIG_PASSPHRASE,
SSH_PRIVATE_KEY, RUSTFS_ACCESS_KEY, RUSTFS_SECRET_KEY. Both pipelines
validated end-to-end in a foundation-ci container on the VM (preview exit 0;
backup-verify RESTORE VERIFY PASS from offsite).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-01 00:50:16 +02:00
.forgejo/workflows feat(ci): state-dependent pulumi-preview + backup-verify pipelines (T14) 2026-07-01 00:50:16 +02:00
backup feat(ci): baked CI image + runner config + self-check workflow (T14) 2026-07-01 00:15:01 +02:00
bootstrap feat(ci): state-dependent pulumi-preview + backup-verify pipelines (T14) 2026-07-01 00:50:16 +02:00
containers fix(ci-image): bump pulumi to 3.243 for bun packagemanager support 2026-07-01 00:50:16 +02:00
documentation docs(session): focus HANDOVER on T14-remainder then 999_testing ecosystem CI 2026-07-01 00:28:57 +02:00
dr feat(ci): baked CI image + runner config + self-check workflow (T14) 2026-07-01 00:15:01 +02:00
offsite-backup feat(offsite-backup): olsitec-foundation bucket + scoped creds on home MinIO 2026-06-30 20:34:55 +02:00
packages feat(provision): Phase-0 throwaway test VM via vendored @olsitec/pulumi-hetzner 2026-06-30 18:57:54 +02:00
preflight feat(preflight): host/toolchain validation + VERSIONS pin-file — T01 2026-06-30 18:00:26 +02:00
provision feat(backup): age at-rest encryption of bundles (CONTRACT_004 §4.3) 2026-06-30 23:23:38 +02:00
.gitignore feat(offsite-backup): olsitec-foundation bucket + scoped creds on home MinIO 2026-06-30 20:34:55 +02:00
bun.lock feat(bootstrap): postgres data-plane + remote helper (T03) 2026-06-30 21:10:34 +02:00
package.json feat(offsite-backup): olsitec-foundation bucket + scoped creds on home MinIO 2026-06-30 20:34:55 +02:00
README.md chore: scaffold olsitec-foundation mono-repo 2026-06-30 17:10:46 +02:00
VERSIONS fix(ci-image): bump pulumi to 3.243 for bun packagemanager support 2026-07-01 00:50:16 +02:00

README.md

olsitec-foundation

The self-hosting platform "egg": a single Pulumi project that brings up Forgejo (+ Actions + OCI/npm registry), PostgreSQL, HashiCorp Vault, RustFS (S3), and a reverse proxy as plain OCI containers on one VM — recoverable from {a VM, this repo, the master passphrase}.

This is Layer 0. Kubernetes, ArgoCD and everything else are Layer-1 consumers of this foundation (see ADR-004).

Layout

  • bootstrap/ — the egg Pulumi project (phases, components, config).
  • packages/ — shared, publishable Pulumi modules (@olsitec/pulumi-*).
  • preflight/ — host & toolchain validation (run before any deploy).
  • backup/, dr/ — backup + disaster-recovery automation.
  • .forgejo/workflows/ — CI (preflight, pulumi preview/up, backup-verify).
  • documentation/ — planning, ADRs, contracts, baseline overlay. Read documentation/000_baseline.md and documentation/000_TOPOLOGY.md first.

Status

Planning complete (PLAN-001 vision, PLAN-002 strategy, ADR-004/005 accepted). Implementation not yet started — next step is T00 (contracts) per PLAN-002 §10.

Recovery in one line

git clone this repo → set PULUMI_CONFIG_PASSPHRASE → ./preflight/preflight.sh → pulumi up → restore latest offsite backup. Full procedure: dr/RUNBOOK.md (TBD, task T13).