Platform
The shared systems that the apps and hosts depend on, and what applies each layer from git.
The platform is the shared systems that the apps and hosts depend on. Git declares each layer, and a controller or workflow applies it, as How changes ship describes.
| Layer | Path | Applied by | Page |
|---|---|---|---|
| Hosts | nix/ | The host's daily auto-upgrade, or nixos-rebuild | NixOS |
| Kubernetes | clusters/ | Flux in each cluster | Kubernetes |
| Network, cloud accounts and cluster bootstrap | terraform/ and clusters/<site>/bootstrap/ | Atlantis, on a pull request comment | OpenTofu and Atlantis |
| First-party code and images | apps/, packages/ and images/ | GitHub Actions, then Flux | Build and release |
Start here#
- Read How changes ship before changing the lab.
- Read Node lifecycle to follow a machine from inventory to installation.
- Read Identity to understand node and workload credentials.
- Use Backups and Observability to understand recovery and fault detection.
For commands, use the runbooks. For design decisions and trust limits, read the folly technical design.
Pages#
How changes shipThe path each kind of change takes from a pull request to the running system, and the GitOps rule that no one changes live state by hand.NixOSThe flake that builds each Linux host and OS image, the fleet baseline each host shares, and the daily upgrade from main.KubernetesThe folly and offsite Kubernetes clusters, how Flux applies clusters/ from git, and the sandbox runtimes and storage the clusters offer.WorkloadsWhat runs on the folly and offsite Kubernetes clusters, the files that list it, and the workloads that have their own page.NetworkThe two sites, their UniFi gateways and networks, and the tunnel, routes, ingress and tailnet that connect them.SecretsWhere secrets are stored, what decrypts them, and how they reach hosts and workloads.BackupsHow Garage, Velero, CloudNativePG and etcd snapshots back up the lab's databases, volumes and etcd, and how each site copies them to GCS.NetBoxThe record of every machine in the lab, on capsule, reachable only over the tailnet.PKIThe FML certificate chain, the Kubernetes cluster CAs and token signers, the cluster OIDC issuers, workload identity federation and the hardware DevID CAs.IdentitySPIRE on spore gives each folly node with a TPM 2.0 an identity rooted in its TPM, by LDevID or EK hash, gives its pods SPIFFE IDs, and lets a pod reach GCP with no key file.Node lifecycleHow a folly node goes from a NetBox device to an attested Talos node with a SPIRE identity, and back out, with the system that owns each step.OpenTofu and AtlantisThe OpenTofu roots that declare the network, cloud accounts, identity and cluster bootstrap, and the Atlantis server that plans and applies them from pull requests.Build and releaseHow first-party code builds, how its images and charts publish and deploy, how Renovate updates dependencies, and which CI checks run on a pull request.Cloud accountsThe Google Cloud projects, Cloudflare zones and Google Workspace domain that OpenTofu declares, and what each one is for.ObservabilityThe metrics, logs, traces, dashboards and alerts on each Kubernetes cluster, the hosts and Windows desktops they watch, and the daily k6 check.