Glossary
The lab-specific terms that the wiki pages use, what each means, and the page that defines it.
This page defines the lab's own terms, and the tool terms that have a lab-specific meaning. Each row links to the page that explains the term.
| Term | Meaning | Page |
|---|---|---|
| Agent token | A 90-day credential that lets an agent call the kthx MCP endpoint | Connect an agent to kthx |
| Anchor network | The folly network for the anchors and other lab hosts | Network |
| App | In kthx, a source and the Components deployed from it | Built apps |
| Apps Gateway | The Gateway, with its own VIP, that serves kthx Apps on a cluster | Ingress and DNS |
| ARC | Actions Runner Controller, which runs the self-hosted GitHub Actions runners | Build and release |
| Artifact | What a kthx Build produces: an image digest or a file tree | Built apps |
| Atlantis | The server on offsite that plans and applies OpenTofu from pull requests | OpenTofu and Atlantis |
| Auto-upgrade | The daily rebuild of a NixOS host from main | NixOS |
| bluenose | The GCP project that holds kthx's storage and identities, and its default Vessel | Cloud accounts |
| Bootstrap root | The OpenTofu root in clusters/<site>/bootstrap/ that installs Flux on a cluster | How changes ship |
| Build | One run of a kthx build route | Built apps |
| Build host | A machine that runs Nix builds for other machines over SSH, such as forge | Build host and cache |
| Build route | Where a kthx Build runs, chosen by its SLSA level | Built apps |
| Built app | An App that kthx builds from a repository or archive, signs and deploys | Built apps |
| cathy | The office phone, a Cisco SPA504G | PBX |
| CD digest PR | The pull request on cd/update-digests that pins the newly built image digests in their manifests | Build and release |
| Class | In Bosun, what a runs-on: label resolves to | Bosun |
| Cluster CA | The FML certificate authority of one Kubernetes cluster | PKI |
cluster-gateway | The shared Gateway that apps on a cluster attach routes to | Ingress and DNS |
| Component | A service, website or job in a kthx App | Built apps |
| Connector | The Tailscale Connector that routes tailnet traffic into a site | Remote access |
| Datastore | A Postgres or Valkey instance that kthx gives to Apps | Built apps |
| Deploy | A kthx Artifact and config applied to a Target | Built apps |
| Fleet baseline | The NixOS modules of each deployable host | NixOS |
| Flux Kustomization | A Flux object that applies one directory of clusters/ | Kubernetes |
| FML | Folly Mountain Laboratories, the name of the lab's private certificate chain | PKI |
fml | offsite's console name for folly, and folly's home WLAN | Network |
| folly | The home site and its Kubernetes cluster | Network |
| Function | In kthx, a JavaScript fetch handler on Workers or Cloud Run | Built apps |
future | The folly network with an IPv6 prefix from the WAN | Network |
| Generation | One build of a NixOS system that a host keeps and can switch back to | Deploy a NixOS host |
| GitOps rule | The rule that nobody changes live state by hand | How changes ship |
| Host recipient | The age key of a host, derived from its SSH host key | Secrets |
| Hull | The kernel, initrd and manifest that a skiff boots from | Bosun |
infra GitRepository | Flux's copy of this repository | How changes ship |
| kthx | The lab's hosting product, with quick sites and built apps | kthx |
| kthx Apps tunnel | The Cloudflare Tunnel named spindrift, for public kthx names | Ingress and DNS |
| kthx engine | The controller in apps/kthx-engine that builds and deploys built apps | kthx |
| Lab resolvers | capsule and spore, which serve lab DNS and time | Ingress and DNS |
| mate | The code name and process of Rowbutt | How Rowbutt works |
nest | folly's console name for offsite | Network |
| offsite | The remote site and its Kubernetes cluster | Network |
| Operator key | The owner's age key, a recipient of every SOPS file | Secrets |
| Owner | The human who runs the lab. Pages name each controller, such as Flux. | Style guide |
| Quick site | A directory that kthx serves at <name>.kthx.dev | Quick sites |
| rackpi5 | The NixOS image that forge boots over HTTP when its NVMe does not boot | rackpi5 |
| Reach | A kthx Component's exposure: none, private or public | Built apps |
| Registry | nix/hosts/default.nix, the list of every host, image and package | NixOS |
| Root | An OpenTofu directory with its own state | OpenTofu and Atlantis |
| Rowbutt | The chat bot that gives the owner a coding agent in Discord and Slack | Rowbutt |
| Sandbox | The Kata microVM pod in which Rowbutt runs one thread's tools | Rowbutt |
| Site Magic | UniFi's WireGuard tunnel between the folly and offsite gateways | Routing and firewall |
| Skiff | A Bosun microVM that runs one GitHub Actions job and then halts | Bosun |
| Status | A page's state. live runs, experiment is a trial, parked is in the tree and runs nowhere, unplugged is powered off, off-git runs from config outside git, and unverified is unconfirmed. | Style guide |
| Tailnet | The owner's Tailscale network | Remote access |
| Target | One runtime on a Vessel, where a kthx Component runs | Built apps |
| Token signer | The key that signs a cluster's ServiceAccount tokens | PKI |
| Tronbyt | The self-hosted Tidbyt server on folly | Tidbyt apps |
| trusted-builds | The GCP project that holds the kthx signing key and attestor | Cloud accounts |
| Turn | One prompt to Rowbutt and the agent's answer | Rowbutt |
| Vessel | A cluster, GCP project, Vercel team or Cloudflare account that kthx deploys to | Built apps |
| VIP | A load-balancer address from LB_RANGE, announced over BGP | Routing and firewall |
| Workload identity | GCP access from an OIDC token of a cluster, GitHub Actions or Vercel, with no stored key | PKI |
| Zone | A group of UniFi networks that the gateway filters traffic between | Routing and firewall |
Linked from 1
- HomeThe owner's homelab at two sites, folly and offsite, managed as code: its apps, platform, hosts and runbooks.