Repo map¶
Where to find what.
Top-level¶
| Path | Purpose |
|---|---|
terraform/ |
Proxmox VM provisioning + Cloudflare zone. |
packer/ |
Ubuntu 24.04 cloud template builder (per-site .pkrvars.hcl). |
ansible/ |
Node prep + cluster bootstrap (6 roles, 19 playbooks). |
cluster/ |
Cluster-level resources (see below). |
argocd-apps/ |
96 ArgoCD Application manifests, app-of-apps pattern, grouped by domain. |
apps/ |
Helm values overlays for app-template-based apps (grouped by domain). |
sealed-secrets/ |
Secret templates (*.tpl) + sealed outputs (sealed/). |
docs/ |
Upstream docs mirrored + this folder (docs/onboarding/, docs/adr/). |
scripts/ |
Workstation setup scripts + Zed project setup. |
.claude/ |
Shared Claude skills (skills/) + hooks (hooks/). |
.github/workflows/ |
CI (pre-commit, manifest validation, tf plan, image tag verify). |
CLAUDE.md, PRINCIPLES.md, STATE.md |
Governance. |
cluster/ subsystems¶
| Path | Purpose | AGENTS.md |
|---|---|---|
cluster/argocd/ |
ArgoCD bootstrap + app-of-apps | — |
cluster/argocd-config/ |
RBAC, OAuth, CM | — |
cluster/authentik/ |
OIDC provider + outpost configs | — |
cluster/cert-manager/ |
Issuers, ClusterIssuers | — |
cluster/cilium-lb/ |
LB IP pools + L2 announce | ✅ |
cluster/cloudnative-pg/ |
PG operator | — |
cluster/cloudnative-pg-media/ |
Media PG cluster | — |
cluster/cluster-policies/ |
Kyverno cluster policies | — |
cluster/coredns/ |
In-cluster DNS overrides | ✅ |
cluster/coredns-lan/ |
LAN split-DNS per site | ✅ |
cluster/gateway/ |
Gateway API resources + HTTPRoutes | ✅ |
cluster/gateway-api-crds/ |
Experimental Gateway API CRDs | — |
cluster/grafana-dashboards/ |
Dashboard ConfigMaps | — |
cluster/kyverno/ |
Custom policies | ✅ |
cluster/longhorn/ |
Storage classes + config | — |
cluster/monitoring/ |
ServiceMonitor extras | — |
cluster/prometheus-home/ |
Home-zone PrometheusAgent | — |
cluster/synology-csi/ |
Synology iSCSI driver | — |
cluster/tetragon/ |
Tetragon eBPF policies | — |
argocd-apps/ by domain¶
| Subdir | Count | Notes |
|---|---|---|
ai/ |
1 | Ollama |
auth/ |
2 | Authentik + blueprints |
databases/ |
3 | CNPG, pg-cluster, pg-media |
dev/ |
4 | Gitea, Actions Runner, Coder, Renovate |
infra/ |
32 | Platform (Cilium, ArgoCD, cert-manager, Longhorn, Harbor, Velero, …) |
media/ |
24 | *arr stack + Jellyfin + downloaders + helpers |
monitoring/ |
6 | Prom-stack, Loki, Alloy |
office/ |
5 | Nextcloud, Collabora, Paperless, MinIO, Newsblur |
security/ |
4 | Tetragon, Trivy, Vaultwarden |
Where to look for X¶
| Question | Path |
|---|---|
| Why is app X failing? | argocd-apps/<domain>/<app>.yaml → apps/<domain>/<app>/values.yaml → cluster/ if CRD-driven |
| Network / VLAN / VM shape | terraform/vms.auto.tfvars, docs/onboarding/network.md |
| Node prep / bootstrap | ansible/playbooks/, ansible/roles/ |
| Image template basis | packer/<site>.pkrvars.hcl |
| Gateway / HTTPRoute / TLS | cluster/gateway/ |
| Cilium L2 / LB IPs | cluster/cilium-lb/ |
| Cluster-wide policy | cluster/cluster-policies/, cluster/kyverno/ |
| Secret schema | sealed-secrets/*.tpl; sealed outputs in sealed-secrets/sealed/ |
| Open bugs / hypotheses | .workingdir2/bugs/ (this-session snapshot; successor sessions read from STATE.md) |
| Architectural decisions | docs/adr/ |
| Tool versions | docs/TOOLING.md |