Access

Everything private on this platform is reachable only over Tailscale — there is no public entry point to punch through.

Network

tailscale status

You should see the subnet router advertising the VPC CIDR. Every private service (OpenBao, the Kubernetes API, Grafana, Homepage, and so on) resolves under the private domain you set in opentofu/config.tm.hcl, and is only reachable once you are connected to the tailnet.

OpenBao

export VAULT_ADDR=https://bao.priv.cloud.ogenki.io:8200
export VAULT_CACERT=opentofu/openbao/management/.tls/ca.pem   # written by `openbao-config.sh ca`
bao status
bao login -method=userpass username=admin

Prefer VAULT_CACERT over VAULT_SKIP_VERIFY — it validates the server certificate against the real chain instead of skipping verification entirely. The admin password is generated by the openbao/management stack and published to AWS Secrets Manager:

aws secretsmanager get-secret-value \
  --secret-id openbao/cloud-native-ref/users/admin \
  --query SecretString --output text | jq

Kubernetes

aws eks update-kubeconfig --region eu-west-3 --name mycluster-0
kubectl get nodes
flux get all

Platform Dashboard

Once Flux has reconciled Tooling, the Homepage dashboard aggregates every deployed service — Grafana, Harbor, Headlamp — behind one private hostname, alongside cluster health and documentation links. It is reached the same way as every other private service: over Tailscale, through the general Gateway.