Platform
Platform
One section per domain: what runs, why it was chosen over the alternatives, and how it is wired together. Foundations and GitOps first, then networking and security, then the developer platform, observability, and the optional AI platform: self-hosted serving and the agent factory.
OpenTofu, Terramate, and the three-stage model two clouds implement — aws-0 on EKS, gcp-0 on GKE Standard — before Flux takes over; Cloud support maps where they differ.
Why Flux, the dependency hierarchy, and how manifests are validated before they merge.
Cilium as the eBPF data plane, Gateway API as the routing model, and Tailscale for every private service.
OpenBao’s PKI and secrets engine, cert-manager and External Secrets, Kyverno and CiliumNetworkPolicy defaults.
The App claim, its data services, and the App Wizard — a Crossplane Configuration package pinned from a sibling repo.
VictoriaMetrics, VictoriaLogs, and VictoriaTraces under one Grafana, plus the SRE agent that reacts to their alerts.
Opt-in vLLM serving behind Envoy AI Gateway, and the agent factory (work in progress): sandboxed coding agents under their own identity that turn labelled issues into pull requests.