Home Lab Blog http://localhost/documentation/blog Home Lab Blog Thu, 08 Oct 2026 00:00:00 GMT https://validator.w3.org/feed/docs/rss2.html https://github.com/jpmonette/feed en <![CDATA[Driving the whole stack from iac-ctl]]> http://localhost/documentation/blog/driving-the-stack-with-iac-ctl http://localhost/documentation/blog/driving-the-stack-with-iac-ctl Thu, 08 Oct 2026 00:00:00 GMT iac-ctl is an interactive terminal UI that runs each deployer's automation from one session, so you don't cd into every repo and run its playbook by hand.

Install it with uv sync and start it with uv run iac-ctl. The menu follows the deployment order. The playbook-based deployer actions (Vault, DevOps server, and application) list the repo's hosts and tags, ask you to pick at least one of each, confirm, and then run the playbook. The onboarding and dashboard actions list the repo's console scripts instead, and run the one you pick.

Actions that read from Vault check connectivity first, and the footer shows a warning when Vault is unreachable or DEVOPS_SERVER_INVENTORY_HOSTNAME is missing from the config's extra_vars. See the controller tool docs for every menu action.

]]> iac-ctl tooling <![CDATA[Vault as the platform's shared secrets store]]> http://localhost/documentation/blog/vault-shared-secrets http://localhost/documentation/blog/vault-shared-secrets Mon, 05 Oct 2026 00:00:00 GMT devops-server-deployer, devops-server-onboarding, and application-deployer read their secrets from one mTLS-secured Vault KV store. vault-deployer deploys that store, so it takes its secrets from the environment instead. Nothing secret is committed to a repo.

Each of those repos needs five values to reach Vault: VAULT_API_ENDPOINT, VAULT_API_KEY, and three base64-encoded PEM values for the CA certificate, client certificate, and client key. The three PEM values are decoded to temporary files at runtime.

Vault paths are scoped by CS_PROJECT_CODE, which is mandatory wherever it appears. An internal Root CA, also stored in Vault, signs every internal TLS certificate, including the PostgreSQL server and client certificates.

]]> vault security <![CDATA[Why the platform deploys in a fixed order]]> http://localhost/documentation/blog/deployment-order http://localhost/documentation/blog/deployment-order Thu, 01 Oct 2026 00:00:00 GMT The platform deploys in one order: vault-deployer, devops-server-deployer, devops-server-onboarding, application-deployer, then dashboard. Each stage after the first depends on something an earlier stage produced.

Vault goes first because every other repo reads its secrets and per-host config from it. The DevOps server comes next. Its PyPI mirror, shared PostgreSQL server, and source-hosting service all run on one host, and the PostgreSQL stage also seeds Vault with the downstream database credentials.

Onboarding then provisions users and publishes artifacts to the DevOps server's registries. application-deployer installs its dependencies from the devops-server package registry, so it can't run before that. The dashboard goes last because it links to, and monitors, everything else.

See the architecture notes for the full picture.

]]> architecture deployment