seanfarm

GitOps repo for sean.farm Kubernetes, storage, and build infrastructure.

Facts

• Flux bootstraps from Codeberg and reconciles kubernetes/flux/clusters/seanfarm/.
• Most manifests live in this repo. Some components also pull from separate Codeberg repos.
• Bootstrap secrets live in secrets/*.yaml.enc and are decrypted by make.

Layout

Path	Purpose
kubernetes/flux/clusters/seanfarm/	Flux cluster entrypoint
kubernetes/flux/clusters/seanfarm/infrastructure/	Cluster Flux Kustomizations
kubernetes/flux/infrastructure/	Component manifests
terraform/roots/	reusable Terraform roots for tofu-controller
secrets/	encrypted bootstrap inputs
docs/	short operational docs

Common Commands

brew install age sops hcloud kubectl flux
age-keygen -o ~/seanfarm-age-key.txt

make create
make rebuild
make destroy

Makefile reads ~/seanfarm-age-key.txt by default.

Rules

• Edit manifests, then test them. Land the change through the pipeline: branch from main, push the feature branch to Forgejo, open a pull request, then use binjovictl release seanfarm --build BUILD_ID --wait. The release service integrates the change. The laptop never pushes a default branch. See the full loop in Development Workflow.
• Prefer declarative changes over imperative cluster changes.
• Do not use kubectl apply for routine Flux-managed development.
• Use kubectl apply only for bootstrap/setup, emergency recovery, or temporary local verification before the matching commit is pushed.
• Use internal service DNS for in-cluster traffic.
• Pin images by version or digest. Do not use :latest.

Style

• Prefer manifest.yaml inside component directories.
• Use a semantic filename only when a directory contains multiple peer manifests.
• Avoid repeating a long dashed directory name in the filename.
• Let the directory name carry the component identity.

Docs

• Architecture — the 4-layer overview, and the DNS, TLS, secrets, and observability cross-cuts
• Development Workflow — the daily branch, pull request, release, and deploy loop
• Repos — where each git repo lives and why
• Pipeline — the workload CI/CD shape and its invariants
• Kernel Roll — the no-drama CVE-patch path
• Kernel Deploy Pipeline — LIVE: the in-cluster canary, smoke, gate, and worker-roll contract
• Node Replace Pipeline — historical design, not current execution instructions
• Rebuild Drill — PREPARED, NOT RUN: the runbook that proves the estate survives a make rebuild
• Laptop De-root — a historical assessment. Routine work now uses a non-admin token (2026-08-01).
• Style — naming, file conventions, commit messages
• Crossplane Primer — XRD versus Composition, the placeholder pattern, patch types, and gotchas (in the platform repo)
• AGENTS.md — repo conventions for human and AI contributors

docs/pipeline-security-audit-2026-06-26.md is a dated point-in-time audit. It is not a living document. Read it as a record of that date, not as the current state.

Native pipeline timing

Binjovi uses native agents for this project's Build, Release, and Deploy tasks. The configured deployment target is seanfarm-development. Native agents publish the selected Git revision and observe Flux convergence. Flux remains responsible for reconciliation of the selected resources.

Select an exact successful Build when you release:

binjovictl builds seanfarm
binjovictl release seanfarm --build BUILD_ID --wait
binjovictl status seanfarm

Open the project dashboard and expand an execution attempt to inspect its task timeline and available profiles. The latest completed pipeline summary includes Build and Release time as well as deployment time. Check the Deploy result separately after Release completes. Telemetry explains execution; the stored revision and verification evidence establish completion.

Kernel recovery creates a short-lived identity probe in binjovi-nodes. The control-plane role can delete those probe Pods after it reads the result. This permission does not grant cluster-wide Pod deletion.