Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform.
cute.haus
ansible
terraform
nix
k8s
jubilife: add codex
Aly Raffauf
(Jun 24, 2026, 2:27 PM EDT)
4b4dfb38
b524c29c
+11
-7
+1
-2
README.md
+1
-2
README.md
···
25
25
├── secrets/ # SOPS-encrypted yaml (multi-recipient age)
26
26
├── keys/ # Per-host + per-user age recipients
27
27
├── terraform/ # Cloudflare DNS, etc.
28
-
├── ansible/ # Server playbooks (deploy-offline, reboots)
29
-
└── BACKUPS.md # B2 backup + restore runbook (CNPG + Longhorn)
28
+
└── ansible/ # Server playbooks (deploy-offline, reboots)
30
29
```
31
30
32
31
---
+7
-4
k8s/charts/README.md
+7
-4
k8s/charts/README.md
···
21
21
├── forgejo/ # Git hosting (git.aly.codes)
22
22
├── longhorn-creds/ # B2 backup-target Secret + recurring backup job + UI ingress
23
23
├── morsels/ # atproto pastebin (morsels.blue)
24
-
├── pg-shared/ # CloudNativePG cluster + longhorn-pg StorageClass
24
+
├── pg-shared/ # CloudNativePG cluster using local-path replicas
25
25
├── tranquil-pds/ # TRanquil atproto Personal Data Server
26
26
├── uptime-kuma/ # Uptime monitoring + status pages
27
27
├── vaultwarden/ # Bitwarden-compatible vault
···
100
100
101
101
- **`cluster-tls`** — renders one `kubernetes.io/tls` Secret per entry in
102
102
`.Values.secret`, sourced from `secrets/cluster-tls.yaml`.
103
-
- **`pg-shared`** — a CNPG `Cluster` + a Longhorn `StorageClass`. Apps that
104
-
need a database get a role + database created manually in this cluster;
105
-
there's no per-app provisioning yet.
103
+
- **`pg-shared`** — a CNPG `Cluster` using `local-path` volumes for Postgres
104
+
data. CNPG provides HA with streaming replication across instances; B2
105
+
backups and WAL archiving cover recovery. A `longhorn-pg` StorageClass is
106
+
rendered for experiments or a future migration, but the live cluster does not
107
+
use it. Apps that need a database get a role + database created manually in
108
+
this cluster; there's no per-app provisioning yet.
106
109
- **`external-routes`** — for each entry in `.Values.routes`, renders a
107
110
`Service` + `EndpointSlice` + `Ingress` pointing at an external IP
108
111
(typically a Tailscale IP for a service running on jubilife or eterna).
+2
-1
k8s/helmfile.yaml
+2
-1
k8s/helmfile.yaml
···
173
173
174
174
# ─── Shared platform services ───────────────────────────────────────────
175
175
176
-
# CNPG Cluster (3-instance HA postgres) + longhorn-pg StorageClass.
176
+
# CNPG Cluster (3-instance HA postgres). Uses local-path for Postgres data;
177
+
# CNPG handles HA via streaming replication, while B2 backups cover recovery.
177
178
# Apps that need a database get a role + db here; see charts/pg-shared.
178
179
# Backup config (B2) lives in values/secrets/pg-shared.yaml.
179
180
- name: pg-shared