Platform Architecture¶
Overview¶
This platform is a mono-repo that provisions and manages a Kubernetes-based PaaS across two operational modes: local (KVM/libvirt on the operator workstation) and cloud (shared VPS infrastructure, e.g., Contabo/Hetzner).
Component Map¶
┌─────────────────────────────────────────────────────────┐
│ Operator Workstation (nix-darwin / NixOS) │
│ ┌─────────────┐ ┌──────────────────────────────────┐ │
│ │ nix devShell│ │ Terragrunt CLI │ │
│ │ SOPS/age │ │ → local profile → libvirt │ │
│ │ kubectl │ │ → cloud profile → VPS provider │ │
│ └─────────────┘ └──────────────────────────────────┘ │
└─────────────────────────────────────────────────────────┘
│ │
▼ ▼
┌─────────────────┐ ┌───────────────────────┐
│ Local KVM Lab │ │ Cloud Infrastructure │
│ libvirt VMs │ │ VPS Nodes (NixOS) │
│ K3S cluster │ │ RKE2 cluster │
└────────┬────────┘ └──────────┬────────────┘
│ │
▼ ▼
┌─────────────────────────────────────────────────────┐
│ Kubernetes Platform Layer │
│ cert-manager │ ingress-nginx │ Prometheus stack │
│ RBAC bases │ NetworkPolicies │ Operators │
└─────────────────────────────────────────────────────┘
│
▼
┌─────────────────────┐
│ Applications │
│ kubernetes/apps/ │
│ GitOps (Flux/Argo) │
└─────────────────────┘
State Isolation¶
Each terragrunt/environments/<env>/<stack> is an independent Terraform root.
No state is shared across environments or stacks. Cross-stack outputs use
Terragrunt dependency {} blocks exclusively.