incus_servers | The IncusOS bare-metal hosts themselves (managed via the Incus API, not SSH). |
incus_instances | Debian VMs/containers on those hosts (managed via SSH). Every instance lands in exactly one service-class child group below — except logi, the one-off GPU VM. |
k0s_primary_controllers / k0s_secondary_controllers / k0s_workers / k0s_cluster | The k0s cluster: operator-convention “primary” controller (bootstrap entry-point), the other etcd members, the 8 workers, and the union group for cluster-wide plays. Topology rationale: k0s cluster rebalance. |
backup_servers | Borg+ZFS backup VMs — backup1 (atomsk, primary) + backup2 (kyojin, secondary), each owning a USB JBOD. Design: backup strategy. |
step_ca_servers | The internal CA (step-ca intermediate). Single member: heimdall on hyperion. Replaced the in-cluster step-ca Helm release — see internal CA “Why we moved out of k0s”. |
docker_servers | Parent of docker_rootful + docker_rootless; the docker VM fleet (eren/mikasa/armin on kyojin, jean/connie/sasha on atomsk). Rootless is the default for the AI-agent threat model. |
caddy_proxies | Per-host caddy reverse proxies, all five hosts — articuno/zapdos (hyperion), moltres (theia) on the F5-NAT’d AQ114 side; kyogre (atomsk), groudon (kyojin) internal-only. Each serves static doc roots from its host’s static_sites volume and proxies object-storage paths to Garage. Edge design: HAProxy. |
haproxy_servers | The IncusOS HAProxy/keepalived L4 LB fleet — atlas (hyperion), prometheus + epimetheus (theia). Each is VRRP master for one VIP; keepalived fails a VIP over on haproxy death. This is the tier that fronts the public k0s Gateway: k0s public edge. |
lamp_databases | Per-site MariaDB hosts for the LAMP fleet — izanami (hyperion, AQ114-resident sites) + izanagi (atomsk, RH461-resident sites), no replication between them; PHP-FPM’s future home is k0s pods. Per-site config lives in the websites_lamp catalog. Design: k0s LAMP hybrid. |
dns_resolvers / dns_authoritatives | The internal DNS split: three CoreDNS forward-only resolvers (azelf/mesprit/uxie, one per k0s-bearing site pair) + the Knot authoritative (arceus) serving rrchnm.internal and the dynamic ACME zone. Full design + decision log: internal DNS. |
garage_cluster | Garage S3 object-storage trio (brahma/vishnu/shiva, RF=3). |
oci_mirrors | The Zot pull-through OCI mirror (thoth on atomsk): Zot. |
idm_servers | Kanidm identity servers — huginn (hyperion, serving) + muninn (theia, provisioned but not serving). Deliberately not in k0s: an IdM that gates access to the platform must not depend on that platform to authenticate you during an incident. Phase 0 serves from one instance because ACME dictates the topology. Full story: Kanidm + operator access; day-2 procedures: Kanidm HA runbook. |
package_proxies / apt_proxies | apt-cacher-ng per site (ho-oh AQ114, lugia RH461). Known sharp edge: stale metadata postmortem. |
caddy_kv_stores | Valkey (rayquaza) backing caddy’s distributed cert + rate-limit state; child of caddy_servers alongside caddy_proxies. |
cicd_servers | The CI/CD runner host (nidavellir on theia) running the self-hosted runner containers. Identity design: CI/CD identity. |
cicd_target_servers | The least-privilege boundary for what CI may orchestrate over SSH — a child group (today just caddy_proxies) gating both the group-scoped CI SSH key distribution and the nftables :22 accept rule. Widening or narrowing CI’s reach is a one-group repo edit; mechanics in ansible/README.md, identity design in the CI/CD identity runbook. |