An open, reproducible reference platform for demonstrating production-minded DevOps and site reliability engineering practices across local, on-premises, and cloud environments.
Phase 0: architecture and governance is complete. Phase 1 now delivers one minimal standalone Incus foundation on a Debian 13 VM, initially supplied by a small isolated AWS OpenTofu root. P1-01 provides pinned repository interfaces and fast quality gates; the Mac workstation is used for checks and optional disposable integration rather than persistent platform hosting. P1-02 through P1-04 passed real-host acceptance on the AWS reference VM, and P1-05 completed the provider-managed substrate lifecycle on the optional Lima environment. P1-06 will run the authoritative end-to-end reference-VM acceptance.
- Show one coherent delivery and operations system, not disconnected tool demos.
- Reproduce the platform locally with Incus before consuming cloud resources.
- Demonstrate secure delivery, identity, secrets, observability, and recovery.
- Keep environment-specific differences behind documented profiles and inputs.
- Record trade-offs, failure modes, operational evidence, and recovery results.
The planned platform connects Jenkins, Ansible, OpenTofu/Terraform-compatible modules, Incus, Kubernetes, GitOps, Vault/OpenBao, Keycloak, artifact services, observability, backup, and selected AWS and Azure integrations. Product choices and placements are defined in the architecture and the ADRs.
This project does not promise a turnkey production platform, hide cloud cost, copy employer code, or treat a successful deployment as proof of reliability. See the roadmap for the staged implementation.
The active Phase 1 checks require Git, GNU Make, Node.js/npm, Gitleaks, Python 3, and OpenTofu 1.12.6. Install the pinned local dependencies first:
make setup
make doctor
make checkSee the Phase 1 operator interface before any optional VM work. The enabled AWS lifecycle is documented in the AWS reference VM runbook; no cloud apply is automatic.
Read CONTRIBUTING.md before proposing a change. Architecture or security boundary changes require an ADR.
The registered public domain is apadanalab.de, with development services
below dev.apadanalab.de. Netcup currently provides both registration and
authoritative public DNS. Environment suffixes remain configurable inputs.
Repository-authored material is licensed under Apache License 2.0. Third-party products retain their own licenses; see the license policy.