Infrastructure Automation at Scale.

The platform runs on a six-node Talos Linux cluster (three control-plane, three workers) and treats the entire cluster as a single declarative artifact. ArgoCD self-manages from a root Application; one ApplicationSet then generates every other Application from a Git files generator over per-app config files, so onboarding a new workload never touches central wiring. Secrets are sealed at rest (SealedSecrets), TLS is issued automatically, and identity is centralized through an OIDC provider fronted by a Traefik ForwardAuth middleware.

Before this hub, four repos each carried their own copy of the same lint, scan, and publish jobs — and drifted. The catalog centralizes that job logic behind a typed input surface, versions it like any other dependency, and hardens the supply chain: images and charts are signed by digest and carry SPDX SBOMs as attestations. A weekly scheduled rebuild refreshes base layers so CVE fixes land without a Dockerfile edit, and the new digest propagates to consumers automatically.

kryptos started as a way to stop hand-running kubeseal and grew into a repo-agnostic tool. It reads a declarative config describing which secrets exist and how to produce them, resolves generators and derive types in two passes (so templates can reference other derived values), and writes SealedSecrets ready to commit. It ships a JSON schema for editor autocomplete, and its validate/diff/audit commands run offline — which is what lets CI verify secret configs without ever touching the cluster.

The design keeps three tools in their lanes and lets state flow between them instead of being copied. Terraform provisions the Proxmox hosts and the cluster VMs and writes its state to object storage; Ansible’s inventory is a script that reads that state live, so there is no static inventory to fall out of sync; Komodo watches the repo and, on push, redeploys only the Compose stacks whose content changed — a deliberate choice to avoid redeploying every service on every commit.

The registry is as much about consistency as distribution. Seventeen charts — covering stateful services, gateways, and utilities — share one authoring contract so any of them reads the same way. The pipeline validates changed charts by rendering and parsing them without a cluster, publishes idempotently to an OCI registry, and signs every release by digest (rolling back an unsigned chart rather than leaving it published).

Two automations keep the estate healthy and shareable. Renovate runs from one central project that autodiscovers every repo and applies a shared policy, with low-risk updates auto-merging after a soak so routine bumps never need a human. The mirror pipeline is what makes this very portfolio possible: it sanitizes each private repo against a layered config and refuses to publish unless a verification pass finds zero sensitive terms — turning internal work into public proof without leaking anything.