The tier that holds the household's real data is the one deployed by hand
stacks/sensitive/README.md says it plainly: "Nothing converges this stack. The homelab-* timers are the estate's; make validate notes their absence here as a skip, not a failure. This stack is deployed by hand, from a checkout on trinity."
ADR-0021 converges the estate on a timer instead of deploying over SSH, and the reasons it gives — a deploy that depends on one person's shell, drift between the repository and the host, a Dependabot bump that merges and never lands — apply more to this tier than to any other, because this is the one whose data ADR-0022 says changes the rules. Today's state is a consequence of authoring the stack ahead of its host, which was the right order; it stops being a reason the day trinity exists.
What to decide, then build
- Whether
trinity runs the same homelab-converge timer as prometheus, with HOMELAB_CONVERGE_APPLY at whatever the estate's setting is, or whether a tier with an off-estate copy and a seven-day CA gets a stricter one (report-only, apply by hand, as the estate ran until it trusted the mechanism).
- The SOPS recipient question ADR-0020 asks: the timer on
trinity needs to decrypt secrets/sensitive.sops.yaml, which means the tier's own age recipient on that host — already the design, not yet a key.
make validate's "skip" for this stack becomes a pass or a fail.
Done when
A Dependabot bump to stacks/sensitive merges and lands on trinity without anyone opening a shell, and converge-the-host.md names trinity beside prometheus.
Blocked on #404. Refs #404, ADR-0021, ADR-0020.
The tier that holds the household's real data is the one deployed by hand
stacks/sensitive/README.mdsays it plainly: "Nothing converges this stack. Thehomelab-*timers are the estate's;make validatenotes their absence here as a skip, not a failure. This stack is deployed by hand, from a checkout ontrinity."ADR-0021 converges the estate on a timer instead of deploying over SSH, and the reasons it gives — a deploy that depends on one person's shell, drift between the repository and the host, a Dependabot bump that merges and never lands — apply more to this tier than to any other, because this is the one whose data ADR-0022 says changes the rules. Today's state is a consequence of authoring the stack ahead of its host, which was the right order; it stops being a reason the day
trinityexists.What to decide, then build
trinityruns the samehomelab-convergetimer asprometheus, withHOMELAB_CONVERGE_APPLYat whatever the estate's setting is, or whether a tier with an off-estate copy and a seven-day CA gets a stricter one (report-only, apply by hand, as the estate ran until it trusted the mechanism).trinityneeds to decryptsecrets/sensitive.sops.yaml, which means the tier's own age recipient on that host — already the design, not yet a key.make validate's "skip" for this stack becomes a pass or a fail.Done when
A Dependabot bump to
stacks/sensitivemerges and lands ontrinitywithout anyone opening a shell, andconverge-the-host.mdnamestrinitybesideprometheus.Blocked on #404. Refs #404, ADR-0021, ADR-0020.