Cloud accounts
The Google Cloud projects, Cloudflare zones and Google Workspace domain that OpenTofu declares, and what each one is for.
The lab has three cloud accounts: a Google Cloud organization, a Cloudflare account and a Google Workspace domain. kthx, public DNS and cluster workload identity depend on them. OpenTofu declares all three, and Atlantis applies them from pull requests.
Google Cloud#
The organization root declares folders, projects, budgets, policies, custom roles and IAM. The Google providers of most roots impersonate the terraform service account in homelab-ng.
| Project | What it is for |
|---|---|
homelab-ng | It has the OpenTofu state bucket, Firestore, and the oldboy VM. It also has the KMS key that unseals OpenBao, the Prowler cloud-scanner identity, the bucket and identity that back up the mate database, the SPIRE upload test bucket, and workload identity pools for GitHub Actions, Vercel, the clusters and SPIRE. |
bluenose | It has the storage, identities and Secret Manager of kthx. It is also the default Vessel, the project that kthx deploys Apps into. |
trusted-builds | The supply chain of kthx Apps. It has the signing key, the Binary Authorization attestor, a staging registry and the Developer Connect link to GitHub. |
lolcorp | Holds the org policies a Google Workspace BigQuery export needs. Nothing runs in it. |
wishin-app | The Firebase project of wishin.app, a gift wishlist site. |
jonpulsifer | The owner's jonpulsifer bucket and a dotfiles Cloud Source repository. |
projects.tf also declares firebees, kubesec, secure-the-cloud and cloud-glue, which no documented app uses.
Cloudflare#
The Cloudflare root declares the zones, the Cloudflare Tunnels that Ingress and DNS describes, and the Pages projects of wiki.lolwtf.ca and oidc.lolwtf.ca.
| Zone | What it is for |
|---|---|
lolwtf.ca | Lab hosts, cluster services and API servers, the wiki, and the cluster OIDC documents |
lolwtf.dev | The default zone for App names (KTHX_ENGINE_DOMAIN) |
kthx.dev | kthx at the apex, and its quick sites at <name>.kthx.dev |
clankerbanker.ca | clankerbanker |
embarrassing.ca | App names |
pulsifer.ca | pulsifer.ca on GitHub Pages, and mail on Google Workspace |
wishin.app | wishin.app on Vercel, and App names |
Google Workspace#
The Workspace root declares the pulsifer.ca domain, its alias pulsifer.dev, the owner's user, a terraform user and an agent user. Its cloud@pulsifer.ca group holds Owner and the organization admin roles in Google Cloud. The group's members include the agent user and the terraform service account.
Rules#
- Create a project in
terraform/gcp/organization/projects.tf, or it has no folder, billing account or deletion lien. Then give it a root. - The organization blocks new service account keys. Give a workload a federated identity.
- Keep a new App zone in step with the external-dns and cert-manager lists in Ingress and DNS, or its names do not resolve.
Where it lives#
terraform/gcp/organization/: the organizationterraform/gcp/projects/<project>/: the project rootsterraform/network/cloudflare/: the Cloudflare accountterraform/google-workspace/: Google Workspace
Related#
Linked from 4
- IdentitySPIRE on spore gives each folly node with a TPM 2.0 an identity rooted in its TPM, by LDevID or EK hash, gives its pods SPIFFE IDs, and lets a pod reach GCP with no key file.
- OpenTofu and AtlantisThe OpenTofu roots that declare the network, cloud accounts, identity and cluster bootstrap, and the Atlantis server that plans and applies them from pull requests.
- GlossaryThe lab-specific terms that the wiki pages use, what each means, and the page that defines it.
- Authorize Developer ConnectAuthorize the Developer Connect GitHub connection in the trusted-builds project after Atlantis creates or replaces it.