Reference
Pages to look up while you read or write this wiki: the glossary, the topology files and the style guide.
Reference pages are for lookup. They define the lab's terms, name the files that hold its network facts, and set the rules for writing these pages.
From purchase to workload identity is the security engineering brief: receiving evidence, provisioning gates, open-source building blocks and their tradeoffs.
DIY hardware-to-workload identity proposes a signed attester image, provisioning-time tool, narrow runtime identity service and SPIRE.
Folly node lifecycle and trust design explains the component relationships, design choices, experiments and threat boundaries.
From purchase to workload identityFollow a machine from receiving through NetBox and installation, then weigh Tinkerbell, direct BMC operation and simpler TPM enrollment.DIY hardware-to-workload identityA proposed signed bootstrap image, provisioning-time tool, narrow identity service and SPIRE stack, without Tinkerbell or a full fleetd daemon.Folly node lifecycle and trust designThe technical design, tradeoffs, evidence and threat boundaries for node provisioning, trusted boot and workload identity at folly.GlossaryThe lab-specific terms that the wiki pages use, what each means, and the page that defines it.TopologyThe two JSON files that hold the lab's network facts, the format rule they follow, and the Flux, Nix and OpenTofu code that reads them.Hardware inventoryThe nodes file that declares each folly Kubernetes node, the code that reads it, the OpenTofu root that applies it into NetBox, and the check that compares NetBox with the machines.Style guideThe rules for writing and reviewing wiki pages, runbooks and code comments in this repository.