Cloud

Everything outside the house: a Hetzner VPS that is the public edge, the SSO and VPN it hosts, and the DNS that decides what is public. Each is a Pulumi stack in core/cloud/, run from the laptop with just core <stack> up, never from CI.

Stack	Command	Manages
hetzner	just core hetzner up	VPS, firewall, Bifrost config upload and bootstrap
authentik	just core authentik up	GitHub source, OIDC apps, ForwardAuth provider
cloudflare	just core cloudflare up	Every DNS record in the zone

BifrostThe Hetzner VPS: Traefik, Authentik, NetBird, Gatus and its bootstrap.

NetBirdWireGuard mesh from Bifrost and laptops into the LAN, with first-time setup.

AuthentikGitHub SSO, OIDC for Grafana and NetBird, ForwardAuth for public routes.

ExposureWhat is reachable from LAN, VPN and internet, and how to make a service public.