Deploy from scratch
Each phase depends on the one before it. Most of the time is spent waiting for services to come up.
At a glance
Section titled “At a glance”| Phase | What | Time | Page |
|---|---|---|---|
| 0 | Tools, age key, SOPS secrets | one-time | Prerequisites |
| 1 | Proxmox VMs, Talos, platform | ~15 min | Cluster |
| 2 | OpenBao init, auth, app secrets | ~10 min | OpenBao |
| 3 | DNS and the Bifrost VPS | ~8 min | Bifrost |
| 4 | Authentik apps | ~2 min | Authentik |
| 5 | NetBird first login | ~5 min | NetBird login |
| 6 | NetBird keys, token, LAN route | ~5 min | NetBird keys |
| 7 | Grafana SSO and Public org | ~5 min | Grafana SSO |
| 8 | Publish manifests | ~3 min | Manifests |
| 9 | End-to-end checks | — | Verify |
Secrets quick reference
Section titled “Secrets quick reference”Key names only. SOPS means secrets/bootstrap.sops.yaml; env/ is core/cloud/bifrost/env/, written by just core hetzner up and gitignored. See Secrets for the full model.
| Key | Where it lives | Set in |
|---|---|---|
PROXMOX_PASSWORD | SOPS → Pulumi talos stack | 0 |
HCLOUD_TOKEN | SOPS → Pulumi hetzner stack | 0 |
CLOUDFLARE_API_TOKEN | SOPS → Secret cert-manager/cloudflare-api-token, env/traefik.env (as CF_DNS_API_TOKEN), Pulumi cloudflare stack | 0 |
AUTHENTIK_TOKEN | SOPS → env/authentik-server.env (as AUTHENTIK_BOOTSTRAP_TOKEN), Pulumi authentik stack | 0 |
AUTHENTIK_SECRET_KEY | SOPS → env/authentik-server.env, env/authentik-worker.env | 0 |
AUTHENTIK_POSTGRESQL_PASSWORD | SOPS → env/authentik-postgres.env, env/authentik-server.env, env/authentik-worker.env | 0 |
AUTHENTIK_GITHUB_SECRET | SOPS → Pulumi authentik stack | 0 |
GRAFANA_OAUTH_CLIENT_SECRET | SOPS → Pulumi authentik stack, OpenBao secret/grafana OAUTH_CLIENT_SECRET | 0 |
NETBIRD_CLIENT_SECRET | SOPS → Pulumi authentik stack; typed into the NetBird UI | 0 |
NB_DATA_STORE_KEY | SOPS → env/bootstrap.env | 0 |
NB_RELAY_SECRET | SOPS → env/bootstrap.env | 0 |
NB_OWNER_PASSWORD | SOPS → env/bootstrap.env | 0 |
OPENBAO_UNSEAL_KEY | SOPS → Secret openbao/openbao-unseal-key | 2 |
NB_PROXY_TOKEN | SOPS → env/netbird-proxy.env | 6 |
NB_BIFROST_SETUP_KEY | SOPS → env/netbird-agent.env (as NB_SETUP_KEY) | 6 |
ADMIN_PASSWORD | OpenBao secret/grafana (seeded) | 2 |
HARBOR_ADMIN_PASSWORD | OpenBao secret/harbor (seeded) | 2 |
ENCRYPTION_KEY | OpenBao secret/n8n (seeded) | 2 |
FALCOSIDEKICK_UI_USER | OpenBao secret/falco (seeded) | 2 |
RCON_PASSWORD, JOIN_PASSWORD | OpenBao secret/cs2 (seeded) | 2 |
NETBIRD_SETUP_KEY | OpenBao secret/netbird (placeholder in 2, real key in 6) | 6 |