Quickstart

The shortest path from bare Proxmox to a synced cluster. Each step links to its phase page for details and checks.

Caution

Start only after Prerequisites: the tools installed, SOPS_AGE_KEY_FILE exported and every Phase 0 key in secrets/bootstrap.sops.yaml.

1. just core talos up — Proxmox VMs and Talos bootstrap (~15 min). Phase 1
2. just create-secrets — bootstrap Secrets for OpenBao and cert-manager, after pointing KUBECONFIG at core/kubeconfig (seconds). Phase 1
3. just core platform up — Cilium, Gateway API, cert-manager, Argo CD (a few minutes). Phase 1
4. just openbao-init — initialise and unseal OpenBao, save the unseal key (seconds). Phase 2
5. Put the key in SOPS, then just create-secrets and kubectl delete pod -n openbao openbao-0 (~1 min). Phase 2
6. just openbao-setup — Kubernetes auth, policies, roles, seeded app secrets (~1 min). Phase 2
7. just core cloudflare up — DNS records (~1 min). Phase 3
8. just core hetzner up — Bifrost VPS and its bootstrap (~8 min). Phase 3
9. just core authentik up — GitHub login, OIDC apps, ForwardAuth (~2 min). Phase 4
10. NetBird UI — log in as local admin, add Authentik as identity provider (~5 min). Phase 5
11. NetBird UI — create setup keys and an access token; add them to SOPS; just core hetzner up again (~5 min). Phase 6
12. Write the k8s-routing-peer key to OpenBao and add the LAN route (~2 min). Phase 6
13. just grafana-init — create Grafana’s Public org (seconds). Phase 7
14. git push — CI publishes manifests, Argo CD syncs (~3 min). Phase 8
15. Run the checks in Phase 9.

Every recipe is listed in the justfile reference.