Repositories
Six active repositories, one dependency direction, no overlap in responsibility. All are private under github.com/poindexter12.
Private repositories
Links to the repositories will 404 unless you have access. This site is the public-safe overview.
The map
| Repo | Role | Holds state? |
|---|---|---|
| jacaranda-inventory | Network intent registry | No — YAML + git history |
| jacaranda-foundation | Must-exist-first services | Yes (own tfstate branch) |
| jacaranda-homelab | Live infra monorepo — everything else | Yes (own tfstate branch) |
| jacaranda-modules | Shared modules, version-tagged | No |
| fleet | Pipeline controller app + its own deploy | Yes (local encrypted) |
| jacaranda-infra | Gen-1 monolith — retired, read-only reference | Historical |
jacaranda-inventory
The source of truth for network intent: VLANs, IP allocations, DNS records, Proxmox node placement — as YAML, validated by a Go CLI (registry). No database; git is the history.
registry reserve / release / set-statusmutate allocations with invariant checks; nothing ever deletes.registry query --format jsonis the machine interface other repos build on (Ansible inventories, DNS publishing).registry dns-exportemits the full DNS picture in zone-file form.- CI runs
registry check --stricton every push.
jacaranda-foundation
The must-exist-first layer, deliberately standalone (ADR-0001): if everything else burns down, foundation can rebuild the world.
| Service | What | Shape |
|---|---|---|
| pihole | DNS filtering + the estate's authoritative internal DNS | 4 LXC replicas (2 profiles × HA pair) |
| secrets-server | 1Password Connect Server | 3-node Keepalived HA |
| step-ca | SSH Certificate Authority | 3-node Keepalived HA |
| fleet ops | Cross-service SSH keys, packages, baseline | Recipes, not a service |
Deploys run in two phases: deploy (stand up on hardcoded IPs, bootstrap TLS) then finalize (register DNS, switch TLS to step-ca, sign SSH host certs). Foundation also owns full-dns-sync — the applier that publishes the entire registry's DNS to every Pi-hole.
jacaranda-homelab
The live infra monorepo — every directory maps to real running things, in three tiers:
| Tier | Meaning | Contents |
|---|---|---|
platform/ | Shared capabilities services build on | postgres, ingress, observability, authelia (being rebuilt — see Roadmap) |
hosted-apps/ | Third-party apps we run | musa (Twenty CRM), inbox-zero, maxwells-wallet |
physical/ | Bare-metal hosts — SSH-CA + DNS only | Ansible-only, no VM creation |
Each stack follows one layout: terraform/envs/{test,prod} roots symlinked to a shared _env.tf, Ansible inventory generated from the registry, one justfile with op read as the only secrets seam. This site also lives here, under site/.
jacaranda-modules
Reusable OpenTofu modules and just helpers, consumed via git::ssh://…//<module>?ref=vX.Y.Z — exact tags, no ranges, no submodules. Notable modules: lxc-docker-app (the standard single-LXC app shape), vmid-ranges (VMID validation every stack pins), ssh-host-cert. Contains no state, no environment specifics, no real IPs.
fleet
A self-authored controller CLI for pipeline stacks. Application source repos normally contain no infrastructure — fleet is the exception that proves the owner-based rule: self-authored apps keep their own deploy/, and its deploy consumes jacaranda-modules exactly like the monorepo stacks do.
jacaranda-infra (gen-1)
The original monolith: NetBox IPAM, Telmate provider, a central DNS aggregation stack. Retired piece by piece — its audit (jacaranda-homelab/docs/GEN1-AUDIT.md) is why the current principles exist. Kept read-only for reference; never apply from it.
Archived
jacaranda-maxwells-wallet, jacaranda-musa, jacaranda-physical-nodes — gen-2 per-service repos whose stacks were imported into the monorepo (2026-07). Archived on GitHub; their state and deploys live in jacaranda-homelab now.