Skip to main content
CI validates code. Terrakube plans, locks, and applies OpenTofu inside the homelab.
The CI/CD surface spans four runner tiers, with workflows picking a tier by the work they need to do. Credentialed OpenTofu runs are a separate control-plane concern owned by Terrakube. For how secrets reach a workflow regardless of tier, read Security — this page does not duplicate that material.

​
Runner tiers

Pick by what the workload actually needs: The decision tree is workload-first: a Darwin build picks GitHub-hosted macos-latest; a job that needs the always-on Studio picks mac-fleet; an IaC apply picks RunsOn; a public-repo lint picks GitHub-hosted; a Linux x64 job that must stay on-prem picks proxmox-fleet. The cost ordering is “free → very cheap → host-cost → host-cost”, but the cost is rarely what drives the choice.

​
The shape of every IaC pipeline

Public PRs never receive raw resolved plans. Terrakube keeps the full plan in the homelab workspace and obtains provider credentials through native OpenBao paths.

​
Branch protection and merge rules

The main branch on every trunk-flow IaC repo (default branch main, no develop) is protected by a ruleset, not a legacy branch-protection rule:
  • Required signatures (GPG)
  • Required linear history (no merge commits)
  • Required review-thread resolution before merge
  • Squash or rebase merge methods only (no merge-commit option)
  • Copilot Code Review auto-requested on every PR (review-on-open, not review-on-push)
An IaC repo on git-flow (default branch develop) instead follows Branch conventions: main requires merge commits from develop (squash and rebase banned there). The rules above apply to develop as its protected integration branch, except that develop allows merge commits for back-merges and stacked work — the “no merge commits” / “squash or rebase only” rules stay main-only. There is intentionally no required approving review count on solo-maintained personal repos — the gates that matter are the ruleset checks and the OIDC scope of the apply role. Multi-maintainer org repos under dryvist set the count in their own rulesets.

​
Where to go next

Dependency automation

Renovate trust tiers, scheduling, automerge policy, and version-pinning across every repo.

CI/CD policy

Marketplace actions, release-please conventions, the full runner-label catalog, on-prem runner requirements.

Git signing

Identity per execution context, the App-token pattern, deterministic-GHA signing.

tofu-runs-on

The RunsOn tier — the runner pool itself, OIDC trust, migration guide.

OpenTofu check placement

Static checks in pre-commit and CI; credentialed operations in Terrakube.

Security overview

How secrets reach a workflow, across all four runner tiers.

Infrastructure overview

Where CI/CD fits in the broader Proxmox + AWS picture.