Skip to main content
CI validates code. Terrakube plans, locks, and applies OpenTofu inside the homelab.
The CI/CD surface spans four runner tiers, with workflows picking a tier by the work they need to do. Credentialed OpenTofu runs are a separate control-plane concern owned by Terrakube. For how secrets reach a workflow regardless of tier, read Security. This page does not duplicate that material.

​
Runner tiers

Pick by what the workload actually needs: The decision tree is workload-first. A Darwin build picks GitHub-hosted macos-latest. A job that needs the always-on Studio picks mac-fleet. An IaC apply picks RunsOn. A public-repo lint picks GitHub-hosted. A Linux x64 job that must stay on-prem picks proxmox-fleet. The cost ordering is “free → very cheap → host-cost → host-cost,” but cost rarely drives the choice.

​
The shape of every IaC pipeline

Public PRs never receive raw resolved plans. Terrakube keeps the full plan in the homelab workspace and obtains provider credentials through native OpenBao paths.

​
Branch protection and merge rules

A ruleset, not a legacy branch-protection rule, protects the main branch on every trunk-flow IaC repo (default branch main, no develop):
  • Required signatures (GPG)
  • Required linear history (no merge commits)
  • Required review-thread resolution before merge
  • Squash or rebase merge methods only (no merge-commit option)
  • Copilot Code Review auto-requested on every PR (review-on-open, not review-on-push)
An IaC repo on git-flow (default branch develop) instead follows Branch conventions: main requires merge commits from develop (squash and rebase banned there). The preceding rules apply to develop as its protected integration branch. The exception: develop allows merge commits for back-merges and stacked work. The “no merge commits” and “squash or rebase only” rules stay main-only. Solo-maintained personal repos intentionally have no required approving review count. The gates that matter are the ruleset checks and the OIDC scope of the apply role. Multi-maintainer org repos under dryvist set the count in their own rulesets.

​
Where to go next

Dependency automation

Renovate trust tiers, scheduling, automerge policy, and version-pinning across every repo.

CI/CD policy

Marketplace actions, release-please conventions, the full runner-label catalog, on-prem runner requirements.

Git signing

Identity per execution context, the App-token pattern, deterministic-GHA signing.

tofu-runs-on

The RunsOn tier — the runner pool itself, OIDC trust, migration guide.

OpenTofu check placement

Static checks in pre-commit and CI; credentialed operations in Terrakube.

Security overview

How secrets reach a workflow, across all four runner tiers.

Infrastructure overview

Where CI/CD fits in the broader Proxmox + AWS picture.