HYB-3: OpenTofu multi-cloud substrate contract (design) — plat/mitosis#36 #48

Merged

plat merged 1 commit from docs/hyb-3-opentofu-substrate into main

2026-07-06 15:47:27 +00:00

plat commented

2026-07-01 02:15:27 +00:00

Owner

roadmap HYB-3 (#36), backlog/design-only. Design note only — no code; acceptance is a reviewed/merged contract doc.

Adds docs/proposals/opentofu-multicloud-substrate.md, fixing the contract every future substrate/<provider>/ OpenTofu module must satisfy so germinate/lib.sh stay cloud-blind.

The four-output contract each provider module must produce (and nothing germinate doesn't already consume):

(a) a reachable kubeconfig / kube context — germinate uses the ambient context (bin/germinate:39), it doesn't fetch one;
(b) a domain bound to the cluster — germinate takes DOMAIN and owns every downstream rewrite;
(c) registries.yaml pre-seeded at /etc/rancher/k3s/registries.yaml before k3s starts — the node-local mirror is Mitosis's sole image-sovereignty mechanism (recipe/registries.yaml.tmpl, bin/up:5-11);
(d) a declared inbound posture: tunnel-only (VPS-first default) vs public-IP+ACME.

Grounded in the real code: germinate already needs only DOMAIN + a working kubectl context; all cloud/k3d shape lives in one branch of bin/up (:79-102), with the generic bare-server fallback already spelled out at bin/up:104-116 and the tunnel cutover already opt-in (bin/germinate:477-480, bin/lib.sh:568-598).

Records OpenTofu over SST/CFN/Effect (MPL/LF HCL, ~3,900 providers incl. Hetzner/Cloudflare, liftable k3s modules; SST is AWS/serverless-shaped Pulumi-underneath; CFN is AWS-only; Effect is an effect-system, not IaC).

Explicit don't-build-now stance + the one invariant to protect immediately: reject any germinate/lib.sh change that assumes a specific cloud's shape. Ties to VPS-first HYB-1 (#25) / HYB-2 (#35) and the Cloudflare-tunnel default.

Do not merge — for review of the contract.

**roadmap HYB-3 (#36), backlog/design-only.** Design note only — no code; acceptance is a reviewed/merged contract doc. Adds `docs/proposals/opentofu-multicloud-substrate.md`, fixing the contract every future `substrate/<provider>/` OpenTofu module must satisfy so `germinate`/`lib.sh` stay **cloud-blind**. **The four-output contract** each provider module must produce (and nothing germinate doesn't already consume): - (a) a reachable kubeconfig / kube context — germinate uses the ambient context (`bin/germinate:39`), it doesn't fetch one; - (b) a domain bound to the cluster — germinate takes `DOMAIN` and owns every downstream rewrite; - (c) `registries.yaml` pre-seeded at `/etc/rancher/k3s/registries.yaml` **before** k3s starts — the node-local mirror is Mitosis's sole image-sovereignty mechanism (`recipe/registries.yaml.tmpl`, `bin/up:5-11`); - (d) a declared inbound posture: `tunnel-only` (VPS-first default) vs `public-IP+ACME`. **Grounded in the real code:** germinate already needs only `DOMAIN` + a working `kubectl` context; all cloud/k3d shape lives in one branch of `bin/up` (`:79-102`), with the generic bare-server fallback already spelled out at `bin/up:104-116` and the tunnel cutover already opt-in (`bin/germinate:477-480`, `bin/lib.sh:568-598`). **Records** OpenTofu over SST/CFN/Effect (MPL/LF HCL, ~3,900 providers incl. Hetzner/Cloudflare, liftable k3s modules; SST is AWS/serverless-shaped Pulumi-underneath; CFN is AWS-only; Effect is an effect-system, not IaC). **Explicit don't-build-now stance** + the one invariant to protect immediately: reject any germinate/lib.sh change that assumes a specific cloud's shape. Ties to VPS-first HYB-1 (#25) / HYB-2 (#35) and the Cloudflare-tunnel default. Do **not** merge — for review of the contract.

plat added 1 commit

2026-07-01 02:15:27 +00:00

HYB-3: OpenTofu multi-cloud substrate contract (design) e9d1073a7e

Design note only (no code). Fixes the four-output contract each future
substrate/<provider>/ OpenTofu module must satisfy so germinate/lib.sh
stay cloud-blind: (a) reachable kube context, (b) domain bound to the
cluster, (c) registries.yaml pre-seeded before k3s starts, (d) declared
inbound posture. Records OpenTofu over SST/CFN/Effect, the don't-build-now
stance + the one invariant to protect, and the tie to VPS-first HYB-1/HYB-2
and the Cloudflare-tunnel default.

roadmap HYB-3 (#36), backlog/design-only

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat referenced this pull request

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this pull request

2026-07-06 14:52:45 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this pull request

2026-07-06 14:52:46 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat merged commit 02ee692dd6 into main

2026-07-06 15:47:27 +00:00

plat referenced this pull request from a commit