No description
- Shell 41%
- Python 39.6%
- HCL 10.4%
- PowerShell 7.1%
- Makefile 1.9%
Kai Siren
8ea9a4f147Attachments were dropped in #274 because attachment-cache-dir needs an
explicit base-url and that URL carries the opaque tailnet suffix. Store
the base-url in SSM (/coilysiren/ntfy/base-url, String) and pull it via
a new ntfy-base-url ExternalSecret, the same pattern as the ts-authkey.
ntfy gets NTFY_BASE_URL from that Secret plus the two attachment env
vars back. The opaque suffix stays out of the repo.
closes #276
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Audit-log: coily://1779455358/AGPE7TPW - coily git add deploy/ntfy.yml
Audit-log: coily://1779455361/AGPE7TQC - coily
Audit-log: coily://1779455371/AGPE7TRI - coily ops aws sts get-caller-identity
Audit-log: coily://1779455372/AGPE7TRL - coily ops aws ssm get-parameter
Audit-log: coily://1779455372/AGPE7TRM - coily git commit
Audit-log: coily://1779455373/AGPE7TRP - coily
Audit-log: coily://1779455384/AGPE7TSZ - coily git push
Audit-log: coily://1779455412/AGPE7TWK - coily git log
Audit-log: coily://1779455412/AGPE7TWK - coily git show HEAD
Audit-log: coily://1779455412/AGPE7TWK - coily git status
Audit-log: coily://1779455446/AGPE7T2O - coily git show
|
||
|---|---|---|
| .claude | ||
| .coily | ||
| .githooks | ||
| .github/workflows | ||
| caddy | ||
| deploy | ||
| docs | ||
| hardware/kai-desktop-tower | ||
| llama | ||
| scripts | ||
| skills | ||
| sudoers | ||
| systemd | ||
| terraform | ||
| .gitattributes | ||
| .gitignore | ||
| .pre-commit-config.yaml | ||
| .pylintrc | ||
| .python-version | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| eco.md | ||
| Makefile | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||
infrastructure
Everything Kai needs to stand up and operate kai-server. Systemd units, shell scripts, k3s cluster manifests, and a small set of coily verbs for cluster-side bootstrap.
Layout
.
├── caddy/ # (legacy, pre-traefik caddy config)
├── deploy/ # cluster-wide manifests applied via coily verbs
│ ├── cert_manager.yml # cert-manager ClusterIssuers (DNS-01 via Route 53)
│ ├── externalsecret.yml # external-secrets sync rules
│ └── secretstore.yml # SecretStore -> AWS SSM Parameter Store
├── docs/ # durable ops documentation
├── llama/ # llama-service k8s manifests
├── scripts/ # systemd unit ExecStart/ExecPre scripts + Python helpers for coily verbs
├── systemd/ # systemd unit files
├── Makefile # entry points for coily verbs
└── eco.md # Eco server configuration notes
Operating the cluster
Cluster-bootstrap verbs are declared in .coily/coily.yaml and driven by Makefile targets that call scripts/k8s.py / scripts/llama.py. Common verbs:
coily cert-manager # re-apply cert-manager + ClusterIssuers
coily aws-secrets aws_access_key_id=<ID> aws_secret_access_key=<SECRET> # bootstrap external-secrets + aws-credentials
coily observability # install / upgrade VictoriaMetrics + Grafana
coily terraform-grafana action=plan # plan / apply Grafana dashboards via terraform
K3s service ops and game-server systemd ops live in coily core. Restart k3s with coily ssh systemctl restart k3s.service; tail / restart game servers with coily gaming <eco|core-keeper|icarus|factorio> ....
See docs/ for:
architecture.md— top-down view of what runs on kai-servercertificates.md— DNS-01 via Route 53 cert flow (no more HTTP-01 / hairpin-NAT hacks)
Commands
Dev commands are declared in .coily/coily.yaml. Run them as coily exec <verb>.
See also
- AGENTS.md - agent-facing operating rules.
- docs/FEATURES.md - inventory of what ships today.
- .coily/coily.yaml - allowlisted commands. Agents route through coily, not bare
make/uv/python/npm/cargo/dotnet.
Cross-reference convention from coilysiren/agentic-os-kai#313.