Config Management
Configuration is the seam between your code and the environment it runs in. Managed well, it makes systems portable, reproducible, and easy to reason about. Managed poorly, it becomes the source of outages that are hard to diagnose and harder to prevent.
This section covers configuration at every layer — from the formats you express it in, to how applications load it at runtime, to how hosts are provisioned before your code ever runs.
Articles
| Document | Description |
|---|---|
| config-formats | The serialization formats we use (JSON, YAML, TOML) and the command-line tools for working with them |
| application-config | How our services load, validate, and manage runtime configuration |
| feature-gate-lifecycle | Launch gates vs operational toggles: fail closed, retire by deletion, and the Helm/k8s mapping |
| host-config | Linux host provisioning — the system-level settings that establish a secure, consistent foundation |
| sops-application-secrets | SOPS + age for version-controlled application secrets — diffable keys, opaque values |
| pre-seeded-identity | Generating machine identity on the provisioner and baking it into images, so first boot decrypts its own secrets — no second deploy |
| simple-container-deployment | Deploying containerized services without an orchestrator |
| ci-build-deploy-pipeline | The standard website-project pipeline: check → build-and-push (SHA-tagged) → deploy-prod on main |
| flux | GitOps with Flux — the repo as desired state, fleet layering, and the reconcile loop's sharp edges |
| self-hosted-artifacts | Running your own registry: derived images, chart publishing, and tag discipline |