ainfra is the security-first infrastructure provisioning layer for
projectious.work. It defines versioned infrastructure-template contracts and a
thin local wrapper around OpenTofu and Ansible.
ainfra apply -> provisioned target + non-secret output contract
-> aibox deploys workloads to that existing target
-> processkit reconciles content inside the workspace
The project provisions targets. It does not build workload images, install Kubernetes or processkit, deploy aibox fleets, or hide OpenTofu and Ansible behavior.
The current v0 implementation includes strict v1alpha1 contracts, local
security gates, reviewed-plan lifecycle controls, sanitized outputs, Ansible
inventory generation, and a disposable Hetzner Kubernetes-ready baseline.
The full path has been exercised on disposable Hetzner infrastructure, including deterministic SSH trust, Ansible check mode, an idempotent second apply, and complete teardown. It remains early-development software: review plans, understand the costs, and keep teardown ready.
- Reviewed plans. Apply requires the exact plan identifier that was reviewed.
- Explicit ownership. Destroy requires the exact reviewed destroy-plan ID.
- Secret boundaries. Inputs reference credentials; standardized outputs do not contain them.
- Private defaults. Public address allocation and management ingress are deliberate choices.
- Visible automation. OpenTofu owns infrastructure and Ansible owns host configuration; direct-tool behavior remains inspectable.
- Local gates. Contract, policy, formatting, type, security, and infrastructure checks run without GitHub Actions.
Template + non-secret input
│
▼
contract and policy checks
│
▼
reviewed OpenTofu plan
│
▼
infrastructure + hardened hosts
│
▼
non-secret output contract
│
▼
downstream workload deployment
Install the verified release binary, then initialize a separate infrastructure project:
curl --proto '=https' --tlsv1.2 --fail --location \
--proto-redir '=https' \
https://github.com/projectious-work/ainfra/releases/latest/download/install.sh \
-o /tmp/ainfra-install.sh
sh /tmp/ainfra-install.sh
ainfra --help
mkdir ../my-infrastructure
(cd ../my-infrastructure && ainfra init --name my-infrastructure)
(cd ../my-infrastructure && ainfra validate)
(cd ../my-infrastructure && ainfra doctor --environment development)For a disposable Hetzner plan, including cost and teardown guidance, follow the Quickstart.
Full documentation lives at projectious-work.github.io/ainfra.
| Section | Contents |
|---|---|
| Quickstart | Install, validate, plan, apply, and tear down |
| Concepts | Architecture, security, state, and secrets |
| Guides | Lifecycle operations, local gates, template authoring |
| Reference | CLI, schemas, Hetzner baseline, acceptance evidence |
| Contributing | Development and documentation workflow |
Build and serve the Hugo + Docsy site locally:
docs/scripts/build-docs.sh
docs/scripts/serve-docs.shsrc/ Rust CLI and lifecycle implementation
schemas/ Versioned public JSON Schema contracts
templates/hetzner-kubernetes-baseline/
OpenTofu, cloud-init, and Ansible template
tests/ Contract, policy, and lifecycle tests
docs/ Self-contained Hugo + Docsy site and tooling
scripts/ Local gates and documentation commands
Issues and pull requests are welcome. Start with the
contributing guide
and run scripts/validate-all plus scripts/test-all before submitting a
change.
Feature branches target v0.x-dev. Tested changes are promoted through
v0.x-pre-release and v0.x-release; published stable releases are merged
into main. See the
branching strategy
for the complete lane responsibilities and release rules.
Never place credentials, private keys, state, plans, or generated inventories in an issue or commit. Review the security model before operating live infrastructure.
MIT © Bnaard
Brand and design system © projectious.work. The ainfra mark is derived from that system.