286aa12bb0
Point 7 of the page-wording review. The pages no longer show their data structure as headings, and they no longer explain their own conventions. - Level 1 is one screen: claim, status badge, three figures, the technology row, and one sentence carrying one link. Measured in headless Chrome at 1440x900: 1404-1845 px tall before, exactly 900 px (no scroll) after, on all six area pages. - DocPage: no kicker line, no visible level label, no "Evidence for this page" heading or instruction note, no "Drill-downs" list, no "Status <word> - sentence" footer. The artefact table starts at level 2, under the heading "Artefacts"; the history timeline is level 2 only. - Landing page: "Start here" link text gone, "How to read this site" panel gone, the footer's status-label explainer gone. - Content, presentation only, no claim softened: the leading H1 that duplicated the page title removed from all 41 documents; level 1 bodies reduced to the constraint as ordinary prose plus the way in; "**Status: ...**" prefixes removed from the artefact stubs; "## Drill-downs" and "## Period and confidence" removed from the level 2 pages, with the cross-area links moved into the prose. - The six level 1 claims are now sentences with a subject, and use commas instead of middots. Same facts, no new ones. Not in this commit: the 35 level 2 and 3 claims still use the compact CV style. That is a voice decision for Sam, not a wording tidy-up. make validate: 41 documents, 0 violations. go test ./...: pass. (cherry picked from commit 03009f80fc7815ad7719412e125df9297a6e653f)
52 lines
5.9 KiB
Markdown
52 lines
5.9 KiB
Markdown
---
|
||
id: platform-estate
|
||
area: platform
|
||
level: 2
|
||
title: "A small estate run to a documented standard"
|
||
claim: "Fifty or more containers on a four-host estate, all on declarative configuration — with packaging discipline · encrypted backups and a restore runbook · loopback-bound services · and one public listener."
|
||
confidence: running
|
||
period: "2020–"
|
||
tech: [NixOS, Proxmox, Docker, Caddy, Tailscale, Borg, Kopia, AWS S3, HDMI-CEC]
|
||
metrics: [{label: "containers in the estate", value: 50}, {label: "hosts", value: 4}, {label: "backup tiers", value: "Borg · Kopia · AWS"}, {label: "public listeners", value: 1}]
|
||
artefacts: [{type: doc, label: "Declarative multi-host configuration", url: "content/platform/l3/platform-nixos.md"}, {type: doc, label: "A hand-written Nix package with an exit plan", url: "content/platform/l3/platform-tuios-package.md"}, {type: doc, label: "Container inventory", url: "content/platform/l3/platform-containers.md"}, {type: doc, label: "Backups and restore runbook", url: "content/platform/l3/platform-backups.md"}, {type: doc, label: "Network layout and remote access", url: "content/platform/l3/platform-network.md"}, {type: doc, label: "Signage infrastructure — screens as a managed fleet", url: "content/platform/l3/platform-signage.md"}]
|
||
public: true
|
||
last_verified: 2026-10-26
|
||
tags: [platform, devops, nixos, docker, backups, networking]
|
||
---
|
||
|
||
**Capability statement.** Four hosts, fifty or more containers, configuration in version control instead of in a shell history, and one place where traffic enters. The estate is deliberately small because it is run rather than demonstrated.
|
||
|
||
## What is actually run
|
||
|
||
**Declarative configuration.** NixOS is the base on the machines that matter, with the desktop and the terminal replicated across them so an environment can be rebuilt from a description. Proxmox runs the virtualised side — Ubuntu file server and a Home Assistant appliance alongside the desktop hosts. The point of the arrangement is repeatability: a machine is a configuration, not a pet.
|
||
|
||
**Packaging.** When a tool is missing or stale in nixpkgs, it gets a derivation rather than a manual install. The TUIOS package pins 0.10.1 over nixpkgs' 0.7.0 with `fetchurl` and a verified hash, documents why the override exists, and states the condition for deleting it. A patch with an exit plan is maintenance; a patch without one is debt.
|
||
|
||
**Container estate.** Fifty or more containers run across the hosts — the file server and media services, the automation layer, the AI services, traffic for public ingress, and the tools used to build all of it. Each new service is given its own port, its own folder and a memory cap equal to its swap cap, so it cannot take the host's swap.
|
||
|
||
**Networking.** Remote access is a private mesh rather than an exposed SSH port: Tailscale across the machines, SSH on every host, and a phone used as a terminal. Services bind to loopback; Caddy is the only public listener, terminating TLS at the edge host and proxying the sites that are allowed to be seen.
|
||
|
||
**Storage and backups.** Three tiers, each covering a different failure: local snapshots on the machine, a copy on another machine over the network, and an offsite copy in object storage. Retention is stated in the job (daily, weekly, monthly, annual) and a restore runbook sits next to the jobs, because a backup nobody has restored from is an assumption.
|
||
|
||
**Observability and operations.** Resource use is watched at the host level, because the runtime host is memory-bound and a new service can destabilise the ones people rely on. The agent fleet is observed as a fleet through TUIOS — sessions, state and approvals in one console — rather than by tailing logs on four machines.
|
||
|
||
**Signage infrastructure.** The display work is treated as a fleet to be managed: HDMI-CEC control for power, rotation, mirroring and multi-screen layout, so screens are driven by the platform rather than by a person with a remote control.
|
||
|
||
## Evidence
|
||
|
||
| Claim | Evidence | Artefact |
|
||
|---|---|---|
|
||
| Configuration is declarative and replicated | NixOS hosts with shared configuration; Proxmox for the virtualised side | [Declarative configuration](l3/platform-nixos.md) |
|
||
| Tooling is packaged rather than hand-installed | `pkgs/tuios.nix` pinning 0.10.1 with a documented removal condition | [Nix package](l3/platform-tuios-package.md) |
|
||
| Fifty or more containers are operated | Inventory by host and by purpose | [Container inventory](l3/platform-containers.md) |
|
||
| Backups are three-tier with a restore runbook | Borg on two hosts, Kopia and Backrest on the edge host, offsite object storage | [Backups](l3/platform-backups.md) |
|
||
| One public listener | Loopback-bound services behind Caddy at the edge | [Network](l3/platform-network.md) |
|
||
| Screens are managed as a fleet | HDMI-CEC control of power, rotation and layout | [Signage infrastructure](l3/platform-signage.md) |
|
||
|
||
## Trade-offs and limits
|
||
|
||
- **Memory over hardware.** The runtime host runs 15 GiB with little free and swap in use. The response was caps, fewer and smaller services, and moving heavy work to the gateway rather than buying another machine. Every new service is sized before it is deployed, and the ceiling for this site is one gigabyte and four containers.
|
||
- **Self-hosting is a choice with a cost.** Monitoring, backups, ingress and the AI gateway are all operated here, which means the failure modes are also operated here. The mitigation is documentation and measurement, not optimism.
|
||
- **Rejected on purpose.** A long list of tools was evaluated and refused — Airflow for RAM, self-hosted Langfuse for six containers it could not afford, LiteLLM because it would duplicate the existing gateway, and a pile of documentation platforms. "Alternatives considered" is kept because the reasoning is the senior artifact.
|
||
- **Not everything is automated.** Some operations are still a documented command run by a person. The runbook exists precisely because the automations do not cover everything.
|