Documentation
Documentation
ainfra is the infrastructure provisioning layer for projectious.work. It
combines strict contracts with a thin, local wrapper around OpenTofu and
Ansible:
ainfra apply → provisioned target + non-secret output contract
→ aibox deploys workloads to that target
→ processkit reconciles workspace content
→ aibox deploys workloads to that target
→ processkit reconciles workspace content
The project provisions targets. It does not build workload images, install Kubernetes or processkit, deploy aibox fleets, or hide OpenTofu and Ansible behavior.
Find your path
| If you want to… | Start here |
|---|---|
| Validate and provision a disposable target | Quickstart |
| Follow the complete Hetzner lifecycle | Hetzner environment how-to |
| Understand ownership and tool boundaries | Architecture |
| Review threat assumptions and invariants | Security model |
| Operate plan, apply, output, and destroy | Lifecycle operations |
| Find an included infrastructure template | Template catalog |
| Understand how templates are structured | Template strategy |
| Author another infrastructure template | Template authoring |
| Look up commands or schemas | Reference |
Core promises
- Inputs are validated before infrastructure mutation.
- Apply identifies the exact reviewed plan.
- Destruction requires the exact reviewed destroy-plan ID.
- Credentials enter through references and child-process environments.
- Ordinary output contracts contain references, never secret values.
- Provider, image, automation, and scanner versions are pinned.
- Every automated gate is available locally.
Last updated on