# Documentation

> Guides and reference material for secure, contract-driven infrastructure templates.

---

LLMS index: [llms.txt](/ainfra/v0.1/llms.txt)

---

`ainfra` is the infrastructure provisioning layer for projectious.work. It
combines strict contracts with a thin, local wrapper around OpenTofu and
Ansible:

<div class="ainfra-flow" role="img"
  aria-label="ainfra provisions a target, aibox deploys workloads, and
  processkit reconciles workspace content">
ainfra apply → provisioned target + non-secret output contract<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;→ aibox deploys workloads to that target<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;→ processkit reconciles workspace content
</div>

The project provisions targets. It does not build workload images, install
Kubernetes or processkit, deploy aibox fleets, or hide OpenTofu and Ansible
behavior.

## Find your path

| If you want to… | Start here |
|---|---|
| Validate and provision a disposable target | [Quickstart](/ainfra/v0.1/docs/getting-started/quickstart/) |
| Follow the complete Hetzner lifecycle | [Hetzner environment how-to](/ainfra/v0.1/docs/how-to/hetzner-baseline-environment/) |
| Understand ownership and tool boundaries | [Architecture](/ainfra/v0.1/docs/concepts/architecture/) |
| Review threat assumptions and invariants | [Security model](/ainfra/v0.1/docs/concepts/security-model/) |
| Operate plan, apply, output, and destroy | [Lifecycle operations](/ainfra/v0.1/docs/guides/lifecycle/) |
| Find an included infrastructure template | [Template catalog](/ainfra/v0.1/docs/reference/templates/) |
| Understand how templates are structured | [Template strategy](/ainfra/v0.1/docs/concepts/template-strategy/) |
| Author another infrastructure template | [Template authoring](/ainfra/v0.1/docs/guides/authoring-templates/) |
| Look up commands or schemas | [Reference](/ainfra/v0.1/docs/reference/) |

## Core promises

- Inputs are validated before infrastructure mutation.
- Apply identifies the exact reviewed plan.
- Destruction requires the exact reviewed destroy-plan ID.
- Credentials enter through references and child-process environments.
- Ordinary output contracts contain references, never secret values.
- Provider, image, automation, and scanner versions are pinned.
- Every automated gate is available locally.

---

Section pages:

- [Getting started](/ainfra/v0.1/docs/getting-started/): Install the toolchain and exercise ainfra safely.
- [Concepts](/ainfra/v0.1/docs/concepts/): Architecture, security, and state boundaries.
- [How-to guides](/ainfra/v0.1/docs/how-to/): Complete procedures for common ainfra operator tasks.
- [Guides](/ainfra/v0.1/docs/guides/): Operate the lifecycle, tooling, and template-authoring workflow.
- [Reference](/ainfra/v0.1/docs/reference/): Command, contract, template, and acceptance references.
- [Contributing](/ainfra/v0.1/docs/contributing/): Develop, test, and document changes locally.