Infrastructure declared, typed and checked before it exists
Provisioning turns a Nickel declaration into the running system — servers, task services, clusters — and keeps the two in step.
Declared, typed and checked before it exists.
Declare a workspace once, then create servers, install task services and deploy clusters from the CLI, with dependency order, checkpoints and rollback handled for you.
A provider is an interface to implement and a task service is a catalog component with a manifest validated against a shared contract — the platform itself does not change.
One declaration · any provider · every change reviewable in Git
Configuration always, never a hardcoded value.
Declared, typed, checked — before it exists
One declaration drives every provider, every service and every cluster. What is declared is what runs, and what runs is checked against what was declared.
Configuration that cannot be wrong in shape
Every piece of infrastructure is a Nickel schema, validated before anything reaches runtime. TOML and YAML are generated output, never the source of truth — a malformed server, a missing dependency or an impossible plan is refused at the schema.
Order is structure, not a script
A workspace is composed as a typed dependency graph: containerd before etcd, etcd before Kubernetes, Kubernetes before Cilium. The orchestrator executes it in parallel where the graph allows, with checkpoints and rollback.
One platform, any provider
Providers are a pluggable interface: a new cloud is an implementation, not a change to the platform. Hard service boundaries hold underneath — provider APIs only in the orchestrator, authorization only in the Control Center, secrets only through the vault.
Architecture
Control plane — the orchestrator, Control Center, vault service, AI/MCP and extension registry, coordinated through the NATS JetStream event stream over shared persistence.
How it works
Define, orchestrate, execute.
Define with Nickel
Write servers, task services and clusters as typed declarations. Lazy evaluation and recursive merging compose them; a hierarchy of defaults, user, workspace and runtime configuration overrides them.
Orchestrate with Nushell
The provisioning CLI drives workflows as structured data pipelines — no fragile shell scripts. Operations report back as events on NATS JetStream, the single broker between services.
Execute with Rust
The orchestrator, Control Center and platform services are Rust: provider calls, SSH verified against pinned host keys, Cedar policy decisions and state in SurrealDB.
Infrastructure you can read, review and roll back
Everything lives in Git: schemas, Nickel modules and Nushell workflows are versionable, reviewable and reversible. Start from the platform overview or read how it is built.