About Provisioning
An infrastructure-as-code platform that manages the whole lifecycle — cloud providers, infrastructure services, clusters and isolated workspaces — from typed declarations, across cloud and local environments.
What it is
Provisioning is a declarative platform for infrastructure orchestration. You describe servers, the services installed on them and the clusters they form as Nickel schemas; the platform validates that description, resolves its dependencies and carries it out on the provider you choose.
It combines three layers: Nickel for typed configuration, Nushell for orchestration as structured data pipelines, and Rust for the performance-critical services — the orchestrator, the Control Center, the vault service and the platform daemons.
It runs interactively, as a headless CLI for scripted automation, or unattended in CI/CD pipelines; and in solo mode the whole architecture runs on a single operator's machine.
What it does
- ▸ Provisions servers, networks and storage across cloud providers and local infrastructure.
- ▸ Installs task services — container runtimes, Kubernetes, networking, storage, databases, observability.
- ▸ Deploys complete clusters with multi-node coordination and dependency management.
- ▸ Resolves a hierarchical configuration: defaults, user, workspace, infrastructure and runtime.
- ▸ Runs batch workflows with parallel execution, checkpoint recovery and rollback.
- ▸ Keeps secrets encrypted with SOPS and Age, served to services only through the vault.
Core concepts
Six building blocks, each declared in Nickel.
Providers
Backends that create and destroy resources — cloud APIs, local VMs, Docker or bare metal. They implement one common interface, so infrastructure code stays portable.
Task services
Reusable components installed on servers — containerd, Kubernetes, Cilium, PostgreSQL, Prometheus and more — each with versions, declared dependencies, health checks and its own schema.
Clusters
Complete deployments that combine servers and task services: a highly available Kubernetes control plane with workers, CNI and storage, or a replicated database with backups.
Catalog
The library of providers, components and clusters the platform composes. Every component carries a manifest validated against a shared contract, distributed as a content-addressed OCI artifact.
Workspaces
Isolated environments for projects or stages, each with its infrastructure definitions, configuration and runtime state, switched with a single command.
Workflows
Coordinated operations — server, task service, cluster and batch — executed as a typed dependency graph, in parallel where possible, with progress monitoring.
What never changes
Four invariants hold across the whole platform. They are not guidelines: they are enforced from the schema to the runtime.
Configuration, always
Nothing is hardcoded. Runtime arguments override environment, which overrides user, infrastructure and default configuration.
Types before runtime
All infrastructure configuration is a Nickel schema. TOML and YAML are generated output; every change is validated at the schema before it reaches a running system.
Hard service boundaries
Six boundaries with six layers of enforcement: provider APIs only in the orchestrator, SSH only in the orchestrator and machine services, authorization only in the Control Center, secrets only through the vault.
Providers as an interface
A provider is a pluggable interface. Adding one means implementing it in the catalog — never changing the platform.
See the whole platform
The platform services, the extension model and the technology underneath, in one place.