feat: platform infra, dev tooling, and gitops validation

.fluxschema.yml

@@ -0,0 +1,13 @@
+apiVersion: schema.plugin.fluxcd.io/v1beta1
+kind: Config
+validate:
+  schemaLocation:
+    - default
+    - ecosystem
+    - https://raw.githubusercontent.com/datreeio/CRDs-catalog/main
+  failFast: true
+  skipMissingSchemas: false
+  skipFile:
+    - '.*'
+  verbose: true
+  output: text

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## What
+
+<!-- What does this PR do? -->
+
+## Why
+
+<!-- Why is this change needed? -->
+
+## Checklist
+
+- [ ] `mise run check` passes

.gitignore

@@ -22,8 +22,10 @@ venv/
 .retry/
 .ansible/
 ansible.log
+machines/collections/
 
 # Local overrides/secrets
+.certs/
 *.local.yml
 *.local.yaml
 *.local
@@ -43,6 +45,7 @@ id_rsa
 id_rsa.pub
 id_ed25519
 id_ed25519.pub
+*.agekey
 *_rsa
 *_rsa.pub
 *_ed25519

.shellcheckrc

@@ -0,0 +1,8 @@
+# All repository scripts use Bash.
+shell=bash
+
+# Follow sourced files when scripts add them later.
+external-sources=true
+
+# Keep variable references explicit and catch uninitialized environment assumptions.
+enable=check-unassigned-uppercase

.sops.yaml

@@ -0,0 +1,4 @@
+creation_rules:
+  - path_regex: (^|/)secrets(\.ya?ml|/)
+    encrypted_regex: "^(data|stringData)$"
+    age: age1hvn6a2qlvc2wzzax29psfxxuwrc58xv0226ysuphpr3dnhr5k4ysmwv087

.yamllint

@@ -0,0 +1,35 @@
+---
+extends: default
+
+ignore:
+  - "*/flux-system/*"
+  - "**/secrets.yaml"
+
+rules:
+  # Ansible allows yes/no; Kubernetes prefers true/false
+  truthy:
+    allowed-values: ['true', 'false', 'yes', 'no']
+
+  # Both ecosystems use 120
+  line-length:
+    max: 120
+    allow-non-breakable-words: true
+    allow-non-breakable-inline-mappings: true
+
+  # Ansible files don't always need ---
+  document-start: disable
+
+  indentation:
+    spaces: 2
+    indent-sequences: true
+
+  comments:
+    require-starting-space: true
+  comments-indentation: enable
+
+  trailing-spaces: enable
+
+  empty-lines:
+    max: 2
+    max-start: 0
+    max-end: 0

README.md

@@ -1,8 +1,29 @@
-# Overview
+# Homelab
 
-A playground for experiments, new tools, and whatever I feel like deploying—all in the name of learning.
+A personal homelab for learning, experimenting, and enjoying my passion for
+tech outside of work.
 
+## Architecture
 
-## License
+### Hardware
 
-This project is licensed under the [MIT LICENSE](LICENSE).
+| Component | Details |
+|---|---|
+| Host | ASUS ROG G700TF desktop server |
+| Operating system | Ubuntu Linux |
+| CPU | Intel Core Ultra 5 225F |
+| Memory | 16 GB |
+| Storage | 1 TB NVMe |
+| GPU | NVIDIA GeForce RTX 5060 with 8 GB VRAM |
+| Workstation | macOS system used for administration and development |
+
+### Software
+
+| Component | Responsibility |
+|---|---|
+| Linux server | Compute, local storage, and cluster host |
+| K3s | Container orchestration |
+| Flux | Keeps the cluster in sync with Git |
+| Ansible | Machine provisioning and configuration |
+| GPU runtime | Runs GPU-enabled workloads and AI experiments |
+| SOPS and age | Keeps secrets encrypted |