# SYSTEM

## Identity

`bugabinga.net` is private-cloud infrastructure managed with OpenTofu.
The repository owns the public relay, klops service deployment, Luci CI, public sites, and deployment assets.

## Topology

One Hetzner Cloud relay owns stable public IPv4 and IPv6 ingress.
One existing home server, `klops`, runs application workloads.
The nodes form a dual-stack WireGuard link.

Relay management SSH and WireGuard terminate on the relay.
Selected HTTP, HTTPS, Git SSH, and Luci SSH traffic is forwarded to klops.
Mail and authoritative DNS remain external at `box.bugabinga.net`.

## Service platform

Klops services are predominantly rootless Podman Quadlets managed by user systemd.
Caddy terminates public HTTP and HTTPS, routes applications, and serves static site and package content.
Host-level changes use root; ordinary workloads use the configured service user.
Luci has a dedicated rootless `ci` user, Podman socket, and storage boundary.

Soft Serve provides Git SSH over public bare repositories.
Repository configuration routes the public Git web interface to Luigit.

## Public presentation

The Nugu palette is authored outside this repository and vendored as deployable assets.
Caddy may serve narrowly scoped local presentation overrides before reverse proxying applications.