Erich Blume c89e69e25f Add docs/ with blumeops zk cards (#82 )

## Summary
- Move 21 blumeops-tagged zettelkasten cards from ~/code/personal/zk/ to docs/
- Create symlink ~/code/personal/zk/blumeops -> blumeops/docs for obsidian integration
- Update zk-docs mise task to read from local docs/ directory
- Add blumeops workspace to obsidian.nvim config (strict=true)

## Benefits
- Docs are now git-managed in the blumeops repo (visible on GitHub)
- Wiki links between blumeops docs continue to work via symlink
- obsidian-sync isolation: docs don't sync to work laptop
- Direct editing via obsidian.nvim with dedicated workspace

## Testing
- [x] Files moved to docs/ (21 files)
- [x] Symlink created: ~/code/personal/zk/blumeops -> blumeops/docs
- [x] zk-docs mise task updated and working
- [ ] Verify obsidian.nvim link resolution (after merge)
- [ ] Verify obsidian backlinks work

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/82

2026-02-02 21:40:53 -08:00

1.7 KiB

Raw Blame History

aliases

Pulumi Tailnet IaC Management Log

Pulumi manages the tail8d86e.ts.net tailnet configuration, including ACLs, tags, and DNS settings.

Architecture

Two-layer approach:

Layer 1 (Pulumi): Tailnet-wide config - ACLs, tags, DNS (this card)
Layer 2 (Ansible): Node-local tailscale serve config - see tailscale_serve role

Service Details

State backend: Pulumi Cloud (https://app.pulumi.com/eblume/blumeops-tailnet)
Stack: tail8d86e
Config directory: pulumi/ in blumeops repo
Policy file: pulumi/policy.hujson (HuJSON with comments)

Authentication

Uses OAuth client stored in 1Password (blumeops vault):

Client configured with scopes: acl, dns, devices, services
Auto-applies tag:blumeops to IaC-managed resources

Useful Commands

# Preview changes
mise run tailnet-preview

# Apply changes
mise run tailnet-up

# View current state
mise run tailnet-preview

# Pass additional args
mise run tailnet-up -- --yes

Making ACL Changes

Edit pulumi/policy.hujson in the blumeops repo
Run mise run tailnet-preview to see what will change
Run mise run tailnet-up to apply
Commit and push

What's Managed

Currently managed by Pulumi:

ACL policy (tailscale:index:Acl)

Can be added later:

DNS nameservers (tailscale:index:DnsNameservers)
DNS search paths (tailscale:index:DnsSearchPaths)
Tailnet settings (tailscale:index:TailnetSettings)

Log

Wed Jan 15 2026

Initial setup with Pulumi + Python
Imported existing ACL from Tailscale
State stored in Pulumi Cloud (free tier)
OAuth authentication via 1Password

1.7 KiB Raw Blame History