Erich Blume 6b84a5688e Add docs/ directory with blumeops zk cards

Move 21 blumeops-tagged zettelkasten cards from ~/code/personal/zk/
to docs/ in this repository. These files are symlinked back into the
zk at ~/code/personal/zk/blumeops for seamless obsidian.nvim integration.

This enables:
- Git-managed documentation in the blumeops repo
- Preserved wiki links between blumeops docs
- obsidian-sync isolation (docs don't sync to other devices)
- Direct editing via obsidian.nvim with the blumeops workspace

Also updates zk-docs mise task to read from local docs/ directory.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-02-02 19:17:10 -08:00

1.7 KiB

Raw Blame History

aliases

Pulumi Tailnet IaC Management Log

Pulumi manages the tail8d86e.ts.net tailnet configuration, including ACLs, tags, and DNS settings.

Architecture

Two-layer approach:

Layer 1 (Pulumi): Tailnet-wide config - ACLs, tags, DNS (this card)
Layer 2 (Ansible): Node-local tailscale serve config - see tailscale_serve role

Service Details

State backend: Pulumi Cloud (https://app.pulumi.com/eblume/blumeops-tailnet)
Stack: tail8d86e
Config directory: pulumi/ in blumeops repo
Policy file: pulumi/policy.hujson (HuJSON with comments)

Authentication

Uses OAuth client stored in 1Password (blumeops vault):

Client configured with scopes: acl, dns, devices, services
Auto-applies tag:blumeops to IaC-managed resources

Useful Commands

# Preview changes
mise run tailnet-preview

# Apply changes
mise run tailnet-up

# View current state
mise run tailnet-preview

# Pass additional args
mise run tailnet-up -- --yes

Making ACL Changes

Edit pulumi/policy.hujson in the blumeops repo
Run mise run tailnet-preview to see what will change
Run mise run tailnet-up to apply
Commit and push

What's Managed

Currently managed by Pulumi:

ACL policy (tailscale:index:Acl)

Can be added later:

DNS nameservers (tailscale:index:DnsNameservers)
DNS search paths (tailscale:index:DnsSearchPaths)
Tailnet settings (tailscale:index:TailnetSettings)

Log

Wed Jan 15 2026

Initial setup with Pulumi + Python
Imported existing ACL from Tailscale
State stored in Pulumi Cloud (free tier)
OAuth authentication via 1Password

1.7 KiB Raw Blame History