devdangroup.com Reconciled

Platform engineering — Sydney, Australia

Infrastructure that puts itself back the way it was written.

Dev Dan Group runs a small, self-hosted Kubernetes platform on bare metal. There is no console to click. Every host, workload, policy and certificate is declared in a Git repository, and the cluster continuously pulls itself back into line with it.

platform.yaml main@HEAD
# desired state — the cluster follows this file kind: Platform spec: host: bare-metal delivery: gitopsReady interval: 1m secrets: encrypted-at-rest-in-gitReady drift: revertedReady

Approach

Everything is a commit.

The operating system is built from Ansible playbooks rather than by hand, so a rebuild is a re-run instead of an archaeology exercise. Once the node is up, FluxCD takes over: it watches the repository and applies what it finds there. Nobody applies manifests from a laptop.

That constraint is the point. A change that is not in Git does not survive the next reconcile, which means the repository is an accurate record of the platform rather than an aspirational one — and the commit history doubles as the change log.

The platform is built against the guidance in the ASD Information Security Manual. It is aligned to those controls by design; it is not accredited or independently assessed, and nothing here claims otherwise.

Stack

Open source, all the way down.

  • K3s

    Lightweight Kubernetes on bare metal. No cloud provider, no managed control plane.

  • FluxCD

    GitOps delivery. The cluster pulls from Git; changes are never pushed to it.

  • Ansible

    Declarative host build and hardening, versioned alongside the workloads.

  • Kyverno

    Policy as code. Admission rules live in the repo with everything else.

  • SOPS + age

    Secrets are committed encrypted and only decrypted inside the cluster.

  • cert-manager

    TLS certificates issued and renewed automatically over DNS-01.

  • MetalLB + ingress-nginx

    Load balancer addresses and HTTP routing without a cloud load balancer.

  • external-dns

    DNS records are created from the services that need them, not by hand.

  • Longhorn

    Replicated block storage with snapshots, running on the node's own disks.

  • VolSync + Kopia

    Scheduled, deduplicated volume backups to separate local storage.

  • CloudNativePG

    PostgreSQL as a Kubernetes resource, managed by its own operator.

  • OpenTelemetry + Splunk

    Logs, metrics and audit events collected centrally and retained long term.

  • OAuth2 Proxy

    Single sign-on in front of anything that shouldn't be open.

The loop

Declare, reconcile, correct.

  • 01

    Declare

    Desired state is written as YAML and committed. Review happens in the pull request, before anything reaches the cluster.
  • 02

    Reconcile

    The cluster compares itself to the repository on a fixed interval and applies the difference. No manual deploy step exists.
  • 03

    Correct

    Anything that drifts is pulled back to what the repository says. A change made by hand is undone within the interval.