gitops — Materia repository

Declarative deployment of ~20 self-hosted services as Podman Quadlets to the Fedora CoreOS host core, managed by Materia.

Layout

MANIFEST.toml          # host -> components assignment (host: core)
components/<name>/      # one component per service
  MANIFEST.toml         #   services + secret declarations
  *.container[.gotmpl]  #   quadlets (.gotmpl = Go-templated)
  *.volume *.network *.image *.build
  <data files>          #   configs bind-mounted from the component data dir
attributes/
  vault.enc.yml         # sops+age encrypted secrets (committed)
  vault.yml             # plaintext source (gitignored)
deploy/                 # host units + Butane for Fedora CoreOS
key.txt                 # age private key (gitignored, host-provisioned)

common ships the shared postgres.image / redis.image.

How it works

• Quadlets install to /etc/containers/systemd; data files to /var/lib/materia/components/<name>/ and are referenced from .gotmpl quadlets via {{ m_dataDir "<name>" }}/....
• Repo-stored secrets live in attributes/vault.enc.yml (sops/age). Quadlets pull them via {{ secretEnv "key" "ENV_TARGET" }} (podman secret) or direct {{ .key }} interpolation (env files / JSON blobs).

See deploy/README.md for host bootstrap and mise run validate for checks.