Home

Clouds Against Humanity

A small, cheap, locked-down DigitalOcean environment built with OpenTofu, applied by Spacelift, fed secrets by Doppler, and reached only through Twingate. Nothing in it listens on the public internet. It is a real extension of a homelab and, just as much, a teaching repository: every decision is written down along with the reason for it, including the ones that turned out wrong the first time.

Pick a path

The full tables, with page order, time estimates and checkpoints, are on Reading order. The short version:

You are...	Start with	Then
New to cloud, Terraform or zero trust	Start here if you are new	The eight primers, then the core path from the Architecture overview
An engineer who knows Terraform and wants the design	Architecture overview	Understand the design: OpenTofu, Terraform reference, Spacelift, Doppler, CI, then Trace one change
Building your own copy	The core path through CI and the cost gate	Build it yourself: Fork and private stacks, Labs, Build it, Settings reference
Security-minded	Threat model exercise	Security and threat modelling: Threat model, Threat Dragon exercise
Wondering how a company would do this, or how it would be watched	A small example: the enterprise landscape	Detection, Wazuh and the landscape
Curious how AWS, Azure and GCP differ (unverified drafts)	Why the clouds differ	Other clouds: AWS, then Azure, then GCP
Looking something up	Glossary, Troubleshooting index	Settings reference, Terraform reference

If you only read one page, read Why ZTNA and not a VPN: it is the reason the whole thing is shaped the way it is. It is long and opinionated, so newcomers are better off after the primers.

New to cloud, Terraform or zero trust? Start from zero

If words like "VPC", "Terraform", "CI" or "secrets manager" are new to you, the pages below assume too much. Start here if you are new maps homelab ideas to cloud ideas and then walks through eight short primers, each ending with where that idea lives in this repository. The capstone is the first page of the build track and comes after the core path:

#	Page	One idea, explained from zero
1	What is the cloud	What you are renting, why it has a public address, who is responsible for what
2	Networking basics for this project	Addresses, ports, firewalls, and why "no inbound" still works
3	Identity, secrets and zero trust basics	Passwords, tokens, keys, MFA, least privilege, and what zero trust means
4	What is infrastructure as code	Terraform and OpenTofu, plan and apply, state, drift, and how to read the code here
5	Git, GitHub and pull requests	How a change is proposed, checked by robots, reviewed and merged
6	Containers and Docker basics	Containers versus VMs, state, and what makes a Pi app cloud-shaped
7	How money works in the cloud	What costs, how bills get out of hand, and how the cost gate works
8	Enterprise engineering habits	Why a tiny lab does things the hard way, and which habits to take home
Build track, step 1	Fork, private stacks and the pipeline	Making your own private copy, which settings are demo values, and where the pipeline starts

After those, continue with step 10 of the core path below.

This is a small example. Two machines, one person, one cloud account. A company answers the same questions with different and often several products (other ZTNA and SSE platforms, tunnels, next-generation firewalls, identity providers, privileged access management, other secrets managers). A small example: the enterprise landscape maps this project's choices to what you may meet at work.

What you get out of this wiki

• How each component works, what it is responsible for, and why it was picked over the obvious alternative.
• Flowcharts for the network path, the deploy pipeline, the secrets path and the trust boundaries.
• The threat model, written out, including the risks that were accepted on purpose.
• The things that broke during the build and what fixed them, so you do not have to rediscover them.

The core path

Read these in this order. Each page ends with a Next line that names the following step, and Reading order has the same list with time estimates and checkpoints, plus every other track. Steps 1 to 9 are the start-from-zero pages above.

#	Page	What it answers
10	Architecture overview	What talks to what, and which arrows carry secrets
11	Why ZTNA and not a VPN	Why there is no VPN, no bastion and no open port
12	Twingate	Connectors, resources, groups, and why there are two connectors
13	DigitalOcean network and firewalls	VPC, tag-based firewalls, and why tags beat addresses
14	Droplet hardening	What cloud-init does to a connector before anyone logs in
15	OpenTofu, stacks and modules	Why OpenTofu, and why the code is split into layered stacks
16	Spacelift	How a change gets from a pull request to real infrastructure
17	Doppler and secrets	Where every secret lives and how it reaches a run
18	CI, tests and the cost gate	What runs on every pull request and why the bill cannot surprise anyone
19	Threat model	Assets, adversaries, trust boundaries, accepted risk
20	Lessons learned	What broke and why
21	Roadmap	Stages 0 through 4

Then pick a track on Reading order: build it yourself (fork, labs, build, settings), understand the design (Terraform reference, trace one change), security and threat modelling, detection and monitoring, or other clouds (unverified drafts). For lookups: Glossary, Troubleshooting index, Settings reference.

The short version

flowchart LR
    you["You, with the<br/>Twingate client"]:::you
    net["Public internet"]:::ext
    tg["Twingate<br/>control plane + relays"]:::ctrl
    subgraph do["DigitalOcean VPC"]
        ca["connector a"]:::cloud
        cb["connector b"]:::cloud
        host["private hosts<br/>(stage 3)"]:::cloud
    end
    you -- "authenticated,<br/>per-resource" --> tg
    ca -- "outbound only" --> tg
    cb -- "outbound only" --> tg
    ca --> host
    cb --> host
    net -. "every inbound port:<br/>filtered" .-x do

    classDef you fill:#132a1f,stroke:#4ade80,color:#dcfce7
    classDef ext fill:#3b1d1d,stroke:#f87171,color:#fde2e2
    classDef ctrl fill:#1e1b3a,stroke:#a78bfa,color:#ede9fe
    classDef cloud fill:#0f2a3d,stroke:#38bdf8,color:#e0f2fe

Loading

The droplets dial out. You dial out. Twingate introduces the two of you, checks that you are allowed to reach that exact host and port, and the encrypted session runs end to end between your client and the connector. There is nothing for a scanner to find.

Current state

Stage	Status	Monthly cost
0: foundation (project, VPC, baseline firewall)	Built	$0
1: access (two Twingate connectors)	Built	$12
2: logging back to the on-prem SIEM	Planned	not yet approved
3: workload host (Portainer, five daemons, Discord-to-Matrix bridge), Spaces bucket, Functions	Planned	est. $17, not yet approved
4: Grafana (runs on-prem)	Planned	not yet approved

Working ceiling: $30 per month across stages 0 to 4. The cost gate fails any pull request that would push the planned bill above what was approved.

Where this wiki comes from

These pages live in the main repository under docs/wiki/ and are published to the GitHub wiki by the Wiki workflow (.github/workflows/wiki.yml, which calls git-your-ship-together's wiki-publish.yml) on every merge to main. That is deliberate: edits go through a pull request, so the same secret scanning and review that guard the code also guard the documentation. Edits made directly in the GitHub wiki editor are overwritten on the next publish, so send a pull request instead.