lairkit¶

Self-hosted git, CI, secrets and deployments for a small team — on one Linux host, reachable only over your tailnet.

lairkit is a set of Cookiecutter templates. Each render produces a complete infrastructure repository that you commit and operate with one command, ./lk.

flowchart TB
  C["Core<br/>Forgejo · Infisical · Runner"]
  A["App repositories<br/>CryptPad · ERPNext · Jitsi Meet · Zipline"]
  H["App host"]
  B[(S3 backups)]

  C -->|"repo + secrets"| A
  A -->|"workflows"| H
  C -->|"backups"| B

Pick your starting point¶

You want	Use	Page
Git, CI, a secret store and backups	`cookiecutter-lairkit-core`	Set up a core instance
Core plus one app	Render the core, then an app template	Set up apps
To understand the design first	—	Architecture

Templates¶

Template	Renders
`cookiecutter-lairkit-core`	Forgejo, Infisical, Postgres, Redis, dind, Tailscale, a runner, Dozzle and Pages as ten Kamal accessories
`cookiecutter-lairkit-iac-cryptpad`	CryptPad with OnlyOffice
`cookiecutter-lairkit-iac-erpnext`	ERPNext v16 on MariaDB
`cookiecutter-lairkit-iac-jitsi-meet`	Jitsi Meet, Matrix chat and lldap
`cookiecutter-lairkit-iac-zipline`	Zipline file uploads and short links

The iac templates are grouped under Apps for setup and App operations for day-2 work.

The shape of a deployment¶

flowchart TB
  A[Render] --> B[Collect facts and secrets]
  B --> C[Commit and push]
  C --> D[Run install workflows]
  D --> E[Live instance]
  E --> F[Check, change, recover]

Core first. Render the core, collect facts, run the install.
Apps second. Render an app inside the core's repos/ directory, collect, push. Its workflows run on the core runner.
Operate from evidence. Every mutating action ends with one exit code and one git tag.

What lairkit is not¶

Not Kubernetes, not a PaaS, not multi-region, and not a monitoring product. It is one host per core, one facts file, and a small set of commands.

Before you start

lairkit installs software and changes hosts. Read Setup overview and have your host, tailnet and object store ready before running any command.