# Stable Private-Only Baseline

This document defines the current engineering target for this repository.

## Topology

- 1 control plane
- 2 workers
- private Hetzner network
- Tailscale operator access

## In Scope

- Terraform infrastructure bootstrap
- Ansible k3s bootstrap (using k3s embedded cloud provider)
- Flux core reconciliation
- External Secrets Operator with Doppler
- Tailscale private access

## Deferred for Later Phases

- Hetzner CCM (using k3s embedded for now)
- Hetzner CSI (deferred - local storage sufficient for baseline)
- Observability stack (deferred - complex helm release needs separate debugging)

## Out of Scope

- HA control plane
- public ingress or DNS
- public TLS
- app workloads
- DR / backup strategy
- upgrade strategy

## Phase Gates

1. Terraform apply completes for the default topology.
2. k3s server bootstrap completes and kubeconfig works.
3. Workers join and all nodes are Ready.
4. Flux source and infrastructure reconciliation are healthy.
5. External Secrets sync required secrets.
6. Tailscale private access works.
7. Terraform destroy succeeds cleanly or via workflow retry.

_Note: Hetzner CCM, CSI, and Observability are suspended for the stable baseline phase. Core platform only._

## Success Criteria

The baseline is considered stable only after two consecutive fresh rebuilds pass all phase gates with no manual fixes.