Post-X Society Multi-Tenant Infrastructure

Infrastructure as Code for a scalable multi-tenant VPS platform running Zitadel (identity provider) and Nextcloud (file sync/share) on Hetzner Cloud.

🏗️ Architecture

• Provisioning: OpenTofu (open source Terraform fork)
• Configuration: Ansible with dynamic inventory
• Secrets: SOPS + Age encryption
• Hosting: Hetzner Cloud (EU-based, GDPR-compliant)
• Identity: Zitadel (Swiss company, AGPL 3.0)
• Storage: Nextcloud (German company, AGPL 3.0)

📁 Repository Structure

infrastructure/
├── .claude/agents/          # AI agent definitions for specialized tasks
├── docs/                    # Architecture decisions and runbooks
├── tofu/                    # OpenTofu configurations for Hetzner
├── ansible/                 # Ansible playbooks and roles
├── secrets/                 # SOPS-encrypted secrets (git-safe)
├── docker/                  # Docker Compose configurations
└── scripts/                 # Deployment and management scripts

🚀 Quick Start

Prerequisites

• OpenTofu >= 1.6
• Ansible >= 2.15
• SOPS + Age
• Hetzner Cloud account

Initial Setup

1. Clone repository:

   git clone <repo-url>
   cd infrastructure
   

2. Generate Age encryption key:

   age-keygen -o keys/age-key.txt
   # Store securely in password manager!
   

3. Configure OpenTofu variables:

   cp tofu/terraform.tfvars.example tofu/terraform.tfvars
   # Edit with your Hetzner API token and configuration
   

4. Provision infrastructure:

   cd tofu
   tofu init
   tofu plan
   tofu apply
   

5. Deploy applications:

   cd ../ansible
   ansible-playbook playbooks/setup.yml
   

🎯 Project Principles

1. EU/GDPR-first: European vendors and data residency
2. Truly open source: Avoid source-available or restrictive licenses
3. Client isolation: Full separation between tenants
4. Infrastructure as Code: All changes via version control
5. Security by default: Encryption, hardening, least privilege

📖 Documentation

• Architecture Decision Record - Complete design rationale
• Runbook - Operational procedures (coming soon)
• Agent Definitions - Specialized AI agent instructions

🤝 Contributing

This project uses specialized AI agents for development:

• Architect: High-level design decisions
• Infrastructure: OpenTofu + Ansible implementation
• Zitadel: Identity provider configuration
• Nextcloud: File sync/share configuration

See individual agent files in .claude/agents/ for responsibilities.

🔒 Security

• Secrets are encrypted with SOPS + Age before committing
• Age private keys are NEVER stored in this repository
• See .gitignore for protected files

📝 License

TBD

🙋 Support

For issues or questions, please create a GitHub issue with the appropriate label:

• agent:architect - Architecture/design questions
• agent:infrastructure - IaC implementation
• agent:zitadel - Identity provider
• agent:nextcloud - File sync/share