DevSecOps how-tos
The guides are grouped by when you reach for them, not by which task they happen to use.
Every guide shows both surfaces. The finished deliverable appears as a flow and as a script, because both reach the same atoms — and where one is genuinely the better tool for that job, the guide says which and why. For most of the work on this page that answer is the flow: an operator wants to know which host got as far as where when something fails at 3am, and only a flow keeps that record.
If you are new to the engine, read Flows and the atom reference first — these guides assume you know what a task is and go straight to assembling them.
Prepare
Section titled “Prepare”Getting a machine to the point where it can build anything.
| Guide | Goal |
|---|---|
| Prepare a build machine | A host with every toolchain a polyglot build needs |
| Prepare a container build workspace | The same toolchains as a reproducible image |
| Prepare a macOS build machine | The developer-laptop variant |
Turning source into binaries, across one repository or a hundred.
| Guide | Goal |
|---|---|
| Clone or refresh a repository fleet | Every repo present and current, in one command |
| Build every service from trunk | A complete set of binaries from the mainline |
| Build a tagged release | The same, reproducible from tags |
| Build a fleet in parallel | The same build, bounded concurrency, much faster |
| Build only what changed | Skip repositories whose source has not moved |
| Clean a build tree | Reclaim space without losing artefacts you still need |
Release
Section titled “Release”Cutting, publishing and correcting releases.
| Guide | Goal |
|---|---|
| Tag a release across many repositories | One version applied consistently to a fleet |
| Tag at a specific commit | A release cut from a known-good point, not from HEAD |
| Audit tags across the fleet | Find repositories that missed a release |
| Delete a tag safely | Remove a bad tag locally and remotely, in the right order |
| Publish artefacts to object storage | Binaries uploaded, checksummed and addressable |
Provision
Section titled “Provision”Standing up the services a deployment depends on.
| Guide | Goal |
|---|---|
| Provision a single-machine environment | Everything on one host, for evaluation or a small site |
| Install a container runtime | Rootless containers ready for workloads |
| Stand up PostgreSQL | A tuned, TLS-enabled relational store |
| Create a database and role | A per-service database with least privilege |
| Stand up ClickHouse with TLS | The analytical store, encrypted in transit |
| Stand up etcd | The coordination store, with certificates |
| Stand up object storage | Buckets, credentials and a health check |
| Stand up a search backend | Full-text search for content workloads |
| Stand up a package registry | An internal registry for private packages |
Secure
Section titled “Secure”| Guide | Goal |
|---|---|
| Rotate a secret across a fleet | A credential replaced everywhere, with no request failing |
| Renew certificates | Renewal on a schedule, proved by a handshake |
Planned
Section titled “Planned”| Guide | Goal |
|---|---|
| Stand up a secrets backend | A single-node secrets store, initialised and unsealed |
| Stand up a secrets backend in HA | The same, clustered, with no single point of failure |
| Stand up the API gateway | The edge, configured from a file you can review |
| Manage gateway config across environments | One source of truth, rendered per environment |
Operate
Section titled “Operate”Keeping it running.
| Guide | Goal |
|---|---|
| Restart a service safely | A restart that waits for readiness instead of hoping |
| Back up a service | A dated, verified archive on separate storage |
| Restore from a backup | A rehearsed restore, not a first attempt during an incident |
| Run scheduled maintenance | Patching and reboots on a window you choose |
| Stand up metrics collection | Scraping, retention and a first dashboard |
| Gate a flow on code quality | Builds that fail on regressions rather than reporting them |
| Run a flow across many hosts | The same change applied to a fleet, with bounded blast radius |
Add DNS
Section titled “Add DNS”| Guide | Goal |
|---|---|
| Add a DNS entry for a new service | A resolvable name, with the record checked before you rely on it |