DevSecOps how-tos
The guides are grouped by when you reach for them, not by which task they happen to use.
Every guide shows both surfaces. The finished deliverable appears as a flow and as a script, because both reach the same atoms, and where one is genuinely the better tool for that job, the guide says which and why. For most of the work on this page that answer is the flow: an operator wants to know which host got as far as where when something fails at 3am, and only a flow keeps that record.
If you are new to the engine, read Flows and the atom reference first, these guides assume you know what a task is and go straight to assembling them.
Prepare
Section titled “Prepare”Getting a machine to the point where it can build anything.
| Guide | Goal |
|---|---|
| Prepare a build machine | A host with every toolchain a polyglot build needs |
| Prepare a container build workspace | The same toolchains as a reproducible image |
| Prepare a macOS build machine | The developer-laptop variant |
Turning source into binaries, across one repository or a hundred.
| Guide | Goal |
|---|---|
| Clone or refresh a repository fleet | Every repo present and current, in one command |
| Build every service from trunk | A complete set of binaries from the mainline |
| Build a tagged release | The same, reproducible from tags |
| Build a fleet in parallel | The same build, bounded concurrency, much faster |
| Build only what changed | Skip repositories whose source has not moved |
| Clean a build tree | Reclaim space without losing artefacts you still need |
Release
Section titled “Release”Cutting, publishing and correcting releases.
| Guide | Goal |
|---|---|
| Tag a release across many repositories | One version applied consistently to a fleet |
| Tag at a specific commit | A release cut from a known-good point, not from HEAD |
| Audit tags across the fleet | Find repositories that missed a release |
| Delete a tag safely | Remove a bad tag locally and remotely, in the right order |
| Publish artefacts to object storage | Binaries uploaded, checksummed and addressable |
Provision
Section titled “Provision”Standing up the services a deployment depends on.
| Guide | Goal |
|---|---|
| Provision a single-machine environment | Everything on one host, for evaluation or a small site |
| Install a container runtime | Rootless containers ready for workloads |
| Stand up PostgreSQL | A tuned, TLS-enabled relational store |
| Create a database and role | A per-service database with least privilege |
| Stand up ClickHouse with TLS | The analytical store, encrypted in transit |
| Stand up etcd | The coordination store, with certificates |
| Stand up object storage | Buckets, credentials and a health check |
| Stand up a search backend | Full-text search for content workloads |
| Stand up a package registry | An internal registry for private packages |
Secure
Section titled “Secure”| Guide | Goal |
|---|---|
| Rotate a secret across a fleet | A credential replaced everywhere, with no request failing |
| Renew certificates | Renewal on a schedule, proved by a handshake |
Planned
Section titled “Planned”| Guide | Goal |
|---|---|
| Stand up a secrets backend | A single-node secrets store, initialised and unsealed |
| Stand up a secrets backend in HA | The same, clustered, with no single point of failure |
| Stand up the API gateway | The edge, configured from a file you can review |
| Manage gateway config across environments | One source of truth, rendered per environment |
Operate
Section titled “Operate”Keeping it running.
| Guide | Goal |
|---|---|
| Restart a service safely | A restart that waits for readiness instead of hoping |
| Back up a service | A dated, verified archive on separate storage |
| Restore from a backup | A rehearsed restore, not a first attempt during an incident |
| Run scheduled maintenance | Patching and reboots on a window you choose |
| Stand up metrics collection | Scraping, retention and a first dashboard |
| Gate a flow on code quality | Builds that fail on regressions rather than reporting them |
| Run a flow across many hosts | The same change applied to a fleet, with bounded blast radius |
Add DNS
Section titled “Add DNS”| Guide | Goal |
|---|---|
| Add a DNS entry for a new service | A resolvable name, with the record checked before you rely on it |