Overview

An opinionated system for managing arbitrary cloud infrastructure via Terraform / OpenTofu Infrastructure-as-Code (IaC).

An opinionated, production-ready Kubernetes stack that aims to replace the use of managed cloud services. Importantly, it is:

1. Cloud-provider agnostic
2. Controlled transparently via customizable IaC
3. Configured with batteries included: autoscaling, policy engine, service-mesh, monitoring, etc.

A Nix-based DevShell that includes:

1. A local CLI / web-interface for deploying, managing, and operating the IaC and deployed infrastructure
2. Popular, version-matched utilities for the infrastructure
3. Integrations for popular coding agents for secure and safe infrastructure management

1. IaC submodules that support a production-ready SDLC: hardened deployment patterns, CI/CD, observability, etc.
2. IaC submodules for infrastructure primitives like databases, CDNs, object storage, and more.
3. Plug-and-play IaC modules for popular OSS projects such as Airbyte, Temporal, etc.

The DevShell is a Nix flake this is used to install version-specific, OS-compatible toolchains necessary to install and operate a PCNF deployment.

This is setup in a dedicated git repository (created JIT, if needed) that will house the IaC for the deployment. All configuration and tools are scoped to this repository so that your local system will not be polluted by anything that PCNF does.

Our installer takes care of this bootstrapping process for you. It ensures the repository exists, your system has the prerequisites available to begin working with the DevShell, and provides guidance on next steps once installation is complete.

Once the DevShell is running, our pf CLI tool is used to create a new environment.

An environment is the primary bounding box for deployed infrastructure. Every piece of infrastructure is deployed to an environment and can only communicate with other infrastructure deployed to that same environment by default. Network topology and RBAC are environment-scoped. Environments can span multiple clusters, regions, and even cloud providers. Learn more here.

The pf tooling takes you through a guided process for all necessary steps including setting up cloud provider accounts, deploying IaC state backends, configuring DNS, etc.

By the end of this process your git repository will be set up with all the necessary configuration to begin deploying real infrastructure.

PCNF uses Kubernetes as the primary workload orchestrator and almost everything we deploy is designed to run inside the Kubernetes clusters the framework deploys.

You can learn more about what a PCNF cluster contains here.

The pf tooling takes you through a guided process for all the necessary steps to deploy a new cluster to an environment.

By the end of this step, you will have a production-ready cluster that can start running workloads. This will be defined entirely in IaC inside your git repository.

The first workload that we recommend deploying is Authentik, an identity provider that enables you and your users to connect to live infrastructure via SSO.

One core paradigm in PCNF is that our deployments are secure-by-default. That means no static credentials, MFA-enforcement, and centralized audit logging, RBAC, and user management.

Again, the pf tooling provides automations to set this up.

There are two different types of workloads that you will likely want to deploy to PCNF clusters:

1. First-party software: This is software that you have written and want to expose to your internal and external users.

   We provide many IaC submodules that enable all common deployment patterns and infrastructure building blocks. You can use these modules to simplify the process of creating production-ready deployments of your workloads.

   Moreover, we provide agentic skills that can be used to enable coding agents to automatically create the appropriate IaC using our submodules. These skills ensure your deployments take care of all the capabilities we provide and validate that your workload meet our production-ready checklists.

   The IaC for these deployments lives in the generated git repository.

2. Third-party software: These are utilities provided by third-parties such as databases, workflow engines, etc. that can be self-hosted and are used to augment your organization’s capabilities.

   We provide many plug-and-play, prepackaged modules for popular software utilities with optimizations and integrations designed for PCNF. See the full list here.

Up until now, we have only described local operations.

However, we also provide both a CI/CD system built on Argo that comes complete with automatic builds, testing, deployments, and other CI/CD pipelines. In PCNF, all CI/CD is designed to run inside the clusters themselves to optimize for performance, cost, and security.

Critically, we provide turn-key modules for building your container images, deploying image updates, and deploying IaC updates.

Our DevShell provides the necessary utilities to safely and securely connect to and manipulate running workloads locally.

This includes automatic private networking tunnels, zero-disk dynamic credentialing, environment isolation, and RBAC enforcement.

Not only does this make it easy to locally work with private resources like databases locally, but we have designed our system to enable you to safe allow agentic access to environments for debugging and testing.

All of our modules come with automatic monitoring integrations so you can inspect the health of your workloads, debug issues, get alerted to problems, and analyze their cost impact.

We aim to make long-term maintenance of your PCNF deployments as hassle-free as possible.

To that end, our DevShell tooling performs can perform many updates automatically.

We also provide the necessary utilities so tha you can run different versions of our PCNF environments / clusters simultaneously without disruption so you can test upgrades in lower environments before deploying to production.

Finally, we provide structured metadata about every change that we make in our Changelog. This enables you to use easily use our agent skills in our coding agents to automatically update your first-party IaC and code as the PCNF paradigms evolve.

Learn more about our versioning and upgrades here.