Operate tooling¶
Platform tools for shared hosts. Conductor is the knowledge base; tool source repos stay separate unless noted.
All secret values come from Bitwarden via secret-gate — never commit values, never paste them into Conductor docs.
secret-gate¶
Canonical secret unlock for Operate and connect.
| Repo | Konstant-Ventures/secret-gate (public) |
| Role | Authenticate to Bitwarden; export Secrets Manager keys as env vars |
| Install | uv tool install --force 'git+https://github.com/Konstant-Ventures/secret-gate.git@main' |
secret-gate auth
eval $(secret-gate refresh --set ci --print-env) # or --print-env for all / -k KEYS
secret-gate status
Agent connect bootstrap: connecting. Standards: secrets · secret management.
Operate-related secret names (resolve values only via secret-gate):
| Name | Typical use |
|---|---|
CONDUCTOR_MCP_AUTH_TOKEN |
MCP Bearer |
VPS_HOST / VPS_SSH_KEY |
Deploy SSH |
TAILSCALE_AUTHKEY |
CI mesh join |
CLOUDFLARE_API_TOKEN |
Tunnel/DNS API (≠ connector token) |
HETZNER_DNS_TOKEN |
Hetzner Cloud DNS |
BWS_ACCESS_TOKEN / org/project ids |
SM machine account (usually via secret-gate vault item) |
cloudflare-tunnel-cli¶
| Repo | Konstant-Ventures/cloudflare-tunnel-cli (public) |
| Role | Idempotent Cloudflare Tunnel ingress + optional DNS |
| Install | pip install git+https://github.com/Konstant-Ventures/cloudflare-tunnel-cli.git |
cloudflare-tunnel verify-token
cloudflare-tunnel list-ingress
cloudflare-tunnel ensure-hostname --hostname <host> --origin http://127.0.0.1:80 --dns-mode none
DNS modes: auto | cloudflare | hetzner | none.
Used on konstant eval; production VPS historically used Hetzner A records via Platform Control.
hetzner-dns-cli¶
| Repo | Konstant-Ventures/hetzner-dns-cli (public) |
| Role | Hetzner Cloud DNS (api.hetzner.cloud) — replaces deprecated dns.hetzner.com |
| Install | pip install git+https://github.com/Konstant-Ventures/hetzner-dns-cli.git |
| Auth | HETZNER_DNS_TOKEN via secret-gate |
hetzner-dns list
hetzner-dns add --name hello --type A --value <ip>
hetzner-dns delete --name hello --type A
# ensure = idempotent upsert (prefer in automation)
Evolved from scripts under incubator infrastructure-management/scripts/hetzner_dns/.
platform-control¶
| Repo | Konstant-Ventures/platform-control (private) |
| Role | Hosted promotion/deploy control plane — policy + state; not a general SSH shell |
| Runtime | Historically on ai-sandbox; konstant runbooks cover dual-run install |
Agents submit structured operations; the service owns transactions (GitHub, website registry, Publishing MCP, scoped VPS/DNS adapters). GitHub Actions remains the repeatable build executor.
Edge providers:
| Provider | Where |
|---|---|
hetzner |
Legacy VPS production A records |
cloudflare-tunnel |
Konstant eval / future production |
Docs in-repo: ARCHITECTURE, REGISTRY, OPERATIONS, POLICY. Smoke: incubator infrastructure/platform-control-smoke.
mcp-gateway¶
| Repo | Konstant-Ventures/mcp-gateway (private) |
| Role | Code-mode MCP gateway for Obsidian vault on konstant |
| Secrets | Vault/path tokens via secret-gate — never in git |
See konstant runbook heritage for install layout; record live URL on the Operate workstream.
Pipeline Management (workspace scripts)¶
| Source | hector-sanchez-eu/workspace → 01 - Pipeline Management/ |
| Role | Local PowerShell promote/deploy prep (promote-software.ps1, first-deploy.ps1, prep-deploy.ps1, add-repo-secrets.ps1) |
Long-term: scripts should consume Conductor templates (D3a), not fork divergent YAML. Secrets for CI: add-repo-secrets.ps1 in a shell unlocked by secret-gate.
Conductor already cites this tree from Software promote/deploy units.
vps-deployment-toolkit (legacy path)¶
| Repo | Konstant-Ventures/vps-deployment-toolkit (private, archived 2026-07-30) |
| Role | Docker-based deploy to arbitrary VPS targets (deploy.yml, vps-deploy) |
| Status | Superseded for new work by host.konstant / host.vercel patterns |
Useful recovery for apps still on Docker-on-VPS during migration. Candidate to GitHub-archive after cutover. Targets file ~/.vps-deploy/targets.yml is local-only — never commit.
mcp-ssh / host shells¶
| Tool | Role |
|---|---|
| SSH aliases | Day-to-day Operate (hosts) |
| mcp-ssh-manager | Historical VPS MCP SSH (ssh-mcp.hectorsanchez.eu) — API key via secret-gate |
| systemctl / nginx | Shared host runtime |
What stays out of Conductor git¶
- Private keys,
.envvalues, Bitwarden session files - Production tunnel connector tokens
- Quarantined incubator credentials
- Full vendor copies of large tool repos (link + usage here instead)