Skip to content

Operate tooling

Platform tools for shared hosts. Conductor is the knowledge base; tool source repos stay separate unless noted.
All secret values come from Bitwarden via secret-gate — never commit values, never paste them into Conductor docs.


secret-gate

Canonical secret unlock for Operate and connect.

Repo Konstant-Ventures/secret-gate (public)
Role Authenticate to Bitwarden; export Secrets Manager keys as env vars
Install uv tool install --force 'git+https://github.com/Konstant-Ventures/secret-gate.git@main'
secret-gate auth
eval $(secret-gate refresh --set ci --print-env)   # or --print-env for all / -k KEYS
secret-gate status

Agent connect bootstrap: connecting. Standards: secrets · secret management.

Operate-related secret names (resolve values only via secret-gate):

Name Typical use
CONDUCTOR_MCP_AUTH_TOKEN MCP Bearer
VPS_HOST / VPS_SSH_KEY Deploy SSH
TAILSCALE_AUTHKEY CI mesh join
CLOUDFLARE_API_TOKEN Tunnel/DNS API (≠ connector token)
HETZNER_DNS_TOKEN Hetzner Cloud DNS
BWS_ACCESS_TOKEN / org/project ids SM machine account (usually via secret-gate vault item)

cloudflare-tunnel-cli

Repo Konstant-Ventures/cloudflare-tunnel-cli (public)
Role Idempotent Cloudflare Tunnel ingress + optional DNS
Install pip install git+https://github.com/Konstant-Ventures/cloudflare-tunnel-cli.git
cloudflare-tunnel verify-token
cloudflare-tunnel list-ingress
cloudflare-tunnel ensure-hostname --hostname <host> --origin http://127.0.0.1:80 --dns-mode none

DNS modes: auto | cloudflare | hetzner | none.
Used on konstant eval; production VPS historically used Hetzner A records via Platform Control.


hetzner-dns-cli

Repo Konstant-Ventures/hetzner-dns-cli (public)
Role Hetzner Cloud DNS (api.hetzner.cloud) — replaces deprecated dns.hetzner.com
Install pip install git+https://github.com/Konstant-Ventures/hetzner-dns-cli.git
Auth HETZNER_DNS_TOKEN via secret-gate
hetzner-dns list
hetzner-dns add --name hello --type A --value <ip>
hetzner-dns delete --name hello --type A
# ensure = idempotent upsert (prefer in automation)

Evolved from scripts under incubator infrastructure-management/scripts/hetzner_dns/.


platform-control

Repo Konstant-Ventures/platform-control (private)
Role Hosted promotion/deploy control plane — policy + state; not a general SSH shell
Runtime Historically on ai-sandbox; konstant runbooks cover dual-run install

Agents submit structured operations; the service owns transactions (GitHub, website registry, Publishing MCP, scoped VPS/DNS adapters). GitHub Actions remains the repeatable build executor.

Edge providers:

Provider Where
hetzner Legacy VPS production A records
cloudflare-tunnel Konstant eval / future production

Docs in-repo: ARCHITECTURE, REGISTRY, OPERATIONS, POLICY. Smoke: incubator infrastructure/platform-control-smoke.


mcp-gateway

Repo Konstant-Ventures/mcp-gateway (private)
Role Code-mode MCP gateway for Obsidian vault on konstant
Secrets Vault/path tokens via secret-gate — never in git

See konstant runbook heritage for install layout; record live URL on the Operate workstream.


Pipeline Management (workspace scripts)

Source hector-sanchez-eu/workspace01 - Pipeline Management/
Role Local PowerShell promote/deploy prep (promote-software.ps1, first-deploy.ps1, prep-deploy.ps1, add-repo-secrets.ps1)

Long-term: scripts should consume Conductor templates (D3a), not fork divergent YAML. Secrets for CI: add-repo-secrets.ps1 in a shell unlocked by secret-gate.

Conductor already cites this tree from Software promote/deploy units.


vps-deployment-toolkit (legacy path)

Repo Konstant-Ventures/vps-deployment-toolkit (private, archived 2026-07-30)
Role Docker-based deploy to arbitrary VPS targets (deploy.yml, vps-deploy)
Status Superseded for new work by host.konstant / host.vercel patterns

Useful recovery for apps still on Docker-on-VPS during migration. Candidate to GitHub-archive after cutover. Targets file ~/.vps-deploy/targets.yml is local-only — never commit.


mcp-ssh / host shells

Tool Role
SSH aliases Day-to-day Operate (hosts)
mcp-ssh-manager Historical VPS MCP SSH (ssh-mcp.hectorsanchez.eu) — API key via secret-gate
systemctl / nginx Shared host runtime

What stays out of Conductor git

  • Private keys, .env values, Bitwarden session files
  • Production tunnel connector tokens
  • Quarantined incubator credentials
  • Full vendor copies of large tool repos (link + usage here instead)