stack.yaml

# stack.yaml — curated: what is worth showing, not every transitive dependency.
#
# I decide what belongs on a page. This file decides nothing about versions:
# every entry either points at a file in THIS repo, from which `make gen` reads
# the version, or it carries no version at all. A literal `version:` here is
# refused by `make check-stack` — that refusal is the entire point of the file.
#
# The rule it buys: nobody ever types a version number into a page again, and a
# wrong stack claim breaks the build instead of sitting there being wrong.
# Build plan ch. 12.3, ADR 0012.
#
# Adding an entry is only allowed once its source exists. Grafana and Tailwind
# are therefore absent today — the phase that lands each of them appends its
# line. Growth, not a placeholder. F2 appended three of them; Grafana stayed
# out, and for the same reason Traefik did: that instance belongs to another app
# on the host, no file here can be read for its version, and typing one would be
# a number no running system of ours produced.
#
# Traefik is the exception that proves the rule: D3 landed it and appended
# nothing, because its version is Dokploy's and no file here can be read for it.
# Typing one would be a number no running system produced.
#
# THE SENTENCE THAT STOOD HERE WAS WRONG, and F3 is where it was executed for
# the first time. It said the honest source was `traefik_build_info` from the
# metrics endpoint, arriving "with F3, when something scrapes it". F3 scraped
# it. THAT SERIES DOES NOT EXIST — measured against the running proxy (v3.6.7)
# and reproduced locally against v3.7.11: Traefik exports no build, version or
# info metric of any kind. ADR 0028 §10 carries the same wrong claim and ADR
# 0040 §5 corrects it there.
#
# Traefik therefore has no line here and no prospect of one. That is a better
# reason than the old one: not "not yet measured" but "there is nothing to
# measure". A version for this entry would have to be typed, and typing it is
# what this file exists to refuse.

systems:
  # 02 · timseil.dev — the whole stack lives in this repo, so every version is read.
  timseil-dev:
    - { name: "Next.js",    from: "web/package.json", key: "dependencies.next" }
    - { name: "React",      from: "web/package.json", key: "dependencies.react" }
    - { name: "Go",         from: "api/go.mod",       key: "go" }
    - { name: "pgx",        from: "api/go.mod",       key: "github.com/jackc/pgx/v5" }
    - { name: "sqlc",       from: "api/go.mod",       key: "github.com/sqlc-dev/sqlc" }
    - { name: "goose",      from: "api/go.mod",       key: "github.com/pressly/goose/v3" }
    # compose.yaml, not compose.dev.yaml: the page quotes what production runs.
    # make check-compose refuses a drift between the two files, so this reads the
    # production tag and the development one cannot silently walk away from it.
    # Build plan ch. 12.3, issue #28, ADR 0012 and ADR 0027.
    - { name: "PostgreSQL", from: "compose.yaml", key: "services.db.image" }
    - { name: "Node",       from: ".nvmrc" }
    # F2. Same rule as PostgreSQL above and the same reader: the production
    # compose is what the page quotes, and the resolver cuts the digest off
    # before it takes the tag (#93) — without that these three would each put a
    # sha256 where a version belongs.
    - { name: "Prometheus", from: "compose.yaml", key: "services.prometheus.image" }
    - { name: "Loki",       from: "compose.yaml", key: "services.loki.image" }
    - { name: "Alloy",      from: "compose.yaml", key: "services.alloy.image" }

  # 01 · talos-prod — a bare-metal Kubernetes cluster in its own, private
  # repository. Bare names, no versions, and here the reason is structural
  # rather than a matter of taste: no file in THIS repo can be read for a
  # version of anything running there, so every number would have to be typed,
  # and typing one is what this file exists to refuse. Component names only,
  # nothing about how the cluster is reached or segmented — ADR 0079 draws that
  # line and U3 is the phase that first has to hold it.
  talos-prod:
    - { name: "Talos" }
    - { name: "Kubernetes" }
    - { name: "Flannel" }
    - { name: "MetalLB" }
    - { name: "Traefik" }
    - { name: "cert-manager" }
    - { name: "Cloudflare Tunnel" }
    - { name: "Flux" }
    - { name: "SOPS" }
    - { name: "kube-prometheus-stack" }
    - { name: "CloudNativePG" }
    - { name: "Velero" }