workdesk

A desk, not a dependency. It holds the project template, the backup config, and the rules — nothing that needs maintaining by hand.

~/Projects/workdesk/
├── CHEATSHEET.md        every command you actually type
├── docs/                manuals (below)
├── templates/project/   copier template, every feature a toggle
├── backup/              restic → local disk + Backblaze B2
└── repos/               ignored; every project lives here
    ├── vault/           Obsidian vault (own repo)
    └── servers/         Podman Quadlet units per host (own repo)

Projects in repos/ are standalone: config got there by copy (a copier template) or as a real published package, never by reference. Delete the desk and every project still builds, lints and runs the same.

Start here

you are…	read
new to this, or setting up a machine	docs/onboarding.md
unsure what a word means	docs/glossary.md
asking what's installed and pinned where	docs/stack.md
looking for a command	CHEATSHEET.md
doing something you do rarely	docs/operations.md
wondering why it's built this way	docs/architecture.md
something is broken or stale	docs/reset.md
something is lost	docs/recovery.md

The three rules

1. Config reaches a project by copy, never by reference. A project must work with nothing on the machine but itself.
2. Changes every commit → app repo. Changes when you roll out → servers repo. The boundary between them is a container image tag.
3. The desk stays dumb. No manifests, indexes or status scripts that have to be kept in sync by hand.

Most used

mise run new -- repos/<name>     # scaffold a project
mise run backup                  # snapshot to local + B2
mise run backup:snapshots        # what's in each repository

Status

• Root of trust: age keypair, sops, key in Bitwarden + paper
• Copier template with toggles (mise run new)
• Obsidian vault (repos/vault, GSD structure)
• Backups: local disk + B2, nightly 03:00, last 3 snapshots each, restore-tested 2026-09-19
• servers repo: host hades (this machine), mise run deploy -- hades
• Forgejo 16.0.5 installed, registration disabled
• Forgejo backed up: forgejo dump on every run, restore-verified from B2 (2026-09-20)
• Public at https://git.jonnxor.is — DNS at ISNIC (CNAME to the router's DDNS name), MikroTik dstnat, ufw, Caddy with a real Let's Encrypt certificate. Git over SSH on port 2222.
• All three repos pushed, branches renamed master → main: WAAAGH/workdesk (public), WAAAGH/servers and jonnxor/vault (private)
• Apex jonnxor.is still points at Vercel — move the site here, then retire the Vercel project (not before: resolvers holding the old delegation still need it)

Tools: git, age, sops, mise, podman, gh, rsync (system); restic, lefthook, copier (via mise). Full inventory: docs/stack.md.