Services¶
The workloads running on Sanctum's single-node k3s cluster. Manifests live in
sanctum-codex/k8s/, reconciled by Argo CD. This is the "what runs where"
reference; for user-facing links see Tools.
| Workload | Description | Exposed as |
|---|---|---|
| traefik | Ingress controller with TLS (bundled with k3s) | — (internal) |
| cloudflared | Cloudflare Tunnel for Zero Trust access to ops services | — (internal) |
| authentik | Identity provider (OAuth2/OIDC) with Discord social login | account. |
| mosquitto | MQTT broker for inter-service messaging | — (internal) |
| chronos-gate | Calendar/event service (FastAPI + PostgreSQL) | — (internal) |
| shadow-nexus | Clan management app (Next.js + PostgreSQL) | nexus. |
| redbot | Discord bot (Ebonguard) with relay-cog for MQTT | — (Discord) |
| grafana | Grafana + Loki + Alloy for log aggregation | grafana. |
| gatus | Uptime/status monitoring and alerting | status. |
| backup | Nightly PostgreSQL backups to Cloudflare R2 | — (internal) |
Single node, no HA, no staging
Every change lands on production. See the deployment and safety docs in
sanctum-codex before touching a workload.