Entity: TazPod (Operator Environment)

This page is the repository hub for the TazPod CLI and its containerized execution model.

Overview

tazpod/ is the operator continuity layer of TazLab. It combines a disposable container runtime, a gopass secret store (GPG-encrypted git), and persistent project-local state under .tazpod/.

Repository Structure

tazpod/
├── cmd/tazpod/               # CLI command dispatch and lifecycle
│   ├── main.go               # Entrypoint, command dispatcher
│   ├── lifecycle.go          # up/down/enter/smartEntry/ensureContainerUp
│   ├── config.go             # Config struct definitions
│   ├── init.go               # initProject()
│   ├── vpn.go                # vpn command (legacy/untrusted)
│   └── help.go               # help/usage
├── internal/
│   └── utils/
│       └── utils.go          # RunCmd/RunOutput/IsMounted/FileExists
├── .tazpod/
│   ├── Dockerfile.base       # Ubuntu 24.04 + dev tools + shell tools
│   ├── Dockerfile.aws        # + AWS CLI v2
│   ├── Dockerfile.k8s        # + kubectl, helm, flux, talosctl, terraform
│   ├── Dockerfile.ai         # + AI agents (pi, gemini-cli, opencode)
│   └── config.yaml           # Project-local configuration
├── dotfiles/
│   ├── .bashrc               # Shell init, symlinks, OpenCode seeding
│   ├── .tmux.conf            # Mouse, vi-mode, OSC 52 clipboard
│   └── .config/              # Starship, Zellij, OpenCode TUI, nvim
├── .github/workflows/
│   └── build-push.yml        # CI: conditional build per layer
├── Taskfile.yml              # Build tasks
└── VERSION                   # Current version

Quick Facts

Canonical Starting Pages for Agents

Architecture & Concepts

• Architecture — Runtime contract, CLI model, persistence boundaries
• Image Hierarchy — 4-layer Docker build chain
• Nomadic Workflow — Recovery and host-to-host restoration

Secrets & Gopass

• Gopass Security — GPG-encrypted git store, gpg-agent caching
• Vault Lifecycle Detail — Unlock/lock/save/push/pull step-by-step
• Sync Daemon — Background auto-save/push
• Sync Daemon Detail — 5-min cycle, SIGTERM, log path
• Crypto Detail — AES-256-GCM, PBKDF2, output format

CLI & Container Lifecycle

• Smart Entry Detail — The no-args guided flow
• Container Lifecycle Detail — Docker create/start/stop/remove
• Code Structure Detail — Package tree, function inventory, call chains
• Config Detail — .tazpod/config.yaml fields
• S3 Detail — S3 client for vault persistence

Tooling & Automation

• Dotfiles Detail — bashrc, tmux, starship, OpenCode seeding
• CI Detail — Conditional build pipeline per layer
• CLI Reference — Full command table

LXC Runtime (CT106) and the agent container (CT108)

• Paperclip: the dedicated agent container — where the agent company runs now: CT108 paperclip (192.168.1.208), unprivileged, own service account (no sudo, no SSH), own gopass store and GPG key on its own data volume, the egress chokepoint that brokers credentials, and the identities (Proxmox, paperclip-observer, Vault AppRole).
• Paperclip on the TazPod container — historical (CT106, 2026-09-25 → 2026-09-26): managed install (pinned), paperclip database user over TLS, gopass-custodied secrets, idempotent Ansible layer, and the CLI traps.
• Proxmox LXC Runtime Detail — CT106 tazpod-proxmox provisioning (Terraform + Ansible under runtimes/lxc), installed stack, re-run assessment; the dsh Web UI was decommissioned on 2026-09-25 (nginx reverse proxy had been removed 2026-09-10), and the container hosts the operator environment and its tooling; the Multica daemon and its Git-declared team were removed on 2026-10-20
• Trusted Orchestration Host — where create.sh must run (tazlab, 192.168.1.200), the from= pin that forces it, control-host prerequisites and the TAZ-19 acceptance checks (tazpod@e38dc17)

Known Issues / Technical Debt

Relationships

• Infrastructure target: ephemeral-castle
• GitOps target: tazlab-k8s
• Semantic memory: mnemosyne-mcp-server
• Blog posts: tazpod-rising-go-cli-zero-trust, tazpod-v2-ram-vault-evolution, tazpod-zero-credentials-aws-sso

See Also

• Wiki Index