Skip to content

Operate TAPPaaS

TAPPaaS 2.0 is operated through a small set of managers and controllers, running on the CICD mothership:

  • Managers own a domain of the platform — one per part of the taxonomy: Site, People, Module (Apps), Environment, Network, Backup, Health, and Satellite. When you install, update or reconfigure something, you talk to a manager.
  • Controllers wrap a concrete system — OPNsense, Proxmox, the identity stack, backup, access points, switches, node provisioning — and expose it to the managers. You rarely call a controller directly, but they're where the system-specific knowledge (and troubleshooting detail) lives.

So: managers decide, controllers do. A day-to-day operation like "update all modules" is a manager conversation; "why didn't the VLAN get created" is a controller page.

You reach both from the tappaas@tappaas-cicd prompt — see Admin Access for the three ways to get there (on the management network, or over WireGuard with a public IP or a satellite).

Reference

These pages are always current with the source code (new managers and controllers appear here automatically):

  • Managers — see the Managers section in the sidebar: one page per manager (site, people, module, environment, network, backup, health, satellite).
  • Controllers — see the Controllers section: one page per controller (opnsense, proxmox, identity, backup, ap, switch, node-provisioner).
  • Network Zones — the zone model the network manager maintains.
  • Firewall Rules — how the zones and the modules in them become the firewall's rule set, in which order it is evaluated, and the known gaps.
  • IPv6 — running IPv6 next to IPv4: turning it on and off, the WAN modes, which zones carry it, names, the reverse proxy and IPv4 fallback.
  • Verified Updates — what the site checks before it runs new code (signed releases, image hashes, signed guest systems), how to read the result in health-manager validate, requiring signed releases, and what to do when an update is refused.