osinfra.io

Platform docs, written for the people who use and build it.

🚀

Building on the platform

You own a service and want to run it here. One interface, the Nomos Agent, onboards your team and requests everything the platform provides.

Get started →

🛠️

Building the platform

You own a technical area. Find what each team owns, its interfaces, and the decisions behind them.

See the teams →

🌐

Learning from the stack

These docs are the reference implementation: every page describes the live platform, open source end to end.

See the stack →

Start with one clear request

The Nomos Agent turns team requirements into validated, reviewable pull requests. Use the prompt builder to provide the information needed by Logos and any downstream platform services.

Build your agent prompt →

Onboard a new team — Fides. Team key: st-fides. Maintainers: joesmith. Admin email: joe@osinfra.io.

👋 Hi! I'm the Nomos Agent — your self-serve interface to the osinfra.io platform. Give me just a moment while I look you up…

✓ get_me → joesmith · joe@osinfra.io · osinfra-io member

✓ lookup_user → no existing team memberships

Team key st-fides is a stream-aligned team. Suggested display name: Fides. Confirm, and share a one or two sentence team description — or I can suggest one.

Fides is right. Suggest a description.

Suggested description: "Fides — the platform's trust and verification service." Keep it or rewrite it?

Keep it.

Next, Datadog: should I use joe@osinfra.io as the admin? Then I'll collect GitHub maintainers and Google Cloud groups, one group at a time.

… required fields, then an optional menu: GitHub Actions + GCP OIDC, repositories, GKE, Cloud SQL, projects

Yes. Enable workflows and add repo st-fides-api.

✓ open_team_pr → PR opened on pt-logos

✓ open_team_docs_pr → PR opened on pt-ekklesia-docs

Done. Once the pt-logos PR merges, your team structure and access foundations are created. Cloud and Kubernetes capabilities follow through Corpus and Pneuma.

🔐

Guardrails by default

Platform-managed projects include established security controls, encrypted state, audit logging, and policy enforcement. Your team owns its workload while the platform owns the shared guardrails.

📦

Built on open standards

Infrastructure automation and runtime tooling are built on CNCF and Linux Foundation open-source projects — Kubernetes, Istio, cert-manager, OPA Gatekeeper, OpenTofu, OpenBao. No proprietary abstractions, no lock-in, no black boxes.

🤝

Innersource, not a bottleneck

Arche, Ekklesia, and Techne run as innersource repositories — any engineer can open a pull request, and platform engineers from staffed teams review. Stream-aligned teams unblock themselves by contributing fixes and new capabilities directly to the platform.

Everything your team needs, out of the box.

From source code management to production support — already in place.

🏭

Continuous delivery enablement

GitHub teams and repositories, keyless GCP authentication, Artifact Registry, and reusable deployment workflows.

🏗️

Cloud foundation

CIS-compliant GCP projects across sandbox, non-production, and production, with KMS-encrypted state, shared networking, DNS, and Kubernetes namespaces.

🔒

Security

OpenBao secrets, Istio mTLS, OPA Gatekeeper admission control, Cloud Armor WAF, hardened GKE clusters, and Datadog security monitoring.

🐶

Observability and incident response

Platform-managed Datadog integrations provide cluster telemetry and can enable logs, APM, security features, and cloud-cost visibility where configured.

Open source

Vendor

Explore the full ecosystem →