Architecture overview
kixctl is a control plane whose only backend is the Incus REST API, keeping its own state in Postgres — never a synced copy of the cluster.
The deploy pipeline
From a git push to a running immutable revision — webhook or poll, a queued job, a hermetic commit-pinned build, and an API-only import and launch.
The build subsystem
The one host-touching step, fenced two ways — it runs no general shell and never runs as root — plus the NixOS base every image is built on.
State, config, and secrets
The immutable unit holds no durable state; config is declared once and delivered as root-only credential files; the secret chain and the three-tier database direction.
Compliance posture
The security properties fall out of the architecture rather than being bolted on — the substrate a compliance program rests on, not a certification kixctl claims to hold.