> ## Documentation Index > Fetch the complete documentation index at: https://docs.hill90.com/llms.txt > Use this file to discover all available pages before exploring further. # Decisions > Why the homelab looks the way it does, and what is still undecided. # Decisions Three records explain most of the current shape of the homelab. All live in the Hill90 repository as the authority; this page summarises them. ## Platform primitives **Status:** decided, recorded 2026-07-26. Supersedes the reasoning in *Infra/app separation* below. Hill90 is a deliberate open-source counterpart to the Azure platform primitives Jon works with professionally, so that operating it builds transferable skill. The mapping is on the [Overview](/homelab/overview#a-personal-cloud-platform). The record exists because that intent was never written down, and the cost of not writing it down was concrete: during the July strip, Keycloak and Postgres were reasoned about as application dependencies, found to have no surviving consumer, and deleted. That conclusion was correct given what was recorded and wrong given the actual intent — and the same argument won three separate times in one day, because footprint was written down and capability was not. What follows from it, in the record's terms: a platform primitive does not have to justify itself by naming a current consumer, "no consumer today" is evidence of an under-used platform rather than an argument for deletion, and multi-user is a real requirement because the operator count is not one. → [`docs/decisions/platform-primitives.md`](https://github.com/jonhill90/Hill90/blob/main/docs/decisions/platform-primitives.md) ## Infra/app separation **Status:** implemented. Decided 2026-07-11, implemented 2026-07-26. Hill90 had grown into a combined repository — infrastructure automation alongside an eight-service AI agent application. In June 2026 the production VPS was destroyed and rebuilt on AlmaLinux 10 as a deliberate scope reduction; only the infrastructure and observability stacks were redeployed, and the application stack was left undeployed. The decision made that permanent: **Hill90 becomes a homelab domain rather than an application host, and the AI agent application is shelved.** Carried out across four pull requests — the eight application services and their compose files, workflows, tests and secrets removed; Keycloak, Postgres and MinIO removed, which also cost the vault its OIDC SSO; documentation rewritten; observability configuration reworked. What remained immediately afterwards was three stacks and ten containers. Keycloak and Postgres have since returned, in July 2026, as platform services rather than application dependencies — see [Platform primitives](#platform-primitives) above. MinIO has not returned. `services/dns-manager` was kept. It is live infrastructure — the DNS-01 ACME webhook Traefik depends on — not application code. The application is preserved two ways: the `archive/app-stack-final` tag on the Hill90 repository, and the [hill90-app](https://github.com/jonhill90/hill90-app) repository, which holds the eight services extracted with full history. **Deviations from the original decision, recorded honestly in the source:** Hill90 was *not* archived as the decision anticipated. It stayed live and had the application removed in place, because the infrastructure and observability stacks are still deployed and still wanted. The generic boilerplate repositories the decision envisaged (`docker-infra-template`, `k8s-cluster-template`) are a separate, parallel effort. The decision also settled kubeadm over k3s for the future Kubernetes boilerplate — identical API and tooling either way, but kubeadm gives hands-on exposure to etcd, CNI and certificate management, and an etcd backup/restore story that k3s's SQLite datastore would not provide. → [`docs/decisions/infra-app-separation.md`](https://github.com/jonhill90/Hill90/blob/main/docs/decisions/infra-app-separation.md) ## Vault versus SOPS **Status:** open. Raised 2026-07-26. The call is Jon's. The record was written when the vault was empty, and recommended that SOPS remain the operative store until the vault had a concrete consumer. **Events have since overtaken parts of it.** The vault has been reinitialized and configured — policies and AppRoles exist — and the weekly `vault-sync-to-sops` schedule, which the record describes as disabled after failing every Monday since 2026-06-01, was re-enabled on 2026-07-26 once a manual run went green. See [Secrets](/homelab/secrets) for what is verified on the running vault. The decision itself — whether the vault or SOPS is the operative store — has not been recorded as made. The OpenBao image tag is pinned to 2.6.1, so no upgrade can arrive by surprise. What remains is a real constraint: OpenBao's `file` storage backend is deprecated, and the vault cannot move past 2.6.x without switching to `raft`. Production is still on `file` — verified on the running container — even though the repository has since gained a reinitialize-with-raft path. The record's argument that migrating *this* vault was the wrong move was made when it was empty and unconfigurable; that premise no longer holds, which is a reason to revisit the record rather than to act on it as written. There is no deadline, but there is a decision, and it resurfaces the first time a security fix lands in a version the current pin cannot reach. → [`docs/decisions/vault-vs-sops.md`](https://github.com/jonhill90/Hill90/blob/main/docs/decisions/vault-vs-sops.md)