Org infra repo pattern

Pattern

Each GitHub organization gets one central repository named infra (or infrastructure):

  • Pulumi (TypeScript preferred in our orgs) owns shared DNS, email-related records, and other cross-repo platform resources.

  • Application repos stay mostly IaC-free (or thin wrappers only).

  • Secrets live in Pulumi config / ESC / a vault — never committed.

  • A small Antora component under docs/ holds stack inventory, apply/preview how-tos, and org-specific DNS checklists.

Strategic "which vendor" guidance stays in this Business Bootstrap component. Org infra docs answer "how our stacks work."

Why central infra

  • One source of truth for DNS and shared platform resources

  • Easier review, policy, and secret hygiene

  • Matches DevCentr IaC Discovery’s "centralized infrastructure repository" pattern

Reusable skeleton: dev-centr/infra-template.

Live example: FoodTruckNerdz/infra.

Tooling note

DevCentr installation flows may still offer OpenTofu as a broadly compatible default for new users. For orgs following this bootstrap guide, prefer Pulumi when scaffolding the org infra repo. OpenTofu/Terraform remain valid for discovery and personal/repo-level IaC.

See also Infrastructure as Code (IaC).

What Pulumi can and cannot automate for email

Automatable in infra Usually manual / portal

Cloudflare DNS: SPF, DKIM, DMARC, Resend CNAMEs

Gmail "Send mail as" per user (no public API for personal Gmail)

Placeholder records; stack outputs for operators

ZeptoMail Mail Agents / API keys (no native Pulumi provider — Dynamic Provider later optional)

Documented secret slots

ESP dashboard domain verification clicks

Pulumi can consume Terraform providers via pulumi package add terraform-provider … when a vendor has TF but not Pulumi.