Org infra repo pattern :: Business Bootstrap

Pattern

Each GitHub organization gets one central repository named infra (or infrastructure):

Pulumi (TypeScript preferred in our orgs) owns shared DNS, email-related records, and other cross-repo platform resources.
Application repos stay mostly IaC-free (or thin wrappers only).
Secrets live in Pulumi config / ESC / a vault — never committed.
A small Antora component under docs/ holds stack inventory, apply/preview how-tos, and org-specific DNS checklists.
Member-only static hostnames (team.docs., internal runbooks) get Cloudflare Access on the orange-cloud record — not a docs-app rewrite. Identities live in the GitHub org (or Google / email PIN). See Access in front of static sites and the Access how-to.

Strategic "which vendor" guidance stays in this Business Bootstrap component. Org infra docs answer "how our stacks work."

Why central infra

One source of truth for DNS and shared platform resources
Easier review, policy, and secret hygiene
Matches DevCentr IaC Discovery’s "centralized infrastructure repository" pattern

Reusable skeleton: dev-centr/infra-template.

Live example: FoodTruckNerdz/infra.

Tooling note

DevCentr installation flows may still offer OpenTofu as a broadly compatible default for new users. For orgs following this bootstrap guide, prefer Pulumi when scaffolding the org infra repo. OpenTofu/Terraform remain valid for discovery and personal/repo-level IaC.

Pulumi Cloud trap: the free Individual plan is one user — no org invites. Multi-human collaboration needs paid Team, OSS Team, or a self-managed state backend. See Pulumi Cloud org model and Back up Pulumi stack state.

See also Org infra (area overview), Fast org bootstrap (identity pass before infra exists), and Infrastructure as Code (IaC).

What Pulumi can and cannot automate for email

Automatable in infra Usually manual / portal / Gmail UI

Automatable in `infra`	Usually manual / portal / Gmail UI
Cloudflare DNS: SPF, DKIM, DMARC, Resend / Customer.io CNAMEs	Gmail create Send mail as (Composio/Gmail Settings API: list + patch existing; create often missing or verification-bound)
Placeholder records; stack outputs for operators	ZeptoMail Mail Agents / API keys (no native Pulumi provider — Dynamic Provider later optional)
Documented secret slots	ESP dashboard domain verification clicks
Optional Email Routing MX (if managed in stack)	Routing destination verification + address creation; no outbound SMTP from Routing

Cloudflare DNS: SPF, DKIM, DMARC, Resend / Customer.io CNAMEs

Gmail create Send mail as (Composio/Gmail Settings API: list + patch existing; create often missing or verification-bound)

Placeholder records; stack outputs for operators

ZeptoMail Mail Agents / API keys (no native Pulumi provider — Dynamic Provider later optional)

Documented secret slots

ESP dashboard domain verification clicks

Optional Email Routing MX (if managed in stack)

Routing destination verification + address creation; no outbound SMTP from Routing

Personal Gmail + free Cloudflare Routing limits: Personal Gmail send-as gotchas, Cloudflare Email Routing limits.

Pulumi can consume Terraform providers via pulumi package add terraform-provider … when a vendor has TF but not Pulumi.