Infrastructure

Prefer

  • Pulumi for org-level infra repos (DNS, shared platform hosts)

  • Nushell as the recommended agent-friendly shell (see Explanation)

  • Secrets via vault → ESC / host env — never commit tokens

Member-only static hostnames

Do not rewrite Antora as an app. Put Cloudflare Access on the orange-cloud hostname (and on *.pages.dev). Reader identities live in GitHub / Google / email PIN — not Cloudflare dashboard users. GitHub org membership is checked at login, not scraped.

Org email + DNS (business ops)

Developer IaC mechanics stay here / in Explanation. Vendor choice and personal-Gmail gotchas live in Business Bootstrap:

See also (Explanation)