# rackctl

> The day-0 installer for a nanohype platform. One command takes an empty AWS
> account to a running, reconciling nanohype platform — cloud, cluster, GitOps,
> controllers — then hands off to the portal for day-2 operations.

rackctl is the day-0 installer for an agent-native platform. It is an orchestrator, not a
rewrite: it drives the existing nanohype repos (landing-zone Terragrunt, eks-gitops
ArgoCD catalog, eks-agent-platform operator) and automates the manual runbook in
landing-zone/docs/first-deploy-aws.md end to end — especially the footguns that
strand a human today.

Scope (v1): AWS only. CRD group: *.nanohype.dev. Apache-2.0.

## Install

    curl -fsSL rackctl.com/install | sh

## The bootstrap pipeline (0 -> running)

0. preflight  — tools, caller identity, EC2 vCPU quota
1. acquire    — clone landing-zone + eks-agent-platform, fork eks-gitops into the org
2. identity   — account.hcl + versioned S3 tfstate backend
3. cluster    — VPC -> EKS control plane -> kubeconfig
4. gitops     — secrets -> ArgoCD app-of-apps pointing at the org's eks-gitops fork
5. addons     — cluster-addons, IRSA account-id writeback, wait for ArgoCD convergence
6. platform   — agent substrate, CRDs, operator
7. fleet      — (opt-in) Crossplane multi-cluster control plane
8. portal     — (opt-in) the day-2 operator UI
9. smoke      — (opt-in) first-tenant end-to-end

Phases 0-6 are the core path. On failure, completed phases tear down in reverse.

## Footguns it removes

- IRSA ARN writeback: the 000000000000 placeholder in eks-gitops values files,
  replaced with the real account id from terragrunt output, then committed.
- quota deadlock: preflight files L-1216C47A before the cluster apply dies mid-provision.
- operator cold start: falls back to helm install ./charts/operator with the SSM role ARN.
- tenant app-seam order: the five-step extraPolicyArns dance, run in the right order.
- private-endpoint lockout: prod clusters default to a private API endpoint.
- teardown safety: reverse-order teardown; no orphaned NAT gateways billing.

## Commands

- rackctl init --apply   — provision a platform from zero (dry-run by default; --tui for the TUI)
- rackctl destroy --apply — reverse-order teardown
- rackctl doctor          — check tools + cluster health
- rackctl upgrade         — bump the catalog + operator

## Links

- Source: https://github.com/rackctl/rackctl
- Platform: https://github.com/nanohype