andrew.dunn.dev

exhibits

~4 min
gitlabself-managedciair-gapjenkinspublic-sector
Source Trunk guide Switchyard guide Firebreak Topology

exhibits is a group of working GitLab installations I build and keep at GitLab Public Sector, in public, on GitLab.com. Each exhibit is a project, or a set of them, that a reader can walk end to end: the pipelines run, the merge requests are the real ones, the evidence files sit beside the claims. Where an exhibit handles data, the data is synthetic. Eight exhibits make up the group. bulkhead and egress have their own pages here; the other six are the subject of this one.

EXHIBITSfoundry · diode · topology · trunk · switchyard · firebreak · bulkhead · egressONE EXHIBITTEXTgitlab-profileREADME, pages, platesthe group overviewpublic APISITEguideAstro, docs templatepublished to Pageslinks toWORKworking projectspipelines, MRs, releases,evidence filesSHAREDpipeline componentsosv-verdict, release,pages, heartbeatreferenceconformance contract,docs template, designRenovate presetcomponent pins, images,lab-repass labelsfreshness tripwireweekly; reports red,never edits a claimDATAsynthetic where an exhibit handles any • the pipelines, runs and reports are real
The shape every exhibit shares
  • A gitlab-profile project holds the guide text and its plates.
  • A guide site reads that text over the public API and publishes it to GitLab Pages.
  • Working projects hold the pipelines and runs the guide points at.
  • All of it stands on the Public Sector pipeline components, the reference conformance contract, a shared Renovate preset, and a weekly freshness tripwire.

foundry is a delivery team’s planning line rebuilt native in GitLab, for a team moving off Jira: epics across projects, milestones and iterations as the timeboxes, a workflow state held in a Status field rather than a label, and dashboards written in GitLab Query Language. diode carries the vulnerability and license database a sealed GitLab instance needs as one signed OCI artifact: pack and sign on the low side, replicate from the high side, unpack from a CronJob, with the scripts and manifests in courier. topology is one page on how GitLab Duo Agent Platform deploys, from fully online to fully offline, drawn from a single dataset along two axes, how the instance is licensed and where inference runs. trunk runs the seven rules of trunk-based development on a three-component Go service, with a merge request or job as evidence for each, and forge applies those settings to tenants on another instance with OpenTofu. switchyard is six Jenkins pipelines on a Java and Maven app, each converted to GitLab CI/CD, with the converter’s merge request kept beside the reviewed one. firebreak is a hardening guide for Duo Agent Platform flows on your own runners, on OpenShift, Kubernetes and Podman; it stands on bulkhead‘s rootless Podman posture.

Each exhibit’s text lives in a gitlab-profile project, with its figures as SVG plates beside it. A guide project holds no prose: it is the docs template from the Public Sector reference, an Astro build that reads that README and its plates over the public API, wraps them in the docs chrome, and publishes to GitLab Pages. The text exists once and is read in two places; a push to the profile triggers the site build. The working projects hold what the guide points at. Every project declares the reference version it conforms to; the publishing jobs, Pages deploys, releases and the OSV check are the pipeline catalog’s components, and dependency updates arrive from one shared Renovate preset. topology and firebreak add a weekly tripwire that checks whether a newer GitLab minor has shipped and whether every cited page still resolves, and republishes its verdict as a badge; it reports red and never edits a claim, so a re-derivation is always a person re-reading the sources.

The group holds the exhibits. The pipeline components and the conformance contract they stand on live in their own projects and are consumed here, not defined.