canasta gitops init

Initialize git-based configuration management

Synopsis

Bootstrap git-based configuration management. Converts extensions and skins to submodules and pushes to a remote repository.

On Compose, per-host vars.yaml is encrypted with git-crypt so secrets stay out of the repo at rest. On Kubernetes, secrets live in K8s Secrets (created by canasta create) rather than in the gitops repo, so the K8s repo is cleartext and Argo CD can read rendered-values.yaml directly.

canasta gitops init [flags]

Examples

canasta gitops init -n prod --repo git@github.com:org/config.git --key /tmp/gc.key

Flags

Flag	Shorthand	Description	Default	Required	Orchestrator
`--key`		A path on the controller (the machine running canasta). On Compose, the path that receives the git-crypt symmetric key, which other hosts use to unlock encrypted vars. Not used with --git-crypt-gpg-user. On Kubernetes, the path basename for the generated SSH deploy key, `<key>.ssh` (private) and `<key>.ssh.pub` (public — register this as a deploy key on the forge), and for the SOPS age key with --encrypt-secrets.		Unless `--git-crypt-gpg-user`	Both
`--name`	`-n`	Name for this host in hosts.yaml		✓	Both
`--repo`		Git repository URL. On Kubernetes it must be an SSH URL (user@host:path or ssh://user@host/path), since Argo CD clones it over SSH from inside the cluster.		✓	Both
`--encrypt-secrets`		Kubernetes only. Encrypt the instance's Secrets in git with SOPS+age instead of leaving them out of version control. The operator age key is generated on the controller (portable via --key for DR); Argo CD's repo-server gains a helm-sops sidecar that decrypts at render time. Requires sops on the target and age on the controller ('canasta install sops'). No effect on Compose, which already encrypts vars with git-crypt.			Both
`--force`	`-f`	Force push to non-empty remote			Both
`--git-crypt-gpg-user`		Compose only. GPG recipient (email or key id) to encrypt the git-crypt key to, enabling GPG-based unlock instead of a shared symmetric key file. When set, gitops initializes git-crypt with `git-crypt add-gpg-user` and later `gitops pull`/`push` unlock via `git-crypt unlock` (using a forwarded GPG agent). No git-crypt key is exported, so --key is not needed.			Both
`--git-user-email`		Git user.email for commits on the target host (set if not already configured)			Both
`--git-user-name`		Git user.name for commits on the target host (set if not already configured)			Both
`--id`	`-i`	Canasta instance ID	*		Both
`--non-interactive`		Don't pause to prompt for registering the deploy key. The pause is skipped automatically when the deploy key already works; this flag additionally makes init fail fast (instead of hanging) when the key is not yet authorized — for unattended/CI runs where the key was pre-installed on the remote.			Both
`--pull-requests`		Require pull requests instead of pushing to main			Both
`--reinit`		Wipe local gitops state (.git, .gitops-host, env.template, wikis.yaml.template, hosts/, plus K8s chart files) before starting. Use after a previous init died mid-run, e.g. before the git push succeeded. Submodule structure is not fully restorable — extensions whose conversion finished before the failure may end up tracked as flat directories.			Both
`--role`		Host role	`both`		Both
`--ssh-key`		Path on the instance's host to an SSH private key for git network operations. When set, git runs with GIT_SSH_COMMAND="ssh -i <ssh-key> ...". On a remote host, give an absolute path or one starting with a quoted '~' (for example '~/x'). On Compose, the instance remembers the path, and later gitops commands use it when --ssh-key is omitted; passing it again replaces it. Without a remembered key, git uses ssh-agent forwarding on Compose, or the generated `<key>.ssh` deploy key on Kubernetes.			Both

* Defaults to the Canasta instance matching the current directory, if any.

Global flags

Flag	Shorthand	Description	Default	Required	Orchestrator
`--help`	`-h`	Show help message and exit			Both
`--verbose`	`-v`	Enable verbose output			Both