.
├── .devcontainer/
│ ├── devcontainer.json # VS Code / Codespaces definition, forwarded port 80
│ ├── docker-compose.yml # two containers: devcontainer + k3s-server
│ ├── devcontainer.Dockerfile # CLIs: kubectl, helm, cilium, hubble, argocd, kubescape
│ ├── bootstrap.sh # Cilium, Argo CD, PUBLIC_URL, root app
│ └── versions.env # pinned versions used by bootstrap.sh
├── gitops/ # everything Argo CD deploys
│ ├── root-app.yaml # template for the app of apps (filled in by bootstrap.sh)
│ ├── apps/ # Helm chart -> one Argo CD Application per component/project
│ │ └── values.yaml # <- the list of research projects lives here
│ ├── platform/ # StorageClasses, Hubble UI ingress
│ ├── keycloak/ # Keycloak Deployment + realm (users, groups, client)
│ ├── jupyterhub/ # Z2JH chart values, RBAC, ingress
│ │ └── files/tre_config.py # <- project-aware spawning logic
│ ├── network-policies/ # CiliumNetworkPolicy for JupyterHub itself
│ ├── kyverno/ # ClusterPolicies + RBAC for generate
│ ├── projects/chart/ # Helm chart: everything one project needs
│ └── portal/ # landing page
├── scripts/
│ ├── tre # helper CLI (tre info, status, hubble...)
│ └── validate.sh # static checks run by CI (helm, kustomize, kubeconform)
├── tests/
│ ├── test_tre_config.py # pytest: spawner logic against real KubeSpawner
│ ├── e2e/ # real hub + proxy vs mock Keycloak and fake Kubernetes API
│ └── kyverno/ # kyverno CLI tests for the policies
├── AGENTS.md / CLAUDE.md # guidance for coding agents (see Getting started)
├── .agents/skills/ # agent skills (also linked from .claude/ and .github/)
├── docs/ # this site (Zensical)
├── zensical.toml # site configuration
└── .github/workflows/
├── docs.yml # build + publish docs to GitHub Pages
└── validate.yml # lint, render and test everything