Day 0 — Design
Day 0 is everything that happens before you touch a single piece of hardware. It's the design phase: network plan, hardware selection, credential strategy, airgap approach, and the key architectural decisions that every subsequent step depends on.
Mistakes made on Day 0 are the most expensive to fix.
Changing a subnet after Harvester is installed means reinstalling Harvester. Changing the internal CA after cert-manager is running means rotating every certificate in the cluster. Choosing the wrong storage layout means migrating live Longhorn volumes. The time you spend on Day 0 pays for itself many times over.
Day 0 Checklist
Work through this checklist before starting Day 1. Every item here unblocks at least one step downstream.
- Hardware procured and physically cabled — all NICs connected, switch ports configured, power on and reachable via KVM/IP-KVM
- Network plan documented — subnet, gateway, all static IPs, VIPs, DHCP range, DNS zone. Written down, not just in your head. See Network Planning.
- Credentials obtained and stored — Carbide portal account, Docker Hub PAT, Harbor admin password chosen, step-ca password chosen, RKE2 token generated. All in
~/.config/RGS/creds. See Prerequisites. - Airgap strategy understood — you know which machine will do Hauler sync, how the tarball crosses the boundary, and that Harbor (not Hauler) is the permanent registry. See Airgap Design.
- DNS and IP plan finalized — no IP conflicts, no DNS name collisions, reverse zone planned. You cannot change IPs easily after nodes are provisioned.
- arm64 requirements noted — you've flagged every component that touches the DGX Spark and know it needs
linux/arm64platform entries in Hauler manifests.
Key Decisions Already Made
These are the architectural choices baked into this build. They're documented here so you understand the reasoning — and so you know what you're changing if you deviate.
| Decision | Choice | Rationale |
|---|---|---|
| Airgap transport | Hauler | RGS-native; handles images, Helm charts, and binary files in one store; OCI-native |
| Container registry | Harbor | Full OCI support, OIDC auth, Helm chart proxy, airgap-friendly push/pull |
| Internal CA | step-ca (Smallstep) | ACME protocol support, cert-manager StepIssuer CRD, fully airgap-capable |
| OIDC provider | Keycloak | Self-hostable; single IdP covering Rancher, Harbor, and DGX workloads |
| Harvester guest OS | SL-Micro 6.2 Base (QCOW2) | Consistent with Harvester's base OS; transactional updates; minimal footprint |
| IaC tool | OpenTofu | Open-source Terraform fork; Harvester provider compatible; no HashiCorp licensing concerns |
| Kubernetes CNI | Canal (default RKE2) | Sufficient for enclave networking; Cilium available as upgrade path if eBPF is needed |
| Primary AI serving | vLLM | GPU-native inference server with OpenAI-compatible API; Ollama as fallback |
| Model registry | Harbor OCI artifact | Keeps model weights inside the same trust boundary as container images |
| Load balancer | Harvester built-in LB | Harvester's integrated load balancer (kube-vip / MetalLB) owns the service VIPs; no separate HAProxy VM |
What You'll Have After Day 0
Day 0 produces no running services — it produces a plan. But a complete plan means Day 1 can proceed without stopping to make decisions:
- Hardware is racked, cabled, and accessible via KVM
- Every IP in the environment is assigned and documented
- Credentials are in place and the
~/.config/RGS/credsfile is populated on both the operator workstation and nuc-00 - The airgap strategy is understood: Hauler collects on the internet side, the tarball crosses the boundary, Harbor becomes authoritative after bootstrap
- The team (or solo operator) agrees on the component versions pinned in
scripts/env.d/carbide-enclave.sh
At that point, Day 1 is a linear sequence of steps with no design decisions left to make.
Day 0 Sub-pages
| Page | What it covers |
|---|---|
| Hardware | System specifications, NIC layout, KVM/IP-KVM management addresses, disk layout |
| Network Planning | Subnet, IP assignments, DNS design, DHCP, iPXE boot chain, Kubernetes internal networks |
| Airgap Design | How the airgap boundary works, the Hauler lifecycle, the two-phase registry strategy, the five hard rules |
| Prerequisites | Credentials, operator workstation tooling, knowledge requirements |